Dozens of water treatment plants in the U.S. have come under cyberattack since President Donald Trump started a war with Israel against Iran in February. Cyberattacks on critical infrastructure are now a regular part of the modern world, but it raises the question: why is that infrastructure hooked up to the internet in the first place?

The problem lies with programmable logic controllers (PLCs), which control various functions at water treatment plants. The Cybersecurity and Infrastructure Security Agency (CISA) has issued alerts about PLCs, including one in July noting that “threat actors” were changing passwords to lock out the proper operators of the facilities and disconnecting PLCs by changing their IP addresses.

The threat actors are believed to be hackers affiliated with the government of Iran, believed to be motivated by the fact that the U.S. and Israel started a war with that country on Feb. 28, bombing infrastructure and assassinating top leadership. The first CISA warning of that kind was issued in April, when Iran was specifically mentioned.

PLCs are vital instruments, and having them hooked up to the internet allows for remote monitoring. They’re made by a variety of companies, including Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens. Tampering with them in even the most relatively minor way can lead to a loss of water pressure, which could allow untreated groundwater to seep into pipes, according to CISA.

PLCs are a vulnerability that can lead to potentially disastrous consequences. In Georgia, Clayton County Water Authority and Columbus Water Works have experienced recent cyberattacks in the past month, according to the FBI and EPA , which triggered water pressure disruptions.

Source link