LOTS of US Water Plants Hit by Hacks

https://www.newsnationnow.com/politics/7-states-water-cyberattacks-fbi/

They identified the threat to “programmable logic controllers,”
or PLCs, in water systems and urged infrastructure owners to
remove publicly exposed PLCs from the internet.

Michael McAandrews, a former special agent with the FBI’s
cyberteam, told NewsNation that these attacks are common and
can occur on a massive scale, with bad actors exploiting parts
of our critical infrastructure tied to the internet, possibly
with simple, default passwords.

“What happens is, the attackers will scan the internet, and they’ll
look for the signature of known devices. When they find one, they
simply try the default password. If it hasn’t been changed, then
they’re in. When it comes to operational technology and things
like PLCs, a lot of these passwords are coded by the manufacturers,
and if they’re exposed to the internet, that signature comes back,
the attackers immediately try it, and if they can get in, they’ll
get in and see what they can do,” he said.

McAndrews said there were no ransom demands, so it appears the
attacks were trying to stoke fear.

. . .

   PLCs ... or the software used to diddle with them ?

   Fair GUESS, we're looking at a bunch of entities that
   were all sold the SAME control software. Find a way to
   crack one and you can crack 'em all.

   Note :

https://openautomationsoftware.com/knowledge-base/how-to-view-allenbradley-web-browser/

https://industrialmonitordirect.com/blogs/knowledgebase/displaying-plc-data-on-a-website-solutions-and-architectures

   though not claiming either corp was involved here.

   This was originally declared to be IRANIAN hacks, but
   no supporting info. Iran does do cyber-war (and the
   USA did cyberwar on Iran, most notably penetrating
   the Siemens industrial process controller used on all
   their uranium centrifuges - wrecking them). The odd
   localization of water plants hit says "local actor"
   more than "Iran".

   The actual attackers - could be anyone. Mere 'anarchists'
   or maybe some 12-year-old whose Daddy does IT work for
   such facilities and got a glimpse of the manual.

   Anyway, hardware PLCs are pretty stupid - you don't
   actually hack them directly. They're basically a
   replacement for a box of relays or equivs. Software
   PLCs - a uC or even better - are more "computers",
   oft net-connected these days. An Ard Uno would make
   a fair software PLC. A low-end PI even better.

   But 'computers' CAN be hacked.