Supervisory Control and Data Acquisition (SCADA) systems are used to run critical infrastructure systems, such as power plants. Despite their importance, researchers are now saying these systems lack proper security measures and in some cases are available via a Google search.<\/p>\n
Speaking at the Black Hat conference in Las Vegas, chief technology officer at FusionX<\/a>, Tom Parker,<\/a> demonstrated how easy it is to access these systems. Parker typed some search terms into Google related to a Programmable Logic Controller, and received numerous results. Among these was a reference to an \u201cRTU pump status\u201d for a remote terminal unit, commonly used in water treatment plants. The result also included a password for the RTU \u2013 \u201c1234\u201d.<\/p>\n Parker highlighted the extent of the vulnerability when saying, \u201cYou can do a Google search with your Web browser and start operating [circuit] breakers, potentially.”<\/p>\n Fellow researcher Jonathan Pollet<\/a>, \u00a0founder of Red Tiger Security<\/a>, went on to highlight how some of these SCADA systems don\u2019t have any form of access control. \u201cYou can make it do anything you want it to do. If that RTU or PLC has large motors connected to it, pumping out water or chemicals, the equipment could be turned off. If it was a substation and the power recloser switches were closed, we could break it open and create an (electricity) outage for an entire area or city…The bottom line is you could cause physical damage to whatever is connected to that PLC,\u201d said Pollet.<\/p>\n