Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Small Kansas Water Utility System Hacking Highlights Risks

A former Kansas utility worker has been charged with remotely tampering with a public water system’s cleaning procedures, highlighting the difficulty smaller utilities face in protecting against hackers.

A former Kansas utility worker has been charged with remotely tampering with a public water system’s cleaning procedures, highlighting the difficulty smaller utilities face in protecting against hackers.

Wyatt Travnichek, 22, was charged last month with remotely accessing the Post Rock Rural Water District’s systems in March 2019, about two months after he quit his job with the utility. He’s accused of shutting down the facility’s cleaning and disinfecting procedures.

When he worked for the utility, he would monitor the water plant remotely by logging into its computer system, the Kansas City Star reports.

The federal indictment says Travnichek used a Samsung phone to commit the offense. Post Rock utility officials declined to provide further details. Travnichek’s attorney, a federal public defender, didn’t respond to the Star’s request for comment.

No centralized database of hacker attacks on utilities exists, but a 2016 report from the federal Department of Energy said the Department of Homeland Security responded to 25 water cybersecurity incidents in 2015.

The Florida city of Oldsmar, population 15,000, reported in February that a hacker attempted to poison its water supply by remotely accessing its system and changing chemical levels. An employee was able to quickly reverse the hacker’s actions.

Small utilities such as Post Rock may not have the resources to hire dedicated information technology staff. Commonly their employees juggle multiple roles, including cybersecurity.

“As far as cities having an IT person, I just don’t know of any our size,” said Bill Shroyer, assistant city administrator in Sabetha, in northern Kansas, and president of the Kansas Rural Water Association. “And if we did have an IT person, they better know how to repair pot holes, fix water leaks, pick up snow and everything else that we do.”

Security experts say the Post Rock case could be as simple as officials failing to revoke Travnichek’s electronic access after he quit. The indictment doesn’t specify how he accessed the system.

“If this is indeed a case with an insider, of course an insider could possess the methods to use that remote access if you don’t have good policies,” said Marty Edwards, an expert on critical infrastructure at the cybersecurity firm Tenable. “When the individual is terminated, for example, from a job, you want to make sure you remove their credentialed access from these systems.”

Related: U.S. Gov Warning on Water Supply Hack: Get Rid of Windows 7

Related: Hack Exposes Vulnerability of Cash-Strapped US Water Plants

Related: Industry Reactions to U.S. Water Plant Hack: Feedback Friday

Written By

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Cybercrime

A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...