Buying or Selling IPv4 Addresses?

Watch this video to discover how ACCELR/8, a transformative trading platform developed by industry veterans Marc Lindsey and Janine Goodman, enables organizations to buy or sell IPv4 blocks as small as /20s.

Avenue4 LLCRead Message Promoted Post

Home / Blogs

Water Supply System Apparently Hacked, with Physical Damage

Steven Bellovin

According to press reports, a water utility's SCADA network was hacked. The attacker turned a pump on and off too much, resulting in physical damage to the pump. This is an extremely significant incident, for three reasons:

• The attack actually happened.
• Ordinary, off-the-shelf hacking tools were used, rather than something custom like Stuxnet
• Physical damage resulted

Arguably, the first point is the most important one. For years, security specialists have been warning that something like this could happen. Although more and more people have started to believe it, we still hear all of the usual reassuring noises — the hackers don't know enough, we have defenses, there are other safeguards, etc. That debate is now over: we have an existence proof. All future debate has to start from this fact: the threat is real. We can argue over magnitude, but not over the possibility.

The second noteworth point is that it didn't take the cyberwarfare unit of a major nation-state to break in. ("Nation-state"? Are there that many city-states around today that we need to describe which kind of "state" we're worried about? Or is the qualifier intended to distinguish it from nations that aren't states?) Reports point to ordinary vulnerabilites in standard web software.

Finally, the attack caused physical damage to a water pump. It's not enough to wipe the disk of the compromised computer and restore from backups; instead, you have to acquire and install new hardware. This is the really scary part about attacks on SCADA systems: the defenders almost certainly have less replacement hardware than they would need in event of a large-scale, focused, malicious attack.

Exactly what happened here is not yet completely clear. The implications, though, are scary.

By Steven Bellovin, Professor of Computer Science at Columbia University
Related topics: Cyberattack, Cybersecurity
SHARE THIS POST

If you are pressed for time ...

... this is for you. More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Vinton Cerf, Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Share your comments

"Nation-state"? John Berryhill  –  Nov 21, 2011 4:03 PM PST

i.e. not Cherokee, for example, and Americans find the use of "state" to refer to independent territorial sovereigns to be confusing.

To post comments, please login or create an account.

Related

Topics

Mobile Internet

Sponsored byAfilias

IP Addressing

Sponsored byAvenue4 LLC

DNS Security

Sponsored byAfilias

Cybersecurity

Sponsored byVerisign

Promoted Post

Buying or Selling IPv4 Addresses?

Watch this video to discover how ACCELR/8, a transformative trading platform developed by industry veterans Marc Lindsey and Janine Goodman, enables organizations to buy or sell IPv4 blocks as small as /20s.