New details have emerged about the remote computer intrusion at a Florida water treatment facility last Friday, highlighting a lack of adequate security measures needed to bulletproof critical infrastructure environments.
The breach involved an unsuccessful attempt on the part of an adversary to increase sodium hydroxide dosage in the water supply to dangerous levels by remotely accessing the SCADA system at the water treatment plant. The system's plant operator, who spotted the intrusion, quickly took steps to reverse the command, leading to minimal impact.
Now, according to an advisory published on Wednesday by the state of Massachusetts, unidentified cyber actors accessed the supervisory control and data acquisition (SCADA) system via TeamViewer software installed on one of the plant's several computers that were connected to the control system.
Not only were these computers running 32-bit versions of the Windows 7 operating system, but the machines also shared the same password for remote access and are said to have been exposed directly to the Internet without any firewall protection installed.
It's worth noting that Microsoft Windows 7 reached end-of-life as of last year, on January 14, 2020.
Adding to the woes, more often than not, many small public utilities are saddled with aging infrastructure, and the IT departments tend to be under-resourced, lacking in budget and expertise to upgrade their security posture and address vulnerabilities in a timely fashion.
"Restrict all remote connections to SCADA systems, specifically those that allow physical control and manipulation of devices within the SCADA network," Massachusetts state officials said. "One-way unidirectional monitoring devices are recommended to monitor SCADA systems remotely."
"Keep computers, devices, and applications, including SCADA/industrial control systems (ICS) software, patched and up-to-date," the alert cautioned, adding "use two-factor authentication with strong passwords."
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in a separate alert published today, warned of "cybercriminals targeting and exploiting desktop sharing software and computer networks running operating systems with end of life status to gain unauthorized access to systems."
The agency, besides recommending protective measures such as installing independent cyber-physical safety systems, also issued additional guidance when using TeamViewer, urging organizations to configure the service to "manual start" and refrain from using unattended access features.
