InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns of a big rise in attacks on internet-connected programmable logic controllers (PLCs) used in water and wastewater systems. The agency’s alert is urgent because hackers affected over 30 local water systems in Minnesota. The attacks began last Sunday and went on until Monday.
CISA’s alert talks about hackers attacking exposed programmable logic controllers (PLC). They change passwords to keep operators out, change IP addresses to cut off devices from the internet, and take other steps that mess up operations.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible.”
Many organizations that run water and wastewater systems are being targeted, even those with strong cybersecurity programs. The bulletin says that visible operational technology (OT) might have undocumented cellular modems set up by operators, vendors, or system integrators.
Internet-facing assets are exposed to defacement attacks, configuration changes, operational disruptions, and even physical damage, the agency said.
CISA suggests taking these assets off the internet right away. If that can’t be done, organizations should use a VPN or secure gateway for safe access.
Additionally, default passwords should be changed, and access should be limited to an IP address allow-list.
The agency told owners of Rockwell Automation MicroLogix 1400 PLCs to check vendor advice for getting access back if passwords were changed.
                                Source: Censys
Censys said there are now over 4,100 Rockwell Automation/Allen-Bradley devices on the internet, 4,100 Siemens devices, and more than 2,000 Schneider Electric devices.
The map above shows devices that can be reached over the public internet. This does not mean these systems are being targeted or hacked. About the MicroLogix 1400 controllers in CISA’s bulletin, Censys says many are using old firmware versions that are no longer sold.
The security company pointed out that many cellular modems are not documented, causing issues. They reported that almost half of the exposed Rockwell devices can be accessed through Verizon Business, AT&T, T-Mobile, Comcast, Charter, and Starlink networks.
                                    Source: Censys
Censys also shared a longer list of signs of compromise (IoCs) in its report, along with tips for finding threats.
Earlier this week, the Minnesota IT Services (MNIT) agency activated the state’s cybersecurity incident response plan after identifying what it described as “a coordinated cyberattack targeting operational technology at more than 30 Minnesota community water systems.”
