Oldsmar Water Treatment Facility Attack

Friday, February 5, 2021, an adversary successfully connected to an engineer workstation at the Oldsmar water treatment plant.  An alert employee was aware that someone had connected to the computer at the bottom of the screen [5].  The employee was not alarmed because it was typical for managers and other engineers to connect remotely to check the water plant’s operational condition [5].  However, the employee continued to watch as the attacker started to open the critical functions and finally making changes to the function to control the amount of sodium hydroxide present in the water treatment process.  Sodium hydroxide is a chemical used to remove metals from the water in the treatment process, commonly known to us as drain cleaner.  The changes made to the system would have taken from 24 to 36 hours to take effect, putting no one in danger.  The Federal Bureau of Investigation (FBI) is currently investigating the attack and has released an advisory warning of similar attacks that can happen.  The advisory states the importance of updating and patching the critical infrastructure systems to prevent attackers from exploiting their systems [6].  It has not been determined if TeamViewer was the root cause of entry, but at this moment, there are no indications that their software has been compromised. It was stated that the Oldsmar water plant was still using an outdated operating system, which could have lead to the original foothold obtained by attackers [7].