Cyber Attacks on Water Systems

Quote of the Day

Disabling cyberattacks are striking water and wastewater systems throughout the United States. These attacks have the potential to disrupt the critical lifeline of clean and safe drinking water, as well as impose significant costs on affected communities,

Michael S. Regan
An administrator with the Environmental Protection Agency (EPA)
Jake Sullivan
White House National Security Adviser
March 20, 2024
Letter to U.S governors.
Warning About Drinking Water Issued Nationwide (newsweek.com)

Prepare appropriately.

I want an underground bunker in Idaho with its own well and septic systems.

Share

15 thoughts on “Cyber Attacks on Water Systems

  1. To say nothing of dumping a batch of carfentanil in it? We are a just in time, indefensible society. And un-walled village open to the murderous hordes. Should they so desire to attack us, they can do so at will. ( I got an idea, let’s go swat that great big bear with a stick!)
    This country could be reduced to tribalism in a matter of hours.
    And the real tribesman are being/have already been imported to make sure we stay that way.
    “This system was built for a moral and religious people”. A very trusting people we have been. No one that survives is going to be.
    “Those that beat their swords into plow shears, will end up plowing for those that didn’t.”
    So, it has been, so it will always be.
    Got tribe?

  2. Anyone got a source for reliable 30-round mags for AR-10s? Asking for a friend.

    • No 30’s for AR10’s.
      If you’re outside the morono-states. You can order 25’s directly from Mag-pul. If inside, take a vacation?
      I like the Mag-pul as the polymer feed lips have just enough give to them to feed and function under fully-loaded upward pressure.
      If you end up getting the older 20 rnd. steel magazines. I always ran 16 rounds in them. The drag on the bolt carrier was too much when fully loaded to operate reliably. Especially if using an over-gassed carbine length gas system.
      Mid/rifle-length gas systems are the best for 308. But make sure each mag you use will function properly, and keep those mags with that gun.
      Enjoy brother! Tell your friend I said hey.
      P.S. And not to shill. But the standard PMC 308 is the most velocity consistent ammo I’ve ever bought.
      I wished I had bought it than reloading over the years.

      • Have both 20s and 25s from Magpul, excellent equipment; portability and mobility favors the 20s, the 25s are borderline too heavy for high mobility (which, to a point, also applies to the AR-10 itself; compare stage times in 3-Gun between AR-15 users and the AR-10 shooters in Heavy Metal. But In Real Life the 10 gains 250-400 meters over the 15 which could Become Useful). As for the Magpul 50-round drum, it’s a range toy that would work well from behind a barricade, but a couple weigh enough that you might as well carry a belt-fed and be done with it. A 30, were it to exist, would be heavy and bulky but somewhat useful in barricaded positions and – probably – able to allow a couple to be carried in pouches on the chest rig or hip bag.

        My friend says “hi” back.

        • Is there a reason that they aren’t making quad-stack mags in 308/7.62? The mags need to be reasonably short. 30’s in 5.56 are awkwardly long to start with, in major caliber they are just silly toys, intended for the jihadist sort of spray and pray employment.

          • “Is there a reason that they aren’t making quad-stack mags in 308/7.62?”

            Weight plus size, and reliability. Magpul says their 50-round drums weigh 1.5 lbs empty, 4.5 lbs full and is no longer than a 25-round straight mag. Even in a shorter 4-stack package that’s a lot of mass hanging forward of the gun’s pivot axis, not to mention the bulk that would be added to the front of a plate carrier. Look around and see how many 5.56 shooters have 4-stacks on their carrier; I think I’ve seen two in years of 3-Gun, and I was surprised both ran without jams. There’s a reason 40-round straight mags are popular in 3-Gun, and it’s because 40 rounds allows completing a lot of stages without a mag change, or at least better control of “when” on mag changes. And, it’s not uncommon for 5.56 Game Gunners to reload with 45 grain bullets to cut overall weight and reduce recoil. Out in The Real World where Energy On Target Counts – which is why some of us use 7.62X51 in the first place, that and longer effective range than 5.56 – flexibility, which means mobility, is pretty high on the to-do list. Any 3-Gun match will have a lot more 5.56 than Heavy Metal shooters.

            50-60 rounds at a time would have advantages in some situations (not as much as a few 200-round belts, though) but in a High Movement environment it would be a handicap. Which is why a good Fire Team will have a mix of weapons. See: USMC, Designated Marksman, for more info.

          • I thought those original 4 stack mags looked like a good idea, but the price was several multiples of two standard mags, which I suspect damped any real market appeal.
            I liked the idea, as I had used a redi-mag to get that capacity, but when I brought it to a 3-gun match, I was informed it was verboten. And here I thought one of the major reasons for those sorts of matches was to validate new ideas for equipment. Nope. Gamesmanship had taken control.

  3. With the exception of some employe convieance there is no reason for the water treatment or waist treatment plant to be on the internet. For the most part almost no industrial or comercial control system requires an out side connection.

    The only secure network is one that is isolated from the public “Local VLAN”. Unplug the web cable and the system is secure. No reason to have a wireless network ether park near by and reck the system?

    • While not entirely true, there is a lot of truth in that. Air gapped systems are not guaranteed to be secure, but they are certainly much more secure than those connected to the Internet. And the security issues of air gapped systems tend to be in information leakage rather than in compromise of system integrity.

      Things like power plants and substations need communication with other nodes in the system. I would not be surprised if pumping stations for water, gas, and oil pipelines need communication with other nodes as well.

      • Nothing is guaranteed secure as you say, When there is little or no consideration from the controls aspect made for security the issue gets worse. The cost savings for using existing infrastructure (internet) for remote locations rules the day.

        The remote systems do require communications but using the Internet and standard local network configurations may not be the best method security wise.

        It has been my experience that much of the controls designers have little or no network system knowledge. I could spend weeks making them assign an IP address to switches and routers while they complained the network did not work.

        Years ago when hard wire was the standard controls architecture there still could be local operation issues but mostly not system wide. A specific contact closure could trigger an automatic system response but you would need control system knowledge and have physical contact to generate the issue. Local physical area security could resolve that.

        These days you can be on the opposite side of the planet and breach the system. Local physical security systems are no deterrent.

        Decision makers know about as much as a Supreme Court Justice “A bump stock makes the rate of fire 800 rounds a second”.

        Project decisions are made with the thinking “That’s an IT problem”. Sound familiar.

        All of the system issues in my world were from granting local access with out a IT review of the device to be attached to a local LAN because they were in a hurry.

        It was quite often when procedures were followed a laptop was denied access and security would take the device and escort the equipment and the owner out of the facility. Again local physical security. Very limited remote access.

        In a world that still thinks that checking your ID at the gate is security there is a problem.

  4. “Things like power plants and substations need communication with other nodes in the system.”.

    Which is an argument for private networks isolated from the internet. More expensive, but which would be cheaper: establishing a private network initially or recovering and rebuilding after a destructive cyber attack (such as the Israelis are rumored to have done with Iran’s centrifuges, although that’s purported to be the result of sneakernet rather than internet access).

    Way back when we used “sally port” type methodology for secure remote access; much slower and a PITA to be sure, but more secure than anything a DNS-enabled browser has to offer. Big difference between Joe and Jane unable to buy clothes and gizmos online today because of a cyber attack and 100,000 users without potable water for days or weeks. Convenience has costs.

    • VPNs can do much of what is needed, though a physically separate network has the advantage that you don’t need to worry about DoS attacks.

      The real problem is idiot IT departments that put mission critical systems on the same network as unimportant Windows systems, and protect that network in sloppy ways if at all.

      • In my experience most IT departments are more interested in building their their own fiefdoms than supporting the corporate mission.
        There are relatively few good IT people and network security types – and most places aren’t willing to pay the money to get them.
        For years I’ve worked on systems that were too tightly constrained to be really usable while being so poorly setup and run that external hackers weren’t needed – they were their own worst enemy!
        I no longer use a work network for anything personal; I don’t trust them.

        • Agreed. Way back in my first job, at DEC, we referred to IT as “Product Prevention” because it seemed most of what they did was to impede the work of people delivering real products and real revenue.
          In the years since, I haven’t seen this improve.

Comments are closed.