In the first week of August, nine municipal water systems in Michigan reported activity consistent with a federal warning about someone tampering with the equipment that runs their water. The state said all of them stayed in service. There was no public health impact. Officials did not name the communities.
The interesting part is how it worked.
What the attackers actually did
The FBI and the EPA described it in a joint bulletin on July 30. The attackers went after controllers that were reachable from the internet. Once inside, they changed the device's IP address and set a password on it. The utility lost its view of the equipment. In some cases it lost control of it too.
Nothing exotic got installed. No clever virus. Somebody reached a device that was supposed to be reachable, changed the locks, and walked away.
Operational effects reported to the FBI included loss of pressure and flooding. At least one organization noticed its control program had been edited.
Why should a hardware store care
You are not a water utility. Fair. That bulletin was not addressed to you.
But the situation it describes is not a water utility situation. It is an arrangement. A piece of equipment that does a job, sitting on a network, reachable from outside so somebody can check on it without driving there.
Now think about what's in your building.
The camera recorder behind the counter, the one with the phone app that lets you look in from home. That app works because something is open to the internet.
The walk-in cooler monitor at the restaurant. The fuel tank gauge at the marina. The well pump controls at the campground. The boiler your mechanical contractor watches remotely. The machine on the shop floor that the vendor dials into when it throws a code.
All of it was set up by somebody, usually to be helpful. In a lot of small businesses, nobody has looked at that arrangement since the day it went in.
In August, five federal agencies issued an advisory on a related campaign and said something worth reading twice. They warned that this risk is higher for organizations that let a service provider or integrator have remote access to their equipment, because the owner may not realize the equipment is exposed at all.
Old devices do not get safer
A security firm scanned the open internet in early August and found more than 4,400 of these industrial controllers exposed to anyone who looked. About 2,844 of them were in the United States.
Twenty-two sat in cities that had already reported attacks. Nineteen of those ran firmware that was still vulnerable to a flaw the manufacturer had patched in 2017.
Nine years. The fix existed for nine years. Nobody applied it.
That is the ordinary way this happens. Not a brilliant attacker. A device that was installed, forgotten, and left reachable. A patch that was available and never installed, because nobody owned that job.
What to do this week
Find out what's reachable from outside your network. Ask the person who set it up. If you cannot get a straight answer, look at the port forwarding settings on your router. Every forwarded port is a door with a label on it.
Change the password on each of those devices to something long and unique. Not your Wi-Fi password. Not the one written on the sticky note under the keyboard. Device passwords and network passwords are separate jobs.
If a vendor needs in, that access should run through a real remote connection that asks for more than a password, not a port left open to the world. Here is the test. If you can pull up your camera feed from a parking lot in Marquette on your phone, so can somebody else.
The honest part
Most Upper Peninsula businesses will never be the target of a campaign like the one that hit those water systems. Those attacks were pointed at one sector, and the people behind them were hunting for a specific kind of hardware.
But the door they used was not special. It was ordinary. Remote access that somebody installed so a job would be easier, on a device nobody had looked at in years.
You probably do not need new equipment for this. You need to know what is reachable, and then close the parts that do not need to be open.
If you are not sure what is exposed, that is a reasonable place to start. We will look at what you have and tell you what we find, whether or not you hire us for anything afterward.
Call us at (906) 662-4481, or contact us for a free assessment.