this post was submitted on 01 Aug 2026
232 points (99.6% liked)

Technology

86780 readers
3883 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
232
CISA Releases Guidance Urging Water Treatment Facilities to Disconnect Equipment From the Internet (www.privacyguides.org)
submitted 9 hours ago by new_otters_raft@piefed.ca to c/technology@lemmy.world
23 comments fedilink hide all child comments
 

CISA released an urgent message warning water utilities to disconnect their logic controllers from the internet in the face of rising cyberattacks.

The hacks target internet-facing programmable logic controllers (PLCs) that control equipment and allow machinery to communicate. They monitor and control the water pressure, chemical dosing, and other factors to ensure the water is safe.

Many of the PLCs are apparently open to the internet and use default credentials, allowing a remote attacker to easily take them over.

I assume it is this CISA: https://en.wikipedia.org/wiki/Cybersecurity_and_Infrastructure_Security_Agency

you are viewing a single comment's thread
view the rest of the comments
[โ€“] khepri@lemmy.world 3 points 7 hours ago* (last edited 7 hours ago) (1 children)

So are we just kind of admitting that there exists no way to expose any networked device to the internet securely? Because if it's not possible for PLCs I don't see why it would be possible for any device. If water utilities have to take these offline, then how does that advice not apply for every internet-capable device in every commercial and industrial facility worldwide?

[โ€“] Archr@lemmy.world 5 points 6 hours ago

I don't work directly with PLCs but we do have them at my work. The main thing that makes these different from any other devices is that they typically control physical machines. Which means there is a real danger that them becoming compromised could lead to damaged equipment or even death.

Additionally, many PLCs use older OS versions like xp because their software is notoriously out of date (if it's working why rewrite it when that could introduce safety concerns)

This "urgent" message from CISA does not prove that any of these devices are internet accessible just that if they are then they should be removed. If CISA wanted to require this then they would have released a binding operational directive (BOD) or an emergency directive (ED). Both of which are publicly viewable on their site.