<story><title>Hacker increased chemical level at Oldsmar&apos;s city water system, sheriff says</title><url>https://www.wtsp.com/article/news/local/pinellascounty/pinellas-oldsmar-water-system-computer-intrustion/67-512b2bab-9f94-44d7-841e-5169fdb0a0bd</url></story><parent_chain><item><author>rsync</author><text>&amp;quot;Internet-accessble industrial control systems have been a problem for many years now ...&amp;quot;&lt;p&gt;They are a problem the way drunk driving is a problem.&lt;p&gt;You just don&amp;#x27;t ever do it.  Ever.&lt;p&gt;No cyber security products are needed.  No budget required.&lt;p&gt;These &amp;quot;startups in the ICS space&amp;quot; are like turbotax&amp;#x2F;HRBlock:  only continued idiocy allows their business model to exist.</text></item><item><author>achillean</author><text>Internet-accessble industrial control systems have been a problem for many years now. It&amp;#x27;s a documented issue but it&amp;#x27;s difficult to fix for a variety of reasons:&lt;p&gt;1. Difficult to identify the owner: a lot of the devices are on mobile networks that don&amp;#x27;t point to an obvious owner.&lt;p&gt;2. Unknown criticality: is it a demo system or something used in production?&lt;p&gt;3. Security budget: lots of smaller utilities don&amp;#x27;t have a budget for buying cyber security products.&lt;p&gt;4. Uneducated vendor: sometimes the vendors of the device give very bad advice (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;why-control-systems-are-on-the-internet&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;why-control-systems-are-on-the-intern...&lt;/a&gt;)&lt;p&gt;That being said, based on the numbers in Shodan the situation has improved over the past decade. And there&amp;#x27;s been a large resurgence of startups in the ICS space (ex &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.dragos.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.dragos.com&lt;/a&gt;, &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.gravwell.io&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.gravwell.io&lt;/a&gt;). Here&amp;#x27;s a current view of exposed industrial devices on the Internet:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;beta.shodan.io&amp;#x2F;search&amp;#x2F;report?query=tag%3Aics&amp;amp;title=Industrial%20Control%20Systems%20Overview&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;beta.shodan.io&amp;#x2F;search&amp;#x2F;report?query=tag%3Aics&amp;amp;title=I...&lt;/a&gt;&lt;p&gt;I&amp;#x27;ve written&amp;#x2F; presented on the issue a few times:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;taking-things-offline-is-hard&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;taking-things-offline-is-hard&amp;#x2F;&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;trends-in-internet-exposure&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;trends-in-internet-exposure&amp;#x2F;&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;exposure.shodan.io&amp;#x2F;#&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;exposure.shodan.io&amp;#x2F;#&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>ac29</author><text>In a perfect world, maybe there would be unlimited budgets for small rural water districts to have 24&amp;#x2F;7 onsite staff and run highly secured networks.&lt;p&gt;I regularly work with these sorts of water districts (larger, better funded ones as well). In reality, some of these small districts may only have 2 or 3 SCADA operators on staff. Sending them home with a pager, a tablet, a VPN password, and some overtime pay is a lot easier to get past the city council then taking on another two employees to cover the night shift for those rare events that need to be handled ASAP.&lt;p&gt;I could share some real horror stories, but it wouldnt be professionally appropriate. Suffice to say, this story did not surprise me at all.</text></comment>
<story><title>Hacker increased chemical level at Oldsmar&apos;s city water system, sheriff says</title><url>https://www.wtsp.com/article/news/local/pinellascounty/pinellas-oldsmar-water-system-computer-intrustion/67-512b2bab-9f94-44d7-841e-5169fdb0a0bd</url></story><parent_chain><item><author>rsync</author><text>&amp;quot;Internet-accessble industrial control systems have been a problem for many years now ...&amp;quot;&lt;p&gt;They are a problem the way drunk driving is a problem.&lt;p&gt;You just don&amp;#x27;t ever do it.  Ever.&lt;p&gt;No cyber security products are needed.  No budget required.&lt;p&gt;These &amp;quot;startups in the ICS space&amp;quot; are like turbotax&amp;#x2F;HRBlock:  only continued idiocy allows their business model to exist.</text></item><item><author>achillean</author><text>Internet-accessble industrial control systems have been a problem for many years now. It&amp;#x27;s a documented issue but it&amp;#x27;s difficult to fix for a variety of reasons:&lt;p&gt;1. Difficult to identify the owner: a lot of the devices are on mobile networks that don&amp;#x27;t point to an obvious owner.&lt;p&gt;2. Unknown criticality: is it a demo system or something used in production?&lt;p&gt;3. Security budget: lots of smaller utilities don&amp;#x27;t have a budget for buying cyber security products.&lt;p&gt;4. Uneducated vendor: sometimes the vendors of the device give very bad advice (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;why-control-systems-are-on-the-internet&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;why-control-systems-are-on-the-intern...&lt;/a&gt;)&lt;p&gt;That being said, based on the numbers in Shodan the situation has improved over the past decade. And there&amp;#x27;s been a large resurgence of startups in the ICS space (ex &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.dragos.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.dragos.com&lt;/a&gt;, &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.gravwell.io&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.gravwell.io&lt;/a&gt;). Here&amp;#x27;s a current view of exposed industrial devices on the Internet:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;beta.shodan.io&amp;#x2F;search&amp;#x2F;report?query=tag%3Aics&amp;amp;title=Industrial%20Control%20Systems%20Overview&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;beta.shodan.io&amp;#x2F;search&amp;#x2F;report?query=tag%3Aics&amp;amp;title=I...&lt;/a&gt;&lt;p&gt;I&amp;#x27;ve written&amp;#x2F; presented on the issue a few times:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;taking-things-offline-is-hard&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;taking-things-offline-is-hard&amp;#x2F;&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;trends-in-internet-exposure&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;trends-in-internet-exposure&amp;#x2F;&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;exposure.shodan.io&amp;#x2F;#&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;exposure.shodan.io&amp;#x2F;#&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>crystalmeph</author><text>I work in industrial automation, and I agree.  There’s constant rhetoric about buzzwords like “Industry 4.0,” which, if it means anything specifically, means “connect all the things.”&lt;p&gt;There doesn’t seem to be a whole lot of thought around “is it even necessary for this three-ton industrial robot to be dynamically reprogrammed from a service center in Stockholm,” and it seems like everyone just assumes that everyone else will do a perfect job implementing and configuring security.  I fear the tune will only change after the first multi-million dollar lawsuit, and I hope all that costs is the money.</text></comment>