Infrastructure

1030 readers

2 users here now

Infrastructure is composed of public and private physical structures such as roads, railways, bridges, tunnels, water supply, sewers, electrical grids, and telecommunications.

The stuff that makes the modern world go round!

founded 2 years ago

MODERATORS

spiritedpause@sh.itjust.works

Russian group hacked Quebec water treatment plant, gained access to control pumps and chlorine dosing: CSE (ca.news.yahoo.com)

submitted 6 days ago by shitwizard420@crazypeople.online to c/infrastructure@sh.itjust.works

7 comments fedilink hide all child comments

Russian cybercriminals managed to hack into a Quebec municipality's water treatment plant systems and had the ability to wreak havoc on the crucial infrastructure before getting caught, according to Canada's cyber spy agency.

In one particular case discussed in the report, the signals intelligence agency said it was advised last October that Russian hacktivist group NoName had broken into the Quebec water plant's network and gained access to many crucial systems.

According to CSE, NoName claimed it had gained the "ability to covertly control pumps, chlorine dosing, pressure settings and monitoring/alerts systems." The report does not identify the impacted Quebec municipality.

you are viewing a single comment's thread
view the rest of the comments

[–] shitwizard420@crazypeople.online 2 points 6 days ago

In my experience it is super location dependent. I've worked with municipalities who had shit locked down and others that made me think I was getting punked. All in Ontario.

I joined the industry in the early 2010s and it was a hot topic then too. This was when Stuxnet was in the news. ISA published Industrial Automation and Control Systems Security standards (ISA99) in 2002. It's not new.

I wonder how connected the folks who make decisions about utility cyber security are to each other. I learned almost everything I know about SCADA security practices via people I met through provincial wastewater industry associations and just letting them infodump lol. I don't know that any of the municipal SCADA people I worked with were members or participated. Maybe they are just trying to go at it alone vs collaborating and learning from each other. You don't know what you don't know!

I'd also be interested to know how old the PLCs at that plant were. We have zero details about this attack but when the Rockwell/AB exploit was in the news people were talking about buying cards off eBay because they are using discontinued PLCs. Can you imagine?

So, even if the staff understands the risk it doesn't mean they are getting enough money to do anything about it. Utilities are so underfunded. It's another ticking time bomb along with all those neglected pipes in the ground.