Update: The cyber-attack of a water treatment plant in Springfield, Ill., reported by the Washington Post's blog CheckPoint Washington, turned out to be a false. An employee, who was "vacationing" in Russia, logged into the wastewater's system and it prompted an alert. The pump failed because of normal usuage and was at the end of its lifecycle, according to multiple reports.
As I write this column, new details are coming out about a cyber-attack on a water plant in Springfield, IL. From the Washington Post, a blog called CheckPoint Washington cited a municipal water district employee and technician reported its water management system had been hacked by a computer in Russia.
And a Homeland Security report states:
Hackers apparently broke into a software company’s database and retrieved user names and passwords of various control systems that run water plant computer equipment. Using that data, they were able to hack into the plant in Illinois.
How did hackers get user names and passwords? The Washington Post blog supposes that hackers working inside China stole sensitive data from a company called RSA Security earlier this year. Before the breach, RSA Security was considered “the gold standard” for SecurID tokens.
It seems like 2012 could be a bad year for manufacturers and utilities if security investments were not made in 2011. As Terry McCorkle said in PC World magazine recently, “The situation [infrastructure security] is reminiscent of what happened to Windows a decade ago, when hackers began picking apart Microsoft’s products. Industrial vendors are, basically, just 10 years behind the curve on security. It’s like we’re gong back to the ‘90s.”
