A shared password may be to blame for a hacker gaining remote access to a water treatment plant in Florida in an attempt to poison the water supply.
On Tuesday, federal and state officials released details of how the hack likely occurred—and all signs point to poor security practices as a main culprit.
To gain access to the water treatment plant in Oldsmar, Florida, the unknown hacker exploited a program called TeamViewer, which companies and governments can install on a PC to remotely view a machine’s desktop screen over the internet, and even control the mouse cursor.
Employees at the water treatment plant in Florida installed TeamViewer on several computers to help them manage the facility. However, all the computers shared the same password for remote access.
The same computers were connected to the internet, without a firewall, making it easier for any hacker to breach the machines over the open internet. To make matters worse, the affected computers ran a 32-bit version of Windows 7, which no longer receives security updates, save for enterprise customers who bought extended life support.
The details about the breach come from an advisory the Massachusetts state government released to local water suppliers urging them to be on guard against cyber attacks. The same post contains details from federal investigators on how the breach at the water plant in Florida likely occurred. (The Associated Press was first to report the news.)
On Tuesday, the FBI also released an alert to companies and governments, which points to “poor password security” and “outdated Windows 7” use as security weaknesses the hacker likely exploited to break into the Florida water plant.
Federal authorities are still investigating who was behind the breach. But the former director of the Cybersecurity and Infrastructure Security Agency, Christopher Krebs, says the US should avoid assuming the hack was the work of “sophisticated” foreign hackers. It’s also possible a disgruntled employee pulled off the breach, Krebs told lawmakers on Wednesday.
Although it’s easy to condemn the water treatment plant in Florida for poor security practices, Krebs points out many public utilities in the US suffer from underfunding. “I would say that Oldsmar is probably the rule, rather than the exception—and that is not their fault,” he added. “These are municipal utilities that do not have sufficient resources to have robust security programs.”
As a result, he called on lawmakers to increase funding to secure the US’s critical infrastructure.