This briefing opened a discussion on LinkedIn about a reported attack on a small municipal water plant. Only the author’s own comments are reproduced below; the comments of the other practitioners who joined the thread are not reproduced.
Why would Russian hackers want to burn up a water plant pump? We all knew the capabilities existed.. but.. What is the motivation?
All excellent responses. I agree about SCADA systems available from the Internet created with COTS software and running on Windows machines are VERY juicy targets. I also think that it was a proof of concept…hopefully all of these incidents are a wakeup call to asset owners.
At this year’s Hacker Halted conference in Miami, I was in the audience while my friend Barnaby Jack conducted a live hacking demonstration using RF 900 MHz RF and an insulin pump. During the first part of his presentation, he went into great detail describing how he reversed the embedded device firmware and discovered the vulnerabilities that allowed him to send START/STOP/SUSPEND/DUMP ALL INSULIN commands to the pump without any knowledge of the device serial number or PIN.
The presentation and demonstration was a moment of awakening for many in the audiance that were not aware of how prevalent embedded devices are in our society, or how they can be utilized in ways the manufacturer did not intend.
