# Hacker tried to poison Florida city's water supply **URL:** \ **Category:** The BBQ Pit\ **Created:** [February 8, 2021, 9:36pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471 "2021-02-08T21:36:02Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![gotpasswords](https://avatars.discourse-cdn.com/v4/letter/g/c57346/32.png) [@gotpasswords](https://boards.straightdope.com/u/gotpasswords)\ **Post date:** [February 11, 2021, 6:11am UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/41 "2021-02-11T06:11:32Z")
> [@bump](#): > > it’s apparently IT amateur hour there. Working in IT for a municipality and having some contact with the water dept’s setup, I can say that the control systems _should_ be walled off in their own secure private network- both for security, and for speed. Why are SCADA (supervisory control and data acquisition) systems still sitting naked on the public net? It’s one thing for a water system manager to be able to monitor flow rates, pumps, etc. remotely, but is the ability to make changes remotely really needed? ---
**Author:** ![OttoDaFe](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ottodafe/32/356_2.png) [@OttoDaFe](https://boards.straightdope.com/u/OttoDaFe)\ **Post date:** [February 11, 2021, 7:34am UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/42 "2021-02-11T07:34:43Z")
When I read the report — especially where the employee said he could see the cursor move — it sounded to me like the hacker had used remote access to take over the employee’s computer rather than taking over the control systems directly. However, this just puts the problem one layer out; why the employee’s computer was vulnerable is still a valid concern. ---
**Author:** ![Bill\_Door](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Bill\_Door](https://boards.straightdope.com/u/Bill_Door)\ **Post date:** [February 11, 2021, 12:14pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/43 "2021-02-11T12:14:34Z")
There are distributed control systems (DCS) systems that can be accessed and changed remotely. You usually need to first get on the network to have access to the infrastructure, then an additional layer of password protection to make actual changes in the controls. It’s a necessary element in some cases. Large facilities will often have the control room hundreds of yards away from the equipment. People will ask how we’re going to run the facility if there’s a fire or flood in the control room, so remote access is part of the recovery plan. It’s considered crossing a line for an engineer or manager to make changes in control parameters without consulting the operators, but people are people and these things happen. There are also some operators who will need to go out in the field for some time and will ask a remote engineer to keep an eye on things while they are away, so remote access is useful then as well. ---
**Author:** ![bump](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@bump](https://boards.straightdope.com/u/bump)\ **Post date:** [February 11, 2021, 1:49pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/44 "2021-02-11T13:49:06Z")
They shouldn’t be; at least where I work they’re in a totally separate secured network. But it’s dependent on the size of the operation; if it’s Podunk Water with one freshwater plant, one wastewater plant and one pumping station, then it’s probably not necessary to do anything remotely. But if you’re talking about somewhere like say… Austin, there are probably multiple freshwater plants, multiple wastewater plants, and a dozen pump stations/lift stations all over the place, all on a different scale than Podunk’s freshwater plant. Remote administration of just about anything makes a lot of sense in that situation. ---
**Author:** ![Folacin](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/folacin/32/3195_2.png) [@Folacin](https://boards.straightdope.com/u/Folacin)\ **Post date:** [February 11, 2021, 4:04pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/45 "2021-02-11T16:04:33Z")
> [@bump](#): > > But if you’re talking about somewhere like say… Austin, there are probably multiple freshwater plants, multiple wastewater plants, and a dozen pump stations/lift stations all over the place, all on a different scale than Podunk’s freshwater plant. Remote administration of just about anything makes a lot of sense in that situation. And it’s cheaper - one guy can monitor multiple things.There is a trade-off between cost and security, and a lot of places probably went with the savings of remote administration without spending the necessary dollars for the security. ---
**Author:** ![Deeg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/deeg/32/2955_2.png) [@Deeg](https://boards.straightdope.com/u/Deeg)\ **Post date:** [February 11, 2021, 4:26pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/46 "2021-02-11T16:26:25Z")
Looks like it was poor TeamViewer use: [Breached water plant employees used the same TeamViewer password and no firewall | Ars Technica](https://arstechnica.com/information-technology/2021/02/breached-water-plant-employees-used-the-same-teamviewer-password-and-no-firewall/) ---
**Author:** ![Ann\_Hedonia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ann_hedonia/32/319_2.png) [@Ann\_Hedonia](https://boards.straightdope.com/u/Ann_Hedonia)\ **Post date:** [February 11, 2021, 8:38pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/47 "2021-02-11T20:38:13Z")
> [@Sherrerd](#): > > Not by me. If my ship came in and I had the ability to buy a shiny new mansion, I would, no doubt, be put to the expense of tearing out all the Internet-connected appliances and AC/heating system and security wiring and whatever else today’s home builders have decided to make Internet-connected, as a (supposed) selling point. > > Too easy to hack. You wouldn’t have to rip out any wiring, you could just unplug a couple of things or flip a couple of DIPS switches. It’s not that uncommon of a request among the shiny new mansion owners. ---
**Author:** ![Broomstick](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/broomstick/32/246_2.png) [@Broomstick](https://boards.straightdope.com/u/Broomstick)\ **Post date:** [February 11, 2021, 9:19pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/48 "2021-02-11T21:19:17Z")
I’m still trying to figure out why my refrigerator or microwave needs or should be connected to the internet. WTH? ---
**Author:** ![Atamasama](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/atamasama/32/12961_2.png) [@Atamasama](https://boards.straightdope.com/u/Atamasama)\ **Post date:** [February 12, 2021, 12:47am UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/49 "2021-02-12T00:47:46Z")
Firmware updates? ---
**Author:** ![Sherrerd](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sherrerd/32/8_2.png) [@Sherrerd](https://boards.straightdope.com/u/Sherrerd)\ **Post date:** [February 12, 2021, 1:05am UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/50 "2021-02-12T01:05:24Z")
> [@Ann\_Hedonia](#): > > **You wouldn’t have to rip out any wiring, you could just unplug a couple of things** or flip a couple of DIPS switches. It’s not that uncommon of a request among the shiny new mansion owners. That’s what they WANT you to believe… 🕶 (my emphasis) ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [February 12, 2021, 4:05am UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/51 "2021-02-12T04:05:10Z")
> [@Broomstick](#): > > I’m still trying to figure out why my refrigerator or microwave needs or should be connected to the internet. WTH?   Relevant remarks from a thread about Internet Of Things (IOT) a while back: n.b.: The link in the post below is defunct. It was just a link to a picture. [Here’s a current similar pic.](https://i.etsystatic.com/10796367/r/il/3893a2/2191131376/il_794xN.2191131376_80mi.jpg) > [@Newish buzzphrase: IOT = Internet of Things. What do I need to know about it?](https://boards.straightdope.com/t/newish-buzzphrase-iot-internet-of-things-what-do-i-need-to-know-about-it/805809/13): > > > [@Newish buzzphrase: IOT = Internet of Things. What do I need to know about it?](https://boards.straightdope.com/t/newish-buzzphrase-iot-internet-of-things-what-do-i-need-to-know-about-it/805809/8): > > > > I have several very old, definitely pre-IOT [potholders](http://www.ikea.com/us/en/images/products/iris-pot-holder-gray__0150595_PE309123_S4.JPG) here, that are starting to fall apart with age. It’s clearly time for me to get new potholders, as the ones I have are no way upgradeable. Should I be looking into IOT-enabled potholders? Why or why not? What advantages would they have for me? > > > > (Note: I do very little cooking.) > > I’ll give a serious answer to an amusing post, because I think it’s a useful way to think about how the IoT will develop. > > As of today, there is no reason for an IoT potholder. Any IoT functionality is clearly unnecessary and frankly ridiculous. But that was true of many current IoT devices 15 years ago - the utility of having your refrigerator connected to the internet would have been a joke (and still is for many people). Ten years from now, it will be as standard on refrigerators as temperature control. > > So brainstorming about an IoT potholder…what if it recorded the time I put a dish in the oven and automatically set a timer for me? What if it detected the temperature of the pan, calculated the cooling rate, and notified me when the cake was cool enough to turn out? These are [del]probably[/del] stupid ideas, but my point is that there will be plenty of IoT devices in the future that we aren’t imagining now. ---
**Author:** ![Broomstick](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/broomstick/32/246_2.png) [@Broomstick](https://boards.straightdope.com/u/Broomstick)\ **Post date:** [February 12, 2021, 8:54am UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/52 "2021-02-12T08:54:49Z")
Don’t get me wrong, I’m not actually a Luddite, I do like my internet and many of my gadgets… But I’m still not convinced everything should be connected. I’m not convinced it always adds utility. I am very concerned it reduces security in some cases, as the topic of this thread indicates. ---
**Author:** ![Folacin](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/folacin/32/3195_2.png) [@Folacin](https://boards.straightdope.com/u/Folacin)\ **Post date:** [February 12, 2021, 12:30pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/53 "2021-02-12T12:30:27Z")
> [@Broomstick](#): > > I’m not convinced it always adds utility. I give you the Delta [VoiceIQ](https://www.deltafaucet.com/VoiceIQ). For when you can’t be bothered to fill your water bottle yourself. Although I guess it could be handy for a bathtub. ---
**Author:** ![MrDibble](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mrdibble/32/114_2.png) [@MrDibble](https://boards.straightdope.com/u/MrDibble)\ **Post date:** [February 12, 2021, 3:20pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/54 "2021-02-12T15:20:17Z")
> [@gotpasswords](#): > > Why are SCADA (supervisory control and data acquisition) systems still sitting naked on the public net? This is the crazy thing for me. Without naming names, my company provides SCADA-interfacing software for one of the biggest water authorities in the UK (soon, that will be two of them). And the idea of _any_ of that being open to the internet is just crazy. They have tighter controls than our oil and power clients. ---
**Author:** ![Broomstick](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/broomstick/32/246_2.png) [@Broomstick](https://boards.straightdope.com/u/Broomstick)\ **Post date:** [February 12, 2021, 7:51pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/55 "2021-02-12T19:51:00Z")
> [@MrDibble](#): > > Without naming names, my company provides SCADA-interfacing software for **one of the biggest** water authorities in the UK That’s really your answer - big utilities can afford the security and the people to tell them the security is necessary. Small cities/towns with small utilities in the US… not so much. Sometimes being **de** centralized and under local control isn’t the best solution. ---
**Author:** ![MrDibble](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mrdibble/32/114_2.png) [@MrDibble](https://boards.straightdope.com/u/MrDibble)\ **Post date:** [February 12, 2021, 8:07pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/56 "2021-02-12T20:07:38Z")
> [@Broomstick](#): > > That’s really your answer - big utilities can afford the security and the people to tell them the security is necessary. > > Small cities/towns with small utilities in the US… not so much. Sometimes being **de** centralized and under local control isn’t the best solution. Oh, _fuck_ that noise. My godsdamn _teenager_ knows to put her private shit on a VPN and not to share passwords. They weren’t _poor_, they were fucking _incompetent_. Fuck off with that “only the rich can afford cybersecurity” crap. The best tools are not even proprietary ones, and “don’t all use the one Teamviewer password and don’t still be running Windows motherfucking 7” is shit a schoolkid should know. And does. ---
**Author:** ![Broomstick](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/broomstick/32/246_2.png) [@Broomstick](https://boards.straightdope.com/u/Broomstick)\ **Post date:** [February 12, 2021, 8:12pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/57 "2021-02-12T20:12:19Z")
If small towns were run by teenagers - who tend to be pretty internet savvy - you might have a point. In reality, small towns are run by aging guys (by and large) who are NOT internet savvy and are often cheapskates. That’s why I said **"and the people to tell them the security is necessary."** ---
**Author:** ![MrDibble](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mrdibble/32/114_2.png) [@MrDibble](https://boards.straightdope.com/u/MrDibble)\ **Post date:** [February 12, 2021, 8:28pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/58 "2021-02-12T20:28:54Z")
It doesn’t need a fucking McKinsey consultant to tell anyone who is actually employed to work with computers that sharing one password is a no-no. It is the most basic computer competence. It’s shit my aging parents know. And no, Johna Jana, the head of Oldsmar Water, is neither aging nor a guy. She may be a cheapskate, I wouldn’t know, but like I said, it’s not a money issue. Any more excuses you want to make for the poor hicks? ---
**Author:** ![MrDibble](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mrdibble/32/114_2.png) [@MrDibble](https://boards.straightdope.com/u/MrDibble)\ **Post date:** [February 12, 2021, 8:36pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/59 "2021-02-12T20:36:42Z")
Sorry, Jahn, not Jana ---
**Author:** ![Broomstick](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/broomstick/32/246_2.png) [@Broomstick](https://boards.straightdope.com/u/Broomstick)\ **Post date:** [February 12, 2021, 8:38pm UTC](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471/60 "2021-02-12T20:38:04Z")
> [@MrDibble](#): > > Any more excuses you want to make for the poor hicks? Guess not. As you have clearly demonstrated, they’re fucking idiots. At which point I have to ask who put them in charge of vital infrastructure? The same asshats that re-sourced the water supply for Flint, Michigan? [Previous page](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471.md?page=2) [Next page](https://boards.straightdope.com/t/hacker-tried-to-poison-florida-citys-water-supply/932471.md?page=4)