Several United States security agencies have warned that cyberattacks against water and sewage systems continue and hackers are attempting to invade Siemens control equipment for critical infrastructure. According to the authorities, such attacks have affected United States multi-terrestrial water facilities and may have resulted in parking, safety incidents and damage to equipment.
Target points to Siemens controller.
The United States Cyber Security and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI) and the National Security Agency (NSA) indicated on Wednesday that the attackers were targeting “all” Westgate S7 programmable logical controllers. Such equipment is usually used to control automated physical processes in energy, water, manufacturing and agriculture.
According to CISA, these attacks were part of a larger operation targeting water and sewage systems throughout the United States. If the equipment is invaded, the critical infrastructure that relies on these controllers can be disrupted or even caused by safety incidents.
AI is used to generate attack scripts.
According to U.S. agencies, hackers are using AI to generate attack scripts and to search for loopholes in connection with open information. The targeted equipment usually runs out-of-date software, or is less secure.
A professional involved in emergency response to critical infrastructure indicated to TechCrunch that it was noteworthy that the attackers not only used AI to identify vulnerable equipment, but also to understand how these controllers worked. He noted, however, that such equipment was inherently a high exposure risk.
Higher pressure in rural areas
CISA has repeatedly cautioned key infrastructure operators against direct Internet access to such equipment. United States officials also recognize that rural communities are often more vulnerable, as these systems typically cover a larger range of services.
At present, many United States water facilities have been reported to have been invaded, including Minnesota, Michigan, Arkansas, Georgia and New Jersey. As the scope of the attack expanded, the issue of network protection of the water system received renewed attention.