this post was submitted on 01 Aug 2026
84 points (100.0% liked)

Technology

86735 readers
4412 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
84
CISA Releases Guidance Urging Water Treatment Facilities to Disconnect Equipment From the Internet (www.privacyguides.org)
submitted 1 hour ago by new_otters_raft@piefed.ca to c/technology@lemmy.world
10 comments fedilink hide all child comments
 

CISA released an urgent message warning water utilities to disconnect their logic controllers from the internet in the face of rising cyberattacks.

The hacks target internet-facing programmable logic controllers (PLCs) that control equipment and allow machinery to communicate. They monitor and control the water pressure, chemical dosing, and other factors to ensure the water is safe.

Many of the PLCs are apparently open to the internet and use default credentials, allowing a remote attacker to easily take them over.

I assume it is this CISA: https://en.wikipedia.org/wiki/Cybersecurity_and_Infrastructure_Security_Agency

top 10 comments
sorted by: hot top controversial new old
[–] sylver_dragon@lemmy.world 27 points 1 hour ago (1 children)

The hacks target internet-facing programmable logic controllers (PLCs)

Why the fuck
is your PLC
facing the fucking internet!

Jesus Zombie Christ an a pogo stick. Has no one been paying attention for the last two decades? Seriously, we learned this sort of lesson in Two Thousand and fucking Three. Your critical assets do not get public IP addresses.

[–] Godort@lemmy.ca 15 points 55 minutes ago* (last edited 55 minutes ago) (2 children)

It usually happens in 2 steps.

First step is that everything gets connected to the LAN and you can only access the PLC network from within the building's network. Then some time later, management finds out that keeping someone on-call to go out costs a fortune, so they request that access be made so they can make the change from anywhere.

The IT team argues security, but no new hardware can be provisioned and a developing a new process is too hard. Then the magical phrase is uttered: "Just make it work". So IT punches a hole in the firewall, adds a NAT rule, and job done.

[–] Carl@anarchist.nexus 4 points 20 minutes ago

Literally this. It starts with “everything needs to be on an air gapped LAN so we can control it.” And then suddenly that air gapped LAN isn’t air gapped, because someone got tired of paying the call-out fee every time the on-call person had to drive to the site to push a few buttons on a keyboard. But figuring out a proper VPN (or at least a reverse proxy with access control) was too difficult or expensive, (management thinks the point is to save money on call out fees, not spend money on proper hardware) so they just poked a bunch of port-forwarded holes in the firewall and called it a day.

[–] sylver_dragon@lemmy.world 8 points 47 minutes ago

Sadly yes, this is exactly what happens. And it ends up being IT holding the bag at the end, with the managers having long since cashed out their stock options and left.

[–] orbituary@lemmy.dbzer0.com 15 points 1 hour ago (1 children)

I am repeating what I said elsewhere on a different comm:

I call FULL bullshit on this being Iran.

I personally worked on the cybersecurity incident that happened to St Paul municipal and water systems last year as the Incident Response Technical lead.

The threat actors were not Iranian then. They were Russian.

I personally rebuilt most of their networks, VMware hosts, storage, and servers. The majority of the VMware environments did not have config backups and were running 5 and 6 branches of VMware, only two had 7+.

Their network was insecure. They had IPSEC VPNs between the various location, but there was no further security in that respect. Their firewalls were not being kept up. AAAAND... I warned them that we thought they were still compromised.

In fact, the forensics team called them out as being clean on a group call one week into the incident, but while we were on the call with leadership, they got RE-infected.

I had my team compile a massive set of recommendations for them and I wrote the report. Water Systems specifically. They did not listen to us, apparently. The forensics team also did this.

They had FBI, national guard (fucking incompetent), and law enforcement (useless) in all meetings.

If they got into Water, they’ll get back into city and municipal again. I guarantee it.

This is not Iran. It's the fucking incompetence of city government and Russian threat actors.

[–] nymnympseudonym@piefed.social 7 points 30 minutes ago

Minor nit: Russia and Iran are already working together on shaheds and targeting

No surprise at all if they also coordinate cyber

[–] skvlp@lemmy.wtf 4 points 1 hour ago

Yup, Sleepy-Don really do have the whole Iran situation under control.