InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns of a big rise in attacks on internet-connected programmable logic controllers (PLCs) used in water and wastewater systems. The agency’s alert is urgent because hackers affected over 30 local water systems in Minnesota. The attacks began last Sunday and went on until Monday.
CISA’s alert talks about hackers attacking exposed programmable logic controllers (PLC). They change passwords to keep operators out, change IP addresses to cut off devices from the internet, and take other steps that mess up operations.
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
“CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible.”
Many organizations that run water and wastewater systems are being targeted, even those with strong cybersecurity programs. The bulletin says that visible operational technology (OT) might have undocumented cellular modems set up by operators, vendors, or system integrators.
Internet-facing assets are exposed to defacement attacks, configuration changes, operational disruptions, and even physical damage, the agency said.
CISA suggests taking these assets off the internet right away. If that can’t be done, organizations should use a VPN or secure gateway for safe access.
Additionally, default passwords should be changed, and access should be limited to an IP address allow-list.
The agency told owners of Rockwell Automation MicroLogix 1400 PLCs to check vendor advice for getting access back if passwords were changed.
Source: Censys
Censys said there are now over 4,100 Rockwell Automation/Allen-Bradley devices on the internet, 4,100 Siemens devices, and more than 2,000 Schneider Electric devices.
The map above shows devices that can be reached over the public internet. This does not mean these systems are being targeted or hacked. About the MicroLogix 1400 controllers in CISA’s bulletin, Censys says many are using old firmware versions that are no longer sold.
The security company pointed out that many cellular modems are not documented, causing issues. They reported that almost half of the exposed Rockwell devices can be accessed through Verizon Business, AT&T, T-Mobile, Comcast, Charter, and Starlink networks.
Source: Censys
Censys also shared a longer list of signs of compromise (IoCs) in its report, along with tips for finding threats.
Earlier this week, the Minnesota IT Services (MNIT) agency activated the state’s cybersecurity incident response plan after identifying what it described as “a coordinated cyberattack targeting operational technology at more than 30 Minnesota community water systems.”
