ハッカーがフロリダの水道処理設備に侵入し、水酸化ナトリウムの濃度を制御した？

こんにちは、丸山満彦です。

ハッカーがフロリダの水道処理設備に侵入し、水酸化ナトリウムの濃度を制御したみたいですね。。。結果的に市民に提供される水道の水質には影響が出ない段階で気づき、問題はなかったということのようです。。。YouTubeは15分ほどです。。。

● YouTube - Pinellas Sheriff

・2021.02.08 Treatment Plant Intrusion Press Conference 

Sheriff Bob Gualtieri gave a press conference surrounding the unlawful intrusion to the City of Oldsmar's water treatment system. He was joined by Mayor Eric Seidel and City Manager Al Braithwaite.

---------- 2021.02.12 追記 ----------

■ CISA

2021.02.11 Alert (AA21-042A) Compromise of U.S. Water Treatment Facility

---------- 追記終わり ----------

---

■ 報道

● Tampa Bay Times

・2021.02.08 Someone tried to poison Oldsmar’s water supply during hack, sheriff says by JACK EVANS

Pinellas Sheriff Bob Gualtieri said the attacker tried to raise levels of sodium hydroxide, also known as lye, by a factor of more than 100.

● The Washington Post

・2021.02.09 A hacker broke into a Florida town’s water supply and tried to poison it with lye, police said

● Govinfo Security 

・2021.02.09 Hacker Breached Florida City's Water Treatment System by Jeremy Kirk

Officials Halted Dangerous Change in Level of Lye in System, Set by Remote Intruder

・2021.02.09 5 Critical Questions Raised by Water Treatment Facility Hack by Scott Ferguson

Incident Highlights the Need to Enhance OT Security

検討ポイントとして次の5つをあげていますね。

1. リモートアクセスの使用は適切だったか
2. ハッカーは認証情報を取得したか
3. 最も重要なセキュリティ手順は何か
4. OTのセキュリティがおろそかになっていなかったか
5. CISA（連邦政府）はもっと関与すべきか
   
   

● BBC News

・2021.02.09 Hacker tries to poison water supply of Florida city

A computer hacker gained access to the water system of a city in Florida and tried to pump in a "dangerous" amount of a chemical, officials say.

The hacker briefly increased the amount of sodium hydroxide (lye) in Oldsmar's water treatment system, but a worker spotted it and reversed the action.

Lye is used in small amounts to control acidity but a large amount could have caused major problems in the water.

Oldsmar Mayor Eric Seidel said: "There's a bad actor out there."

No arrests have yet been made and it is not known if the hack was done from within the US or outside.

・2021.02.09 米フロリダ州の水道システムにハッカー侵入、有害物質を大量に加えようと

米フロリダ州オールズマーで5日、水道システムにハッカーが侵入し、人体に「有害な」濃度の化学物質を水に加えようとした。当局が8日に明らかにした。

ハッカーはオールズマーの水処理システムに遠隔操作で侵入し、水酸化ナトリウム濃度を一時的に高めたが、作業員が気付いて元に戻した。

地元紙タンパ・ベイ・タイムズによると、5日朝、施設のオペレーターがシステム内へ侵入しようとする動きに気付いたが、上司が行っているものだと思ったという。

しかし同日午後、ハッカーは再び侵入を試みた。この時は侵入に成功し、処理ソフトウェアにアクセスして水酸化ナトリウム濃度を通常の100ppmから100倍以上の1万1100ppmに引き上げた。オペレーターは直ちに通常値に戻した。

● CNN

・2021.02.09 Someone tried to poison a Florida city by hacking into the water treatment system, sheriff says by Amir Vera, Jamiel Lynch and Christina Carrega,

Florida Sen. Marco Rubio wants the hacking of the water treatment system handled as a national security measure, he tweeted Monday.

"I will be asking the @FBI to provide all assistance necessary in investigating an attempt to poison the water supply of a #Florida city," the tweet read. "This should be treated as a matter of national security."

・2021.02.09 浄水システムに不正侵入、苛性ソーダ濃度１００倍に設定　米フロリダ州

事件についてはピネラス郡保安官事務所や米連邦捜査局（ＦＢＩ）、シークレットサービスが捜査している。

● Reuters

・2021.02.09 Hackers try to contaminate Florida town's water supply through computer breach by Christopher Bing

Hackers broke into the computer system of a facility that treats water for about 15,000 people near Tampa, Florida and sought to add a dangerous level of additive to the water supply, the Pinellas County Sheriff said on Monday.

● The New York Post

・2021.02.08 Hackers allegedly tried to poison Florida city’s water supply by Tamar Lapin

A hacker recently tried to poison a Florida city’s water supply, police announced Monday.

Pinellas County Sheriff Bob Gualtieri said someone remotely accessed a computer system that controls the City of Oldsmar’s water treatment facility on Friday.

The unidentified person increased the amount of sodium hydroxide being distributed into the city’s drinking water to a “dangerous” level, Gualtieri said at a press conference.

● NBC Montana

・2021.02.10 Hack of Florida water facility highlights critical infrastructure vulnerabilities by Leandra Bernstein

According to Gualtieri, a hacker (or hackers) gained remote access to a plant operator's computer Friday, Feb. 5 and within a few minutes had increased the levels of sodium hydroxide dramatically from about 100 parts per million to 1,100 parts per million. Sodium hydroxide, or lye, is used in small amounts to control acidity and remove metals from drinking water. Lye poisoning can cause burning, severe abdominal pain, vomiting, reduced blood pressure and heart rate.

● Security InfoWatch

・2021.02.09 Catastrophe narrowly averted in Florida water plant hack by Joel Griffin

Experts say incident should serve as a 'wake-up call' in critical infrastructure cybersecurity

● IT Media

・2021.02.09 水道局の水処理システムにハッカーが侵入し、飲料水の汚染試み　フロリダ州で