Hackers attack the water

Recently, hackers have attempted to poison the distribution network in the town of Oldsmar.

According to the authorities, the aim of cybercriminals was to increase the amount of caustic soda in the water distributed to the population.

The population of the city of Florida escaped beautiful. The attack was narrowly averted, as the authorities claim. But it has nevertheless highlighted the vulnerabilities attributable to the water plant's treatment system and this presents an undeniable risk especially in this period of global health crisis.

This article will also interest you: More and more communities affected in France by ransomware

This Monday, January 8 could have been dramatic for the residents of the small Florida town of Oldsmar. Indeed, without the intervention in extremis of the authorities, the water they were going to collect from the tap was going to be poisoned.

The intervention that saved the 15,000 residents of the city of Florida was the work of an operator who managed to perceive the computer attack in time. He quickly realized that the panels were remotely directed by a third party. He had the right reflex to save the entire facility.

What exactly happened? it took only 5 minutes for the hacker to successfully infiltrate the entire network and circumstantically increase the amount of sodium dioxide, that is, caustic soda. It is a low-dose product that promotes the preservation of water ducts by avoiding their corrosions. However, when given in large doses, it automatically becomes poison. It can cause eye damage or burns to the skin.

On the political side, Marco Rubio, the Republican senator from Florida, this computer attack is a matter of "national security." He also mentioned the intervention of the Federal Police, FBI in association with the local police to carry out this investigation.

"This attempt illustrates the nightmare of the entire cybersecurity community because it demonstrates the potential impact on the health of individuals from such an attack," notes the head of cybersecurity strategy for the US computer security company Tenable Adam Palmer, in an interview with France 24.

However, this is not the first time that water treatment plants in the United States have been targeted by cyberattacks. For this reason, the authorities had stated that a power plant had been targeted without giving further details on its location. In this case, the hackers had attempted to change the composition of the products used for water maintenance. Outside the U.S. borders, this was observed in April 2020 in Israel. The water treatment plant in one locality was also targeted by a computer attack for the same purposes. Of course the cyberattack was easily foiled.

This attraction of cyber criminals to water treatment infrastructure is explained by the fact that equipment is totally overwhelmed by the evolution of cybercrime. Unfortunately this problem is not only observable in the sector. "There is often a large mesh of the territory with a large number of facilities, up to the small water castles in the countryside, which must be secured. This is a dantesque job," says Gérôme Billois, an IT security specialist for the consulting firm Wavestone. According to the expert, many of these facilities operate with security systems that were "put in place decades ago, at a time when the cyber threat was not yet as advanced."

As part of the city of Florida, the authorities mentioned the fact that security systems are in the old category compared to new threats. According to Chérif's statement at a press briefing, the computer attack could well be the work of terrorist groups or a lone hacker went into his garage. The security flaw according to the authorities could be at the level of a control panel that the employees of the water treatment plant have in their homes in order to be able to intervene remotely from their homes to manage the emergency. It should be noted that such a device surprised many. Even if some experts like Gérôme billois believes that there is nothing wrong with such devices. "To be able to intervene in a crisis." On the other hand, it is much more surprising that this software can increase the amount of caustic soda in water to levels dangerous to health," he said.

For his part, Adam Palmer notes: "It would be wrong to believe that the control systems of these facilities and the company's computer networks are always perfectly separate. Even within some sensitive infrastructure." Not to mention the additional risk from the coronavirus pandemic. "With the commoditization of remote work, companies have been quick to find ways for employees to continue working from home, sometimes not measuring the implications in terms of IT security." Highlights Adam Palmer.

Now access an unlimited number of passwords: