The Department of Homeland Security (DHS) and FBI have rebuffed reports that hackers were responsible for damaging a pump at an Illinois water utility facility.
”After detailed analysis, DHS and the FBI have found no evidence of a cyber intrusion into the SCADA system of the Curran-Gardner Public Water District in Springfield, Illinois,” DHS spokesman Chris Ortman claimed in a statement obtained by CNET.
“There is no evidence to support claims made in initial reports – which were based on raw, unconfirmed data and subsequently leaked to the media -that any credentials were stolen, or that the vendor was involved in any malicious activity that led to a pump failure at the water plant. In addition, DHS and FBI have concluded that there was no malicious traffic from Russia or any foreign entities, as previously reported.”
Unsurprisingly, SCADA security expert Joe Weiss – who first reported the incident – seemed rather skeptical about the latest DHS statement.
“The DHS statement released recently appears to conflict with the Illinois State Terrorism and Intelligence Center (STIC) report and its positive statements that an event had occurred. This begs the question why two government agencies disagree over whether a cyber event that damaged equipment had occurred at a water utility,” Weiss wrote in a blog post.
“Yesterday, a note was sent from DHS-sponsored Industrial Control Systems Joint Working Group (ICSJWG) stating they were notified about the STIC report on November 16. Why did it take so long for them to be notified? In addition, on Nov. 18 on a local TV station, the general manager of the water utility [stated] that it had been hacked with resulting damage to a water pump.”
Weiss also confirmed that assuming control of a SCADA system could allow hackers to damage critical infrastructure such as water treatment plants.
“SCADA is called the ‘master station’ for a reason… [For example], they could slam a valve shut. [Remember], you’ve got to close them slowly to avoid setting up a shockwave that works like a water hammer in the system… If you send a command to more than one pump and there is a blockage somewhere, you can stress a pipeline until the water makes a hole in it,” he added.
