Hacker tries to poison water supply in Florida city
FLORIDA, United States (AP) — A hacker gained entry to the system controlling the water treatment plant of a Florida city of 15,000 and tried to taint the water supply with a caustic chemical, exposing a danger cybersecurity experts say has grown as systems become both more computerised and accessible via the Internet.
The hacker who breached the system at the city of Oldsmar’s water treatment plant on Friday using a remote access programme shared by plant workers briefly increased the amount of sodium hydroxide by a factor of 100 (from 100 parts per million to 11,100 parts per million), Pinellas County Sheriff Bob Gualtieri said during a news conference Monday.
Sodium hydroxide, also called lye, is used to treat water acidity but the compound is also found in cleaning supplies such as soaps and drain cleaners. It can cause irritation, burns and other complications in larger quantities.
Fortunately, a supervisor saw the chemical being tampered with — as a mouse controlled by the intruder moved across the screen changing settings — and was able to intervene and immediately reverse it, Gualtieri said. Oldsmar is about 15 miles (25 kilometres) northwest of Tampa.
Gualtieri said the public was never in danger.
But he did say the intruder took “the sodium hydroxide up to dangerous levels”.
Oldsmar officials have since disabled the remote-access system, and say other safeguards were in place to prevent the increased chemical from getting into the water. Officials warned other city leaders in the region — which was hosting the Super Bowl — about the incident and suggested they check their systems.
Experts say municipal water and other systems have the potential to be easy targets for hackers because local governments’ computer infrastructure tends to be underfunded.
Robert M Lee, CEO of Dragos Security, and a specialist in industrial control system vulnerabilities, said remote access to industrial control systems such as those running water treatment plants has become increasingly common.
“As industries become more digitally connected we will continue to see more states and criminals target these sites for the impact they have on society,” Lee said.
The leading cybersecurity firm Fireeye attributed an uptick in hacking attempts it has seen in the last year mostly to novices seeking to learn about remotely accessible industrial systems. Many victims appear to have been selected arbitrarily and no serious damage was caused in any of the cases — in part because of safety mechanisms and professional monitoring, Fireeye analyst Daniel Kapellmann Zafra said in a statement.
“While the [Oldsmar] incident does not appear to be particularly complex, it highlights the need to strengthen the cybersecurity capabilities across the water and wastewater industry,” he said.