With regard to news that hacker remotely accessed control system for water treatment plant in Florida to increase lye level, it's no surprise these are accessible online. Have been for yrs. But it sounds like they maybe didn't have 2-factor authentication set up to protect it
Here's a story I wrote in 2012 about critical industrial control systems accessible over the internet and easily discovered through a Shodan search wired.com/2012/01/10000-…
And in 2013 I wrote about a researcher who used Masscan to find systems using port 5900 (the port used by VNC and TeamViewer remote-management software). He found 30,000 connected systems that did not require authentication to access them wired.com/2013/11/intern…
Note that Florida authorities said there were "redundancies" in place that would have prevented the lye from getting to drinking water. Safety systems do detect things like this, but safety systems, depending on how they're configured, can *potentially* also be subverted.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
