Foreign hackers targeted US water plant in apparent malicious cyber attack ... - Washington Post (blog)

Foreign hackers caused a pump at an Illinois water plant to fail last week, according to a preliminary state report. Experts said the cyber-attack, if confirmed, would be the first known to have damaged one of the systems that supply Americans with water, electricity and other essentials of modern life.

Companies and government agencies that rely on the Internet have for years been routine targets of hackers, but most incidents have resulted from attempts to steal information or interrupt the functioning of Web sites. The incident in Springfield, Ill., would mark a departure because it apparently caused physical destruction.

Federal officials confirmed that the FBI and the Department of Homeland Security were investigating damage to the water plant but cautioned against concluding that it was necessarily a cyber-attack before all the facts could be learned. “At this time there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety,” said DHS spokesman Peter Boogaard.

News of the incident became public after Joe Weiss, an industry security expert, obtained a report dated Nov. 10 and collected by an Illinois state intelligence center that monitors security threats. The original source of the information was unknown and impossible to immediately verify.

The report, which Weiss read to The Washington Post, describes how a series of minor glitches with a water pump gradually escalated to the point where the pump motor was being turned on and off frequently. It soon burned out, according to the report.

The report blamed the damage on the actions of somebody using a computer registered to an Internet address in Russia. “It is believed that hackers had acquired unauthorized access to the software company’s database” and used this information to penetrate the control system for the water pump.

Experts cautioned that it is difficult to trace the origin of a cyber-attack, and that false addresses often are used to confuse investigations. Yet they also agreed that the incident was a major new development in cyber-security.

“This is a big deal,” said Weiss. “It was tracked to Russia. It has been in the system for at least two to three months. It has caused damage. We don’t know how many other utilities are currently compromised.”

Dave Marcus, director of security research for McAfee Labs, said that the computers that control critical systems in the United States are vulnerable to attacks that come through the Internet, and few operators of these systems know how to detect or defeat these threats. “So many are ill-prepared for cyber-attacks,” Marcus said.

The Illinois report said that hackers broke into a software company’s database and retrieved user names and passwords of control systems that run water plant computer equipment. Using that data, they were able to hack into the plant in Illinois, Weiss said.

Senior U.S. officials have recently raised warnings about the risk of destructive cyber-attacks on critical infrastructure. One of the few documented cases of such an attack resulted from a virus, Stuxnet, that caused centrifuges in an Iranian uranium enrichment facility to spin out of control last year. Many computer security experts have speculated that Stuxnet was created by Israel — perhaps with U.S. help — as a way to check Iran’s nuclear program.

More cybersecurity coverage

- Proactive steps against cyberattacks

- Pentagon: Offensive cyber attacks fair game

- Cyberspying report names China, Russia

- In cyberspace, growing calls for clarity on what U.S. can do to deter against attacks

View the original article here

Report: Russian hackers targeted Springfield water pump - WJBC News

SPRINGFIELD – Federal officials are investigating a report that Russian hackers shut down a water pump near Springfield last week.

The Springfield Journal-Register reports the Curran-Gardner Public Water District may have been targeted by the alleged cyberattack. The U.S. Department of Homeland Security is investigating, but no major service disruption was reported.

The Nov. 8 water-pump burnout was first reported by a cybersecurity blog, based on a one-page report from the Illinois Statewide Terrorism and Intelligence Center.

A water district trustee says there’s some indication of an attempt to breach the system’s Supervisory Control and Data Acquisition computer system, but no confirmation yet.

No word on why the tiny water district was targeted.

jQuery.fbInit({fb_options:{appId: '190997570932575',channelUrl: 'http://wjbc.com/wp-content/plugins/facebook/library/channel.html'}});

View the original article here

Int'l hackers blamed in water pump attack

Published: Nov. 18, 2011 at 7:19 PM

WASHINGTON, Nov. 18 (UPI) -- Hackers outside the United States were responsible for damaging the municipal water system in Springfield, Ill., an expert says.

Joe Weiss provided information from a report on the Illinois attack to The Washington Post. A Department of Homeland Security spokesman confirmed the damaged water pump in Springfield and said federal agents were trying to determine if it was the result of a computer attack, the newspaper said.

The report said the pump burned out after the system powered up and down unpredictably. Weiss said a municipal water district employee noticed the problems Nov. 8, and a technician determined the system had been hacked into from a computer in Russia.

Computer hackers made a two-stage attack, Weiss said. The first was hacking into a software company data base to obtain the passwords needed for later attacks.

The report said investigators do not know if the hackers succeeded in getting into other systems.

"This is a big deal," Weiss said.

The computer used by the hackers is believed to be physically located in Russia.

View the original article here

Foreign hackers attack Springfield water plant system

Foreign hackers broke into a water plant control system in Springfield last week and damaged a water pump in what may be the first reported case of a malicious cyber attack on a critical computer system in the United States, according to an industry expert.

On Nov. 8, a municipal water district employee noticed problems with the Curran-Gardener Township Public Water District's water pump control system, and a technician determined the system had been remotely hacked into from a computer located in Russia, said Joe Weiss, an industry security expert who obtained a copy of an Illinois state fusion center report describing the incident.

Problems with the system had been observed for two to three months and recently the system “would power on and off, resulting in the burnout of a water pump,” the Nov. 10 report from the U.S. Department of Homeland Security, according to Weiss, who read the report to The Washington Post.

“This is a big deal,” said Weiss. The report stated it is unknown how many other systems might be affected.

According to the report, hackers apparently broke into a software company's database and retrieved user names and passwords of various control systems that run water plant computer equipment. Using that data, they were able to hack into the plant in Illinois, Weiss said.

It's not the first time that two-step technique — hack a security firm to gain the keys to enter other companies or entities — has been used.

Earlier this year, hackers believed to be working from China stole sensitive data from RSA, a division of EMC that provides secure remote computer access to government agencies, defense contractors and other commercial companies around the world. Armed with that data, they breached the computer networks of companies, including Lockheed Martin, whose employees used RSA “tokens” to log in to the corporate system from outside the office. Lockheed said that no sensitive data were taken.

“RSA is the gold standard” for remote access security in industry, said Gen. Keith Alexander, head of U.S. Cyber Command and director of the National Security Agency, at a conference in Omaha this week. “If they got hacked, where does that leave the rest?”

Alexander noted his concern about “destructive” attacks on critical systems in the United States.

The Department of Homeland Security, whose job is to oversee the protection of critical infrastructure such as water utility computer systems in the United States, said that DHS and the FBI are investigating the Illinois incident. “At this time there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety,” DHS spokesman Peter Boogaard said in an emailed statement.

According to the fusion center report obtained by Weiss, the network intrusion of the software company “is the same method of attack recently used against a Massachusetts Institute of Technology server” used to “aid and initiate an attack on other websites.”

For Weiss, though, the incident has significance. “It was tracked to Russia. It has been in the system for at least two to three months. It has caused damage. We don't know how many other utilities are currently compromised.”

Senior U.S. officials, including Alexander, have recently raised warnings about the risk of cyber attacks on critical infrastructure. Questions persist about the readiness and capabilities of DHS to respond to a major attack, and the scope of authority of the U.S. military, which has the greatest cyber operational capabilities, to respond.

View the original article here