The recent cyberattacks on water facilities In Minnesota, Michigan, Arkansas, Georgia and New Jersey which I wrote about on August 1st highlighted growing concerns about foreign government hacking, primarily from Iran. Water utilities are vulnerable targets due to being essential services that largely operate outdated control systems with poor cybersecurity. Warnings about these threats go back to 2016. The EPA issued voluntary cybersecurity best practices, but its attempt at mandatory regulations in 2023 was challenged by states and subsequently withdrawn. In March 2024, the EPA and White House urged states to implement protective plans, noting that 70% of inspected utilities fail to meet necessary cybersecurity standards amidst increasing attacks.
In April, the EPA, FBI, Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) issued a joint advisory warning of an urgent and ongoing Iranian-affiliated cybersecurity threat. In the warning they indicated that water and wastewater systems were being attacked through their operational technology.
On July 22nd CISA issued a specific warning that Iranian backed hackers were targeting critical infrastructure including water systems through attacking Internet connected automated devices used to manage infrastructure systems.
On August 19th CISA, the FBI and the National Security Agency (NSA), the Department of Energy (DOE) and the Environmental Protection Agency (EPA) issued a joint warning that specifically pinpointed how the foreign hackers were attacking the water systems using AI to make their attacks more effective.
As many of us expected the attacks targeted Siemens S7 programmable logic controllers which are devices used to automatically control machines, manufacturing equipment and industrial processes in not just water systems, but also energy, manufacturing and agriculture systems and more. The logic controller receives inputs from sensors or other devices, executes a control program and sends outputs to other equipment. These devices are at the heart of the operation of the water utilities being targeted by the present hackers.
Making the problem worse is the use of AI in these attacks. According to the August 19th warning, “The threat actors are conducting reconnaissance and capability development against U.S. based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools. The actors leverage Internet scanning services to find Internet exposed PLCs running outdated software or that are otherwise poorly protected. The U.S. critical infrastructure sectors most targeted by this threat activity include critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture and Commercial Facilities. This is not a theoretical risk – it is an active threat. Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations and cascading impacts across interconnected systems.”
The warning urged all operators of systems using Siemens S7 Series as well as other PLC devices to combat the threat by making sure their systems are protected by installing the latest security patches and updates as well as isolating their systems from the Internet wherever possible since it is through the Internet that foreign hackers attack the systems.
According to the August 19th FBI warning the hackers are using AI to generate exploitation scripts using readily available public information about the Siemens S7 Series PLCs to gain initial access to the systems and gain credential access where the systems have not been properly cybersecurity protected. According to the warning, “If these PLCs are exposed to the Internet or insufficiently segmented, then threat actors can exploit various critical and high severity known vulnerabilities in these PLCs.”
The use of AI by hackers to achieve their attacks represents a dangerous evolution in the capabilities of hackers dramatically reducing the technical expertise and time required to develop working exploitation scripts and malicious tools. AI can further be used to adapt their attacks to defensive cybersecurity measures of targeted systems such as water utilities. AI thus can be used to quickly and effectively gather public information about the vulnerabilities and weaknesses of the targeted logic controllers, identify exposed and exploitable PLCs and then use AI-generated scripts to act on that information. According to the FBI PLCs that are exposed to the Internet are at high risk of exploitation.
In particular, devices that have continued to use default authentication or otherwise insecure authentication credentials are particularly vulnerable.
The FBI warning provided guidance to users of these vulnerable systems to mitigate the threat including:
- Conducting immediate inventory of all Siemens S7 Series PLCs;
- Applying critical security patches as soon as possible:
- Verify network segmentation and ensure the PLCs are not accessible from the Internet. Preventing Internet accessibility is a key to preventing hacking;
- Review and strengthen access controls including the use of complex passwords and implementation of multi-factor authentication for all remote access to networks;
- Enable comprehensive monitoring of systems to detect intrusions.
The threat posed to our infrastructure including, but certainly not limited to, water and wastewater systems is serious and the threat has increased dramatically through AI making attacks on these systems easier to accomplish. The steps necessary to harden our defenses are not too complicated and have been delayed too long. The time to act is now.
Read the full article here