Insider may have attacked water treatment plant

Authorities investigating the intrusion into a water treatment control system in the city of Oldsmar, Florida, think the attack may have been prepared and carried out by an employee unhappy with the company operating the service. The attacker gained access to SCADA systems through TeamViewer, an application used by system administrators primarily for remote support.

During the time he was connected to the network, he accessed the operation and monitoring software and raised the levels of sodium hydroxide (a chemical for water purification) to levels considered dangerous. The attacker’s actions could have been disastrous had they not been detected in time by the wastewater treatment plant operator. However, the company itself has organized an insecure structure and method of access, greatly facilitating intrusion and attack.

For remote access to all computers, the same password was used; all computers were connected directly to the Internet; in addition, the network was not behind a firewall.

“In other words,” said one of the people investigating the matter, “system administrators at the wastewater treatment plant did not bother to set separate passwords for the software that gives their computers full access. In other words, a factory employee could change the levels of chemicals in tap water across the city with a snap of his fingers anywhere in the world. ”

According to the former director of the United States Cyber ​​Security and Infrastructure Agency (CISA), Christopher Krebs, this is exactly what happened. According to Krebs, the change in the level of sodium hydroxide in tap water is probably the job of an insider, who could be an employee of the offended sewage treatment plant. The attacker probably already has

Most interestingly, station system administrators stopped using TeamViewer six months ago, but never uninstalled it, said Oldsmar sheriff Bob Gualtieri.

With international agencies