Home / Blogs

Water Supply System Apparently Hacked, with Physical Damage

Steven Bellovin

According to press reports, a water utility's SCADA network was hacked. The attacker turned a pump on and off too much, resulting in physical damage to the pump. This is an extremely significant incident, for three reasons:

• The attack actually happened.
• Ordinary, off-the-shelf hacking tools were used, rather than something custom like Stuxnet
• Physical damage resulted

Arguably, the first point is the most important one. For years, security specialists have been warning that something like this could happen. Although more and more people have started to believe it, we still hear all of the usual reassuring noises — the hackers don't know enough, we have defenses, there are other safeguards, etc. That debate is now over: we have an existence proof. All future debate has to start from this fact: the threat is real. We can argue over magnitude, but not over the possibility.

The second noteworth point is that it didn't take the cyberwarfare unit of a major nation-state to break in. ("Nation-state"? Are there that many city-states around today that we need to describe which kind of "state" we're worried about? Or is the qualifier intended to distinguish it from nations that aren't states?) Reports point to ordinary vulnerabilites in standard web software.

Finally, the attack caused physical damage to a water pump. It's not enough to wipe the disk of the compromised computer and restore from backups; instead, you have to acquire and install new hardware. This is the really scary part about attacks on SCADA systems: the defenders almost certainly have less replacement hardware than they would need in event of a large-scale, focused, malicious attack.

Exactly what happened here is not yet completely clear. The implications, though, are scary.

By Steven Bellovin, Professor of Computer Science at Columbia University. More blog posts from Steven Bellovin can also be read here.

Related topics: Cyberattack, Security

WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

"Nation-state"? John Berryhill  –  Nov 21, 2011 5:03 PM PDT

i.e. not Cherokee, for example, and Americans find the use of "state" to refer to independent territorial sovereigns to be confusing.

To post comments, please login or create an account.

Related Blogs

Related News

Topics

Industry Updates – Sponsored Posts

Verisign OpenHybrid for Corero and Amazon Web Services Now Available

Afilias Supports the CrypTech Project - Ambitious Hardware Encryption Effort to Protect User Privacy

Public Sector Experiences Largest Increase in DDoS Attacks (Verisign's Q4 2014 DDoS Trends)

Help Ensure the Availability and Security of Your Enterprise DNS with Verisign Recursive DNS

Verisign iDefense 2015 Cyber-Threats and Trends

What's in Your Attack Surface?

Q3 2014 DDoS Trends: Attacks Exceeding 10 Gbps on the Rise

3 Questions to Ask Your DNS Host About DDoS

Afilias Partners With Internet Society to Sponsor Deploy360 ION Conference Series Through 2016

Neustar to Build Multiple Tbps DDoS Mitigation Platform

The Latest Internet Plague: Random Subdomain Attacks

Digging Deep Into DNS Data Discloses Damaging Domains

New gTLDs and Best Practices for Domain Management Policies (Video)

Nominum Announces Future Ready DNS

New from Verisign Labs - Measuring Privacy Disclosures in URL Query Strings

DotConnectAfrica Delegates Attend the Kenya Internet Governance Forum

3 Questions to Ask Your DNS Host about Lowering DDoS Risks

Continuing to Work in the Public Interest

Verisign Named to the OTA's 2014 Online Trust Honor Roll

Introducing the Verisign Quarterly DDoS Trends Report

Sponsored Topics

dotMobi

Mobile

Sponsored by
dotMobi
Port25

Email

Sponsored by
Port25
Afilias

DNS Security

Sponsored by
Afilias
Verisign

Security

Sponsored by
Verisign
Minds + Machines

Top-Level Domains

Sponsored by
Minds + Machines