<story><title>Hacker increased chemical level at Oldsmar&apos;s city water system, sheriff says</title><url>https://www.wtsp.com/article/news/local/pinellascounty/pinellas-oldsmar-water-system-computer-intrustion/67-512b2bab-9f94-44d7-841e-5169fdb0a0bd</url></story><parent_chain><item><author>rsync</author><text>&amp;quot;In a perfect world, maybe there would be unlimited budgets for small rural water districts to have 24&amp;#x2F;7 onsite staff and run highly secured networks.&amp;quot;&lt;p&gt;I reject this line of thought.&lt;p&gt;A small rural water district can run with looser tolerances and looser guarantees - and have done so for decades.&lt;p&gt;They should spend half the time (and a quarter of the money) setting up systems that fail safely and revert to known states and operate with looser tolerances.&lt;p&gt;As for telemetry ...&lt;p&gt;I am not joking at all when I say that a green light on the building that turns red and everyone in the county knows to call &lt;i&gt;either&lt;/i&gt; Jed or Billy if that light is red is a &lt;i&gt;completely reasonable system&lt;/i&gt;.  It&amp;#x27;s a small rural water district (your words) after all, right ?</text></item><item><author>ac29</author><text>In a perfect world, maybe there would be unlimited budgets for small rural water districts to have 24&amp;#x2F;7 onsite staff and run highly secured networks.&lt;p&gt;I regularly work with these sorts of water districts (larger, better funded ones as well). In reality, some of these small districts may only have 2 or 3 SCADA operators on staff. Sending them home with a pager, a tablet, a VPN password, and some overtime pay is a lot easier to get past the city council then taking on another two employees to cover the night shift for those rare events that need to be handled ASAP.&lt;p&gt;I could share some real horror stories, but it wouldnt be professionally appropriate. Suffice to say, this story did not surprise me at all.</text></item><item><author>rsync</author><text>&amp;quot;Internet-accessble industrial control systems have been a problem for many years now ...&amp;quot;&lt;p&gt;They are a problem the way drunk driving is a problem.&lt;p&gt;You just don&amp;#x27;t ever do it.  Ever.&lt;p&gt;No cyber security products are needed.  No budget required.&lt;p&gt;These &amp;quot;startups in the ICS space&amp;quot; are like turbotax&amp;#x2F;HRBlock:  only continued idiocy allows their business model to exist.</text></item><item><author>achillean</author><text>Internet-accessble industrial control systems have been a problem for many years now. It&amp;#x27;s a documented issue but it&amp;#x27;s difficult to fix for a variety of reasons:&lt;p&gt;1. Difficult to identify the owner: a lot of the devices are on mobile networks that don&amp;#x27;t point to an obvious owner.&lt;p&gt;2. Unknown criticality: is it a demo system or something used in production?&lt;p&gt;3. Security budget: lots of smaller utilities don&amp;#x27;t have a budget for buying cyber security products.&lt;p&gt;4. Uneducated vendor: sometimes the vendors of the device give very bad advice (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;why-control-systems-are-on-the-internet&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;why-control-systems-are-on-the-intern...&lt;/a&gt;)&lt;p&gt;That being said, based on the numbers in Shodan the situation has improved over the past decade. And there&amp;#x27;s been a large resurgence of startups in the ICS space (ex &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.dragos.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.dragos.com&lt;/a&gt;, &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.gravwell.io&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.gravwell.io&lt;/a&gt;). Here&amp;#x27;s a current view of exposed industrial devices on the Internet:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;beta.shodan.io&amp;#x2F;search&amp;#x2F;report?query=tag%3Aics&amp;amp;title=Industrial%20Control%20Systems%20Overview&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;beta.shodan.io&amp;#x2F;search&amp;#x2F;report?query=tag%3Aics&amp;amp;title=I...&lt;/a&gt;&lt;p&gt;I&amp;#x27;ve written&amp;#x2F; presented on the issue a few times:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;taking-things-offline-is-hard&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;taking-things-offline-is-hard&amp;#x2F;&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;trends-in-internet-exposure&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;trends-in-internet-exposure&amp;#x2F;&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;exposure.shodan.io&amp;#x2F;#&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;exposure.shodan.io&amp;#x2F;#&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>EvanAnderson</author><text>re: alerting telemetry - I&amp;#x27;m not finding photos to cite right now, but I&amp;#x27;ve absolutely seen &amp;quot;infrastructure&amp;quot; buildings (here in rural Ohio) with warning annunciators (lights and bells) on their exteriors along with signs reading &amp;quot;If this light is flashing call xxx.&amp;quot; It&amp;#x27;s definitely a viable system for alerting.&lt;p&gt;I like your thinking and I try to espouse it myself (keeping things as simple as they can be-- keeping &amp;quot;technology&amp;quot; out of voting, not connecting things to networks that have no business being connected, etc). Short of a Battlestar Galactica-type &amp;quot;our machines rise up and try to kill us&amp;quot; event, though, I don&amp;#x27;t think the average person will ever understand the vulnerability inherent in networked computers or the risk&amp;#x2F;benefit tradeoff of connected vs. disconnected systems.&lt;p&gt;Even down at the level of local politics in a rural setting the &amp;quot;optics&amp;quot; of bringing technological solutions to bear on problems is seen as forward-thinking-- particularly when it &amp;quot;saves&amp;quot; the taxpayer money. I can&amp;#x27;t imagine trying to convince a local water board that moving away from a PLC-based system with a remote support vendor world fly, even citing this example.&lt;p&gt;This event will be another opportunity for more security vendors to cite in case studies justifying their products. More layers of garbage will build up on a foundation of protocols and design philosophies that grew up in an era of disconnected systems with lower stakes and a less complex threat model.&lt;p&gt;I don&amp;#x27;t see big money to be made in providing sensible levels of connectivity and security to this kind of infrastructure. I don&amp;#x27;t see industry stepping-up because of that. Maybe regulation is the answer, though I&amp;#x27;d just expect regulatory capture to take over, and have it become another &amp;quot;PCI&amp;quot;. Maybe a lot of people have to die before society takes it seriously, as has been the case with so many other safety codes over human history.&lt;p&gt;It makes me really sad, embarrassed for our industry, and more disappointed in human nature.</text></comment>
<story><title>Hacker increased chemical level at Oldsmar&apos;s city water system, sheriff says</title><url>https://www.wtsp.com/article/news/local/pinellascounty/pinellas-oldsmar-water-system-computer-intrustion/67-512b2bab-9f94-44d7-841e-5169fdb0a0bd</url></story><parent_chain><item><author>rsync</author><text>&amp;quot;In a perfect world, maybe there would be unlimited budgets for small rural water districts to have 24&amp;#x2F;7 onsite staff and run highly secured networks.&amp;quot;&lt;p&gt;I reject this line of thought.&lt;p&gt;A small rural water district can run with looser tolerances and looser guarantees - and have done so for decades.&lt;p&gt;They should spend half the time (and a quarter of the money) setting up systems that fail safely and revert to known states and operate with looser tolerances.&lt;p&gt;As for telemetry ...&lt;p&gt;I am not joking at all when I say that a green light on the building that turns red and everyone in the county knows to call &lt;i&gt;either&lt;/i&gt; Jed or Billy if that light is red is a &lt;i&gt;completely reasonable system&lt;/i&gt;.  It&amp;#x27;s a small rural water district (your words) after all, right ?</text></item><item><author>ac29</author><text>In a perfect world, maybe there would be unlimited budgets for small rural water districts to have 24&amp;#x2F;7 onsite staff and run highly secured networks.&lt;p&gt;I regularly work with these sorts of water districts (larger, better funded ones as well). In reality, some of these small districts may only have 2 or 3 SCADA operators on staff. Sending them home with a pager, a tablet, a VPN password, and some overtime pay is a lot easier to get past the city council then taking on another two employees to cover the night shift for those rare events that need to be handled ASAP.&lt;p&gt;I could share some real horror stories, but it wouldnt be professionally appropriate. Suffice to say, this story did not surprise me at all.</text></item><item><author>rsync</author><text>&amp;quot;Internet-accessble industrial control systems have been a problem for many years now ...&amp;quot;&lt;p&gt;They are a problem the way drunk driving is a problem.&lt;p&gt;You just don&amp;#x27;t ever do it.  Ever.&lt;p&gt;No cyber security products are needed.  No budget required.&lt;p&gt;These &amp;quot;startups in the ICS space&amp;quot; are like turbotax&amp;#x2F;HRBlock:  only continued idiocy allows their business model to exist.</text></item><item><author>achillean</author><text>Internet-accessble industrial control systems have been a problem for many years now. It&amp;#x27;s a documented issue but it&amp;#x27;s difficult to fix for a variety of reasons:&lt;p&gt;1. Difficult to identify the owner: a lot of the devices are on mobile networks that don&amp;#x27;t point to an obvious owner.&lt;p&gt;2. Unknown criticality: is it a demo system or something used in production?&lt;p&gt;3. Security budget: lots of smaller utilities don&amp;#x27;t have a budget for buying cyber security products.&lt;p&gt;4. Uneducated vendor: sometimes the vendors of the device give very bad advice (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;why-control-systems-are-on-the-internet&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;why-control-systems-are-on-the-intern...&lt;/a&gt;)&lt;p&gt;That being said, based on the numbers in Shodan the situation has improved over the past decade. And there&amp;#x27;s been a large resurgence of startups in the ICS space (ex &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.dragos.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.dragos.com&lt;/a&gt;, &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.gravwell.io&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.gravwell.io&lt;/a&gt;). Here&amp;#x27;s a current view of exposed industrial devices on the Internet:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;beta.shodan.io&amp;#x2F;search&amp;#x2F;report?query=tag%3Aics&amp;amp;title=Industrial%20Control%20Systems%20Overview&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;beta.shodan.io&amp;#x2F;search&amp;#x2F;report?query=tag%3Aics&amp;amp;title=I...&lt;/a&gt;&lt;p&gt;I&amp;#x27;ve written&amp;#x2F; presented on the issue a few times:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;taking-things-offline-is-hard&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;taking-things-offline-is-hard&amp;#x2F;&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;trends-in-internet-exposure&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.shodan.io&amp;#x2F;trends-in-internet-exposure&amp;#x2F;&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;exposure.shodan.io&amp;#x2F;#&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;exposure.shodan.io&amp;#x2F;#&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>sillysaurusx</author><text>I invite you to become a pentester for a year and see if you still reject this line of thought.</text></comment>