Hackers destroy pump in U.S. water utility attack

Hackers attacking SCADA systems and wreaking havoc in a nation’s critical infrastructure has become a justified concern for all countries. But, setting aside Iran and attacks against its nuclear program for a moment, the U.S. seems to attract a seemingly disproportionate amount of these kind of assaults.

The latest has targeted the control system of the city water utility in Springfield, Illinois, and has resulted in the destruction of a water pump, Wired reports.

The hackers have staged the attack from an Russian IP address and have used login credentials for the SCADA system used by the utility which they acquired by previously hacking into the networks of the manufacturer and vendor of the said SCADA system.

Software vendors usually keep that kind of information because they need to remotely access the systems they sold for maintenance and updating purposes. In this case, the discovery of the compromise has raised a crucial question: How many other systems sold by the same vendor will be attacked in the future – or have been attacked already – due to this breach?

The utility’s operators have noticed some difficulties with the system’s remote functionality months before the pump incident, but thought it was a normal instability of the system.

All this information was in a report released by a state fusion center

Joe Weiss, the security expert and managing partner of Applied Control Solutions who discovered this information from a report compiled by a state fusion center, still hasn’t managed to track down which water utility was hacked (the report doesn’t say) and, consequently, which software vendor was breached.

The fact that the utility company is located in Springfield was revealed by the Department of Homeland Security in a statement, leading to speculation that City Water Light and Power is the one.