InfoSecBulletin Cybersecurity for mankind
The Jerusalem Post reported that hackers targeted water controllers for irrigation systems at farms in the Jordan Valley, as well as wastewater treatment control systems belonging to the Galil Sewage Corporation.
Farms were warned by Israel’s National Cyber Directorate prior to the incident, being instructed to disable remote connections to these systems due to the high risk of cyberattacks. Roughly a dozen farms in the Jordan Valley and other areas failed to do so and had their water controllers hacked. This led to automated irrigation systems being temporarily disabled, forcing farmers to turn to manual irrigation.
Michael Langer, chief product officer at industrial cybersecurity company Radiflow, told SecurityWeek that the impacted farms likely left their ICS exposed to the internet and used default passwords, allowing hackers to easily gain access and cause disruption.
Langer said the hackers targeted programmable logic controllers (PLCs) made by Israeli company Unitronics. Information about these controllers, including default passwords and configuration options, is available online, and the devices run various software components that can be targeted by hackers.
The attacks on water systems in Israel appear to be part of OpIsrael, an anti-Israel hacktivist campaign that has intensified every year in early April in the past decade.
Industrial cybersecurity firm Otorio told SecurityWeek that hacktivists appear to have conducted several attacks against water systems in Israel this month.
It’s not uncommon for hacktivists to make exaggerated claims when it comes to hacking ICS. However, their attacks have often shown how easy it can be to hack industrial systems due to many organizations failing to implement even the most basic security measures, such as changing default passwords and not leaving unprotected systems exposed to the internet.
Otorio’s VP of research, Matan Dobrushin, said the latest incidents involved the same attack vectors seen in the past. The hackers search the web for unprotected human-machine interfaces (HMIs) or PLC web interfaces and then make some changes in those interfaces — do some clicks on the screen, as Dobrushin described it — in an attempt to cause disruption.
Matan noted that the water systems targeted successfully by hackers appear to be owned by private organizations and he hopes that ‘true critical infrastructure’ in Israel is better protected.
“Small and medium businesses using remotely accessible OT technology and without implementing basic cyber security mechanisms can be and will be hacked relatively easily,” said Radiflow’s Langer.
Langer explained that the first step to achieving cyber resilience involves performing regular risk assessments to determine the organization’s OT security posture. He advises organizations that lack the capabilities and knowledge to conduct such assessments to use managed OT security services.
