A team of researchers from Georgia Institute of Technology recently developed a new form of ransomware that could take over control of water treatment plants. The simulated hacking exercise was able to command programmable logic controls (PLCs) to shut down water valves, increase or decrease the amount of chemicals used to treat water, and churn out false readings.
According to the researchers, simulations were conducted to highlight the vulnerabilities in critical infrastructure. This research comes at a time when cyber security concerns have reached a high point in light of recent cyber attacking and hacking attempts across the globe.
Cyber attacks go far beyond the acquisition of emails and corruption of websites. Any establishment with PLCs is, in theory, vulnerable to hacking. This could range from water infrastructure, as demonstrated here, to electrical dependency.
This from Georgia Institute of Technology:
Though no real ransomware attacks have been publicly reported on the process control components of industrial control systems, the attacks have become a significant problem for patient data in hospitals and customer data in businesses. Attackers gain access to these systems and encrypt the data, demanding a ransom to provide the encryption key that allows the data to be used again.Ransomware generated an estimated $200 million for attackers during the first quarter of 2016, and the researchers believe it’s only a matter of time before critical industrial systems are compromised and held for ransom.
Ransomware generated an estimated $200 million for attackers during the first quarter of 2016, and the researchers believe it’s only a matter of time before critical industrial systems are compromised and held for ransom.
“We are expecting ransomware to go one step farther, beyond the customer data, to compromise the control systems themselves,” says David Formby, co-author of the study. “That could allow attackers to hold hostage critical systems such as water treatment plants and manufacturing facilities. Compromising the programmable logic controllers (PLCs) in these systems is a next logical step for these attackers.”
Understanding the attack brings the researchers one step closer to better preventative measures. The team hopes that this study brings attention to the issue of PLC hacking and prompts increased defense in the form of improved password security and limited connections.
Additionally, the researchers behind the study have launched a company that focuses on developing strategies to protect systems such as these.
