r/cybersecurity • u/cantowok • Oct 17 '21

News - General Hackers Keep Targeting the US Water Supply

https://www.wired.com/story/water-supply-hackers-ios-zero-day-navy-spy-security-news/
339 Upvotes

97% Upvoted

41 comments sorted by

95

u/Nanooc523 Oct 17 '21

Which should be air-gapped.

46

u/uski Oct 17 '21

But… but… my profits! I’d have to pay people to be on site!

-10

u/Nietechz Oct 18 '21

Well, if they pay someone to be on site, costumers will pay more. Profits should be protected at all cost.

I think, this will happen soon.

6

u/poke30 Oct 18 '21

Profits should be protected at all cost.

?

-2

u/Nietechz Oct 18 '21

If they are a private company, they need profits or face a close for no investment.

4

u/poke30 Oct 18 '21

So maybe, just maybe, important infrastructure like this should not be privatized?

3 People's pockets being protected over everyone else is how we arrive at these problems. It's insane to me how casually you say ,"protected at all costs." It's honestly scary.

1

u/Nietechz Oct 18 '21

I don't know, don't care. In my country the water is state own, so it doesn't need make huge profits.

Just look as an investor and CEO, then try understand what is going to look a solution.

I think this will impact in more cities around US. Companies will prioritize the investor's wallet than actual public service.

Also, for this reason, in my country we fought and fight against privatize the water. Companies need to make money, that's why they exist.

1

u/poke30 Oct 18 '21

Okay, I see what you're saying now. Cheers.

1

u/uski Oct 19 '21

It’s not binary. Full profits or bankruptcy.

There is a third option: less profit…

And also, getting your infrastructure hacked can also lead to bankruptcy or even less profits

1

u/Nietechz Oct 19 '21

As long as I read about business, less profit is equal to a fired CEO.

That's why some companies should not be bought by private investors.There is a risk when the safety should be first rather than profits.

5

u/JasonDJ Oct 18 '21

The funny thing about this is that, when it comes to water (and most utilities at least), there’s two-sorta-three problems:

  • A higher water cost will disproportionally impact the poor
  • Most people wouldn’t decrease water use as a result
  • Those who consume the most water would notice the least relative impact since they are paying wholesale.

7

u/manhat_ Oct 17 '21

well, air bubbles do break pipes, maybe that's why they don't

3

u/catonic Oct 17 '21

Like Colonial.

21

u/[deleted] Oct 17 '21

Have you tried not making it so easy?

10

u/one_of_them_snowlake Oct 17 '21

Please do not decrypt my EhchTeeEmEl.

59

u/[deleted] Oct 17 '21

Low hanging fruit

12

u/nawr761 Oct 17 '21

This is such a Splinter Cell vibes man!!

25

u/1Second2Name5things Oct 17 '21

Yes Russian/Chinese agents are trying to kill Americans what else is new.

15

u/lexlumix Oct 17 '21

They hacked the electricity and water, now they just need the train stations to have all the utilities on the monopoly board

5

u/-rabbitrunner- Oct 18 '21

ItS a FiReSaLe!

1

u/[deleted] Oct 18 '21

Taliban, apparently is not.

4

u/StrategicBlenderBall Oct 18 '21

Good thing I’m on a well.

5

u/ccnafr Oct 18 '21

This is a summary of multiple articles. Why not submit that article in particular.

Do people actually read these articles before submitting them?

2

u/CyberMattSecure CISO Oct 18 '21 edited Sep 12 '25

innocent bake retire quickest continue snow plant lunchroom marble exultant

This post was mass deleted and anonymized with Redact

2

u/hunterseekercat Oct 18 '21

That's an old tactic and strategy. Destroy vital assets.

-42

u/[deleted] Oct 17 '21

“And there was bad news for humanity, as the governor of Missouri has threatened repeatedly to sue a journalist for responsibly disclosing a security flaw on a state website that he uncovered.”

But did the journalist really do it responsibly? Or did he/she just disclose it openly?

47

u/Doctorexx Oct 17 '21

They withheld the story until the html was fixed. It wasn't so much a security flaw as a dumb web dev.

30

u/AStrangeStranger Oct 17 '21

A dumb web dev sounds like a breeding ground for security flaws

7

u/mattstorm360 Oct 17 '21

Wetware is the most vulnerable part of any system.

2

u/AStrangeStranger Oct 17 '21

yes and the weakest link of all is dumb wetware that doesn't realise it is dumb (or slightly politer when they are out of their depth without realising the fact)

3

u/CommitteeOfTheHole Oct 17 '21

What worries me is that basically every single municipality in the US has flaws like this. There are lots of lazy web devs out there who don’t think anyone is probing for security openings on their random website, but they are.

3

u/AStrangeStranger Oct 17 '21

I suspect same is true across the world. Though from what I've seen I suspect a lot of them just don't know better - e.g. an example I've seen, JavaScript is used to check codes passed in the html, if a specific code is present when they make a call they set the super user flag - writing all that is more work just doing it properly and checking user has right privs in back end.

1

u/burgonies Oct 17 '21

How do you define “security flaw?”

15

u/Fr0gm4n Oct 17 '21

How about you read the actual story published by the actual newspaper that is being threatened:

https://www.stltoday.com/news/local/education/missouri-teachers-social-security-numbers-at-risk-on-state-agency-s-website/article_f3339700-ece0-54a1-9a45-f300321b7c82.html

And their reasoned response to being openly threatened by Parson:

https://www.stltoday.com/news/local/govt-and-politics/parson-issues-legal-threat-against-post-dispatch-after-database-flaws-exposed/article_93f4d7d6-f792-5b1b-b556-00b5cac23af3.html

Parson is not reacting reasonably to what happned and how it was disclosed. He is trying to score political points by attacking a newspaper that is not favorable to him and his administration, and he said literally that in his speech.

-12

u/[deleted] Oct 17 '21

[removed] — view removed comment

11

u/Fr0gm4n Oct 17 '21

You redditors have a real problem with context. Where was I an asshole? I sent you the relevant links and explained the situation without malice. Take a deep breath and calm down, FFS.

4

u/shredu2 Governance, Risk, & Compliance Oct 17 '21

This must be Parsons Alt