Site icon IT World Canada

Researcher says Florida water plant attack was ‘immature, rushed or unintentional’

Howard Solomon
Featured image - cyber attack

The person who broke into a Florida water treatment plant and increased the concentration of a chemical likely wasn’t an experienced attacker, argues a senior security researcher with Domain Tools.

The attack “was either immature, rushed, or potentially unintentional,” Joe Slowik wrote in an analysis on Thursday.

It was just one of several analyses of the scary incident that the City of Oldsmar publicized on Monday.

Slowik came to his conclusion by considering three facts:

  1. Events took place during normal operational hours where personnel were on-hand and available to quickly respond;
  2. The intruder did not attempt to hide or mask their activity through interaction with or overwrite of HMI (human-machine interface) systems or spoofing of sensor data;
  3. The modification to sodium hydroxide levels was so extreme as to almost certainly trigger engineering or other non-ICS (industrial control system) controls or alarms within the environment.

“Although the incident resulted in neither significant disruption nor outright damage, the simple fact that some unknown entity attempted the above action is deeply concerning, reflecting either callousness given the potential harm, or ignorance as to what the attempted change might have produced in the serviced population,” he added.

According to statements from the city and news reports, someone accessed the water plant management system through the remote access software TeamViewer and boosted the amount of sodium hydroxide (lye) in the water treatment system. News reports say the access password was shared among a number of employees. A plant worker noticed the manipulation of the sodium hydroxide on his screen and when the attacker returned the level to its proper point.

While crafting a conclusion, Slowik looked at four well-known cyberattacks on ICS systems:

The 2009 Stuxnet attack on Iran’s centrifuges at a nuclear enrichment plant. “The critical item enabling Stuxnet’s success was the malware’s ability to induce a general loss or denial of view condition in the victim environment. In this specific case, the malware recorded “normal” plant operations then played these recordings back to monitoring systems during physical attack sequences to mask events from plant operators. Absent this critical step, operators would have been able to detect anomalous operations in the plant environment enabling intervention and process diagnosis;

The 2015 attack on Ukraine’s power grid which caused a widespread blackout. For that operations to succeed, Slowik said, plant personnel had to be locked out of their workstations to prevent operator intervention during the initial phases of the attack. Then wiper malware removed remote operational control, after which a malicious firmware update to serial-to-ethernet converters made communicating with equipment impossible. Six Russians military intelligence members have been accused of being behind this and other attacks;

The 2016 attack on Ukraine’s power grid. The incident again wiped control systems to induce loss of control, Slowik says, although it was also likely aimed at a loss of view condition as well to enable a potentially destructive (if failed) physical damage scenario. “In this particular case, removing operator logical control (to force manual operations) combined with loss of logical view into the health and status of the system was used in sequence to enable a process protection-focused attack scenario. Absent these conditions, it would be highly unlikely for the sequence of events required to restore operations in an unprotected, unsafe state (enabling possible destruction) would materialize;”

The 2017 attack on a petrochemical plant in Saudi Arabia led to multiple unexpected plant shutdowns due to the plant’s safety instrumented systems (SIS) tripping for then-unknown reasons. Using purpose-built malware the goal was to enable undetected, arbitrary modification of SIS parameters, says Slowik. Combined with access elsewhere in the plant environment, an attacker could remove or alter safety controls to induce physical damage. But to succeed the attacker had to alter parameters without operators knowing such changes took place.

“In all four examples the attacks required some mechanism to hide from operators or deny their ability to correct or mitigate changes made to operating parameters,” Slowik wrote. The Oldsmar attacker didn’t do that.

Still, the incident highlights the real risks and dangers associated with remote access to critical infrastructure systems, he said. Removing or curtailing remote access is unrealistic, he argues, given the needs of organizations to control widely spread devices and vendor maintenance needs.

Instead, he suggests mitigations:

Through a combination of network hardening, attack surface reduction, network segmentation, and NSM with indicator enrichment, defenders can dramatically reduce the likelihood of successful attacks, says Slowik, significantly reduce their efficacy, or increase the likelihood of identifying such activity at relatively early stages.

More advice from CISA

In its notice, CISA advised water treatment facilities to install independent cyber-physical safety systems that physically prevent dangerous conditions from occurring if a control system is compromised by a threat actor. These controls can include the size of a chemical pump or reservoir, the gearing on valves and pressure switches.

The agency also offered this advice to better secure TeamViewer:

Exit mobile version