America’s drinking water is facing attack, with links back to China, Russia and Iran
Houston Chronicle/hearst Newspapers Via Getty Images | Hearst Newspapers | Getty Images
The City of Wichita recently had an experience that’s become all too common — its water system was hacked. The cyberattack, which targeted water metering, billing and payment processing, followed the targeting of water utilities across the U.S. in recent years.
In going after America’s water, hackers aren’t doing anything special. Despite rising fears of AI use in cyber threats, the go-to criminal way into systems remains preying on human foibles, be it via phishing, social engineering, or a system still running on a default password — “old school” cyberattacks, according to Ryan Witt, vice president of cybersecurity firm Proofpoint.
The rising cybercrime wave targeting key infrastructure led the Environmental Protection Agency to issue an enforcement alert warning that 70% of water systems it inspected do not fully comply with requirements in the Safe Drinking Water Act. Without quantifying an exact number, the EPA said some have “alarming cybersecurity vulnerabilities” — default passwords that have not been updated, vulnerable single login setups, and former employees who retained systems access.
While the methods may be simple, an attack last year by an Iranian-backed activist group against 12 water utilities in the U.S. reinforced how purposeful “an attacker’s mindset” can be, according to Witt. The targeted utilities all contained equipment that was Israeli-made.
FBI, NSA, CISA all express concern
In February, the FBI warned Congress that Chinese hackers have burrowed deep into the United States’ cyber infrastructure in an attempt to cause damage, targeting water treatment plans, the electrical grid, transportation systems and other critical infrastructure. A Russian-linked hack in January of a water filtration plant in a small Texas town, Muleshoe — located near a U.S. Air Force base — caused a water tank to overflow. “Water is among the least mature in terms of security,” Adam Isles, head of cybersecurity practice for Chertoff Group, recently told CNBC.
Psychological impact on the population is also a strategic aim, seen not only in targeting of water assets but the Colonial Pipeline hack that made national headlines in 2021, and in the words of the federal Cybersecurity and Infrastructure Security Agency, featured “snaking lines of cars at gas stations across the eastern seaboard and panicked Americans filling bags with fuel, fearful of not being able to get to work or get their kids to school.”
Attacks on U.S. water utilities’ IT systems can have a similar psychological impact, and even if the attacks don’t directly interfere with the operations of the utility, still lessen public trust in water supply. No hack to date has shut off the water to a population, but that’s the bigger worry, said Stuart Madnick, an MIT professor of engineering systems and co-founder of Cybersecurity at MIT Sloan.
Meddling with a water supply through attacks targeting IT (informational technology), like Wichita’s system, is minor in comparison to a successful attack on the OT (operating technology) that controls water plants. That is a massive risk, Madnick said, and the threat of it happening is not zero.
“We have demonstrated in our lab how operations, such as a water plant, could be shut down not just for hours or days, but for weeks. It is definitely technically possible,” he said.
A recent letter sent by EPA Administrator Michael Regan and National Security Advisor Jake Sullivan to the nations’ governors detailed the urgency of the threat. But Madnick is wary of the government’s ability to act quickly or robustly enough to prevent such an occurrence. Budgets, outdated infrastructure, and reluctance to move on an issue that may seem both vital and daunting suggest that the fixes may indeed not come quickly enough. “It has not happened yet, and serious action to prevent ‘likely’ will not happen, until after it has happened,” he said.
Outdated water utility technology
Like any modern system, water utilities rely on technology for monitoring, for operations, and for customer communication. The technology creates vulnerabilities — for providers and users — so the need for enhanced security measures is acute. “The community risk from cyberattacks includes an attacker gaining control of the operations of a system to damage infrastructure, disrupt the availability or flow of water, or altering the chemical levels, which could allow untreated wastewater to be discharged into a waterway or contaminate drinking water provided to a community,” said an EPA spokesman.
Witt says there are some initial steps to take in improving the cyber hygiene of dated systems. “Improving password strength, reducing exposure to public-facing internet, and the need for cybersecurity awareness training,” would go a long way to shoring up defenses, he said. Another potential fix is the deployment of what are called air-gapped systems that separate supervisory and control systems from other networks. Since the easiest way into these systems is to obtain credentials and then exploit the system, “A systems admin should not be able to access office systems such as email and be able to operate a control panel of a water system from the same laptop,” Witt said.
For the most part, attacks that have occurred have been preventable, according to the EPA. “Systems were victimized by destructive and costly cyberattacks because they failed to adopt basic cyber resiliency practices,” the EPA spokesman said. “All drinking water and wastewater systems are at risk — large and small, urban and rural,” he said.
While it has not been a tool needed to date in these water utility attacks, AI is coming alongside the concerted cyber efforts of geopolitical rivals. “Rapid advances in artificial intelligence are giving cyberthreat actors more sophisticated tactics, techniques, and procedures to penetrate operational technology that controls critical infrastructure facilities,” the EPA spokesman said. “These attacks have been linked to a variety of types of malicious actors, including hackers working on behalf of or in support of other nations who could use disruptions to U.S. critical infrastructure to their strategic advantage.”
A soldier walks next to a Tesla Cybertruck, which was donated to the National Guard, after powerful winds fueling devastating wildfires in the Los Angeles area forced people to evacuate, in the Pacific Palisades neighborhood on the west side of Los Angeles, California, U.S. Jan. 13, 2025.
Daniel Cole | Reuters
Tesla started offering discounts on new Cybertruck vehicles in its inventory this week, according to listings on the company’s website.
Discounts are as high as $1,600 off new Cybertrucks, with the reduced price depending on configuration, and up to around $2,600 for demo versions of the trucks in inventory, the listings show. Production of the angular, unpainted steel pickups has reportedly slowed in recent weeks at Tesla’s factory in Austin, Texas.
Deliveries of the unconventional pickup began reaching customers in 2023. CEO Elon Musk originally unveiled the Cybertruck in 2019 and said it would cost around $40,000, but its base price in the U.S. was closer to $80,000 over the course of 2024.
Wall Street previously viewed the Cybertruck as an important driver of growth for Tesla’s core automotive sales.
While the Cybertruck outsold the Ford Lightning F-150 last year in the U.S. and became the fifth best-selling EV domestically, according to data tracked by Cox Automotive, its high price, repeat recalls and production issues in Austin hampered growth. In November, Tesla initiated its sixth recall in a year to replace defective drive inverters.
As CNBC previously reported, Tesla’s deliveries declined slightly year-over-year in 2024, even as EV demand worldwide reached a record. A slew of new competitive models from a wide range of automakers eroded Tesla’s market share.
According to Cox data, full-year EV sales reached an estimated 1.3 million in 2024 in the U.S., an increase of 7.3% from the prior year. But Tesla’s sales for the year declined by about 37,000 vehicles.
The Tesla Model Y SUV and Model 3 sedan ranked as the top two best-selling EVs by a wide margin. But both older, more affordable Tesla models saw sales drop from the previous year. Cox estimated Tesla sold around 38,965 Cybertrucks in the U.S. last year.
In recent days, Musk apologized to customers in California for delays in delivering their Cybertrucks. He said the trucks are now being used to bring supplies and wireless internet service to people in Los Angeles impacted by devastating wildfires.
“Apologies to those expecting Cybertruck deliveries in California over the next few days,” Musk wrote on X. “We need to use those trucks as mobile base stations to provide power to Starlink Internet terminals in areas of LA without connectivity. A new truck will be delivered end of week.”
David Solomon, CEO of Goldman Sachs, speaks during the Reuters NEXT conference, in New York City, U.S., December 10, 2024.
Mike Segar | Reuters
Goldman Sachs CEO David Solomon says there’s an end in sight to the multi-year IPO drought.
“It’s going to pick up,” Solomon said on Wednesday, in an on-stage interview with Cisco CEO Chuck Robbins at a summit hosted by the computer networking company in Silicon Valley. “It’s been slow, it’s been turned off.”
Solomon, who flew to California for the event just after his Wall Street bank reported fourth-quarter results that blew past analysts’ estimates, said the capital markets broadly are showing signs of life ahead of President-elect Donald Trump’s inauguration next week.
The tech IPO market has largely been dormant since the end of 2021, when tech stocks started falling out of favor due to soaring inflation and rising interest rates. Mergers and acquisitions have been difficult in technology because of hefty regulation that’s restricted the ability for the biggest companies to grow through dealmaking.
Solomon said the mood is changing, and he expects momentum M&A as well as in IPOs.
“We have a more constructive kind of optimism, which always helps,” Solomon said. He later added that, “broadly speaking, I think it’s an improved business environment.”
Earlier in the day, Solomon said on his company’s earnings call that Trump’s election and a swing back to Republican power in Washington is already starting to make an impact in the business world. He noted on the call that “there is a significant backlog from sponsors and an overall increased appetite for dealmaking supported by an improved regulatory backdrop.”
Solomon’s comments on the call and at the Cisco event came on a day when the S&P 500 posted his biggest gain since November, helped by a tame inflation report and Goldman’s results. Goldman’s stock popped 6% on Wednesday.
While the stock market has had a strong two-year run and the S&P 500 and Nasdaq hit fresh records last month, IPOs have yet to see a resurgence. Cloud software vendor ServiceTitan debuted on the Nasdaq in December, marking the first significant venture-backed IPO in the U.S. since Rubrik in April.
“The values came down after 2021, people are growing back into those values,” Solomon said at the Cisco summit.
Some companies have said they’re ready. Chipmaker Cerebras filed to go public in September, but the process was slowed down due to a review by the Treasury Department’s Committee on Foreign Investment in the U.S., or CFIUS. In November, online lender Klarna said it had confidentially filed IPO paperwork with the SEC.
Though he’s bullish about what’s coming, Solomon said that there are structural reasons not to go public. He said 25 years ago there were roughly 13,000 public companies in the U.S., and today that number has come down to 3,800. There are higher standards around disclosure for being public, and there’s now tons of private capital available “at scale.”
“It’s not fun being a public company,” Solomon acknowledged. “Who would want to be a public company?”
WATCH: Goldman Sachs tops estimates
Dado Ruvic | Reuters
If TikTok does indeed go dark on Sunday for Americans, there may be a tool for them to continue accessing the popular social app: VPNs.
The Chinese-owned app is set to be removed from mobile app stores and the web for U.S. users on Sunday as a result of a law signed by President Joe Biden in April 2024 requiring that the app be sold to a qualified buyer before the deadline.
Barring a last-minute sale or reprieve from the Supreme Court, the app will almost certainly vanish from the app stores for iPhones and Android phones. It won’t be removed from people’s phones, but the app could stop working.
TikTok plans to shut its service for Americans on Sunday, meaning that even those who already have the app downloaded won’t be able to continue using it, according to reports this week from Reuters and The Information. Apple and Google didn’t comment on their plans for taking down the apps from their app stores on Sunday.
“Basically, an app or a website can check where users came from,” said Justas Palekas, a head of product at IProyal.com, a proxy service. “Based on that, then they can impose restrictions based on their location.”
Masking your physical internet access point
That may stop most users, but for the particularly driven Americans, using VPNs might allow them to continue using the app.
VPNs and a related business-to-business technology called proxies work by tunneling a user’s internet traffic through a server in another country, making it look like they are accessing the internet from a location different than the one they are physically in.
This works because every time a computer connects to the internet, it is identified through an IP number, which is a 12-digit number that is different for every single computer. The first six digits of the number identifies the network, which also includes information about the physical region the request came from.
In China, people have used VPNs for years to get around the country’s firewall, which blocks U.S. websites such as Google and Facebook. VPNs saw big spikes in traffic when India banned TikTok in 2020, and people often use VPNs to watch sporting events from countries where official broadcasts aren’t available.
As of 2022, the VPN market was worth nearly $38 billion, according to the VPN Trust Initiative, a lobbying group.
“We consistently see significant spikes in VPN demand when access to online platforms is restricted, and this situation is no different,” said Lauren Hendry Parsons, privacy advocate at ExpressVPN, a VPN provider that costs $5 per month to use.
“We’re not here to endorse TikTok, but the looming U.S. ban highlights why VPNs matter— millions rely on them for secure, private, and unrestricted access to the internet,” ProtonVPN posted on social media earlier this week. ProtonVPN offers its service for $10 a month.
The price of VPNs
Both ExpressVPN and ProtonVPN allow users to set their internet-access location.
Most VPN services charge a monthly fee to pay for their servers and traffic, but some use a business model where they collect user data or traffic trends, such as when Meta offered a free VPN so it could keep an eye on which competitors’ apps were growing quickly.
A key tradeoff for those who use VPN is speed due to requests having to flow through a middleman computer to mask a users’ physical location.
And although VPNs have worked in the past when governments have banned apps, that doesn’t ensure that VPNs will work if TikTok goes dark. It won’t be clear if ExpressVPN would be able to access TikTok until after the ban takes place, Parsons told CNBC in an email. It’s also possible that TikTok may be able to determine Americans who try to use VPNs to access the app.
(L-R) Sarah Baus of Charleston, S.C., holds a sign that reads “Keep TikTok” as she and other content creators Sallye Miley of Jackson, Mississippi, and Callie Goodwin of Columbia, S.C., stand outside the U.S. Supreme Court Building as the court hears oral arguments on whether to overturn or delay a law that could lead to a ban of TikTok in the U.S., on January 10, 2025 in Washington, DC.
Andrew Harnik | Getty Images
VPNs and proxies to evade regional restrictions have been part of the internet’s landscape for decades, but their use is increasing as governments seek to ban certain services or apps.
Apps are removed by government request all the time. Nearly 1500 apps were removed in regions due to government takedown demands in 2023, according to Apple, with over 1,000 of them in China. Most of them are fringe apps that break laws such as those against gambling, or Chinese video game rules, but increasingly, countries are banning apps for national security or economic development reasons.
Now, the U.S. is poised to ban one of the most popular apps in the country — with 115 million users, it was the second most downloaded app of 2024 across both iOS and Android, according to an estimate provided to CNBC from Sensor Tower, a market intelligence firm.
“As we witness increasing attempts to fragment and censor the internet, the role of VPNs in upholding internet freedom is becoming increasingly critical,” Parsons said.
-
Sports2 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports9 months agoStory injured on diving stop, exits Red Sox game
-
Sports1 year agoGame 1 of WS least-watched in recorded history
-
Sports2 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports3 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment2 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment2 years agoGame-changing Lectric XPedition launched as affordable electric cargo bike
-
Business2 years agoBank of England’s extraordinary response to government policy is almost unthinkable | Ed Conway