Hackers exploited shared passwords and obsolete Windows 7 systems to infiltrate Florida water treatment plant
Weak network security measures and an obsolete version of Windows allowed hackers to compromise the computer systems at a water treatment plant in Oldsmar, Florida, and alter the chemical levels in the plant's water, federal investigators stated in an advisory issued this week.
According to government officials, computer systems at the Bruce T. Haddock Water Treatment Plant in Oldsmar were running on Windows 7, which has not received security updates from Microsoft for a year.
"The hackers also likely used the desktop sharing software TeamViewer to gain unauthorised access to the system," the officials stated.
They further revealed that all systems shared the same password for remote access and were connected directly to the Internet without any type of firewall protection.
The government advisory also stated that the unidentified attacker logged into the remote access TeamViewer software, accessed the supervisory control and data acquisition (SCADA) system and then attempted to increase sodium hydroxide levels by 100 times.
Sodium hydroxide, also known as lye, is used in small amounts to remove metals from water.
Fortunately the attacker's attempt to poison the water supply was stopped almost immediately. A supervisor tasked with monitoring the control systems noticed the mouse pointer on a plant console moving across the screen.
The supervisor also observed that the intruder had changed the "dosing amounts" settings on the system.
Senior officials at the plant were immediately reversed the changes, and the water treatment process was unaffected.
Had the alterations not been noticed, it would have taken about 24-36 ..
Support the originator by clicking the read the rest link below.
