A hacker gained access to the water treatment system for the city of Oldsmar, Florida, and attempted to increase the concentration of sodium hydroxide (NaOH), also known as lye and caustic soda, to extremely dangerous levels.
Sodium hydroxide is commonly found in household cleaners, but can be very dangerous if ingested in high concentrations. However, in lower levels it is used by water treatment facilities to adjust acidity (pH) and remove heavy metals.
Access via remote desktop software
The attack on the computer system at Oldsmar water treatment system happened on Friday at 1:30 PM, through a remote desktop software that allowed authorized users to troubleshoot system problems remotely.
The hackers remotely gained access to a software program, named TeamViewer, on the computer of an employee at the facility to gain control of other systems, sheriff Bob Gualtieri said in an interview with Reuters.
A plant operator said that they observed how someone took control of the mouse and used it to make changes in the software that controls the functions for the city’s water treatment.
The intruder spent between three to five minutes inside the system and changed the the sodium hydroxide level from 100 parts per million to 11,100 parts per million.
The change was immediately reverted by the operator and the population of Oldsmar was not at risk at any moment because the operator intervened immediately. The plant operator then cut off remote access to the system.
Eric Seidel, the mayor of the city, said that Oldsmar water treatment system is set up with redundancies that would have sounded an alarm if the water’s chemical levels reached dangerous levels.
“Even if the plant operator had not quickly reversed the increased amount of sodium hydroxide, it would have taken between 24 and 36 hours for that water to hit the water supply system and there are redundancies in place where the water had been checked before it would have been released” – Sheriff Bob Gualtieri
Gualtieri added that there has been no arrest and there is no information on whether the breach originated from the U.S. or outside the country. The Pinellas County Sheriff’s Office, the FBI, and the Secret Service are investigating the incident.
Not the first or last attack on water treatment facilities
By the looks of it, this was not a sophisticated intrusion. According to Mandiant Threat Intelligence team, the number of incidents involving less skilled actors trying to access industrial control systems remotely have increased since last year.
“Many of the victims appear to have been selected arbitrarily, such as small critical infrastructure asset owners and operators who serve a limited population set. Through remote interaction with these systems, actors have engaged in limited-impact operations that often included manipulation of variables from physical processes. None of these cases has resulted in damage to people or infrastructure given that industrial processes are often designed and monitored by professional engineers who incorporate safety mechanisms to prevent unexpected modifications” Mandiant said.
Attacks on water treatment facilities have happened several times over the past two decades. Among the oldest ones that caught public attention occurred in 2000 at a waste water treatment facility in Australia and was an inside job. A disgruntled employee, Vitek Boden, used stolen equipment to gain access to the SCADA controller and release 800,000 liters of untreated sewage water into the waterways in Maroochy Shire.
In 2011, a hacker calling themselves ‘pr0f’ reacted to a DHS report about a water pump failure in Springfield Illinois. The hacker linked to screenshots showing that they had access to a waste water treatment plant in South Houston.
In 2016, Verizon reported in its Data Breach Digest that hacktivists were able to breach a water company that had its IT network running on outdated software and hardware equipment.