Over 4,400 Rockwell controllers exposed online, 22 in the towns where water utilities were attacked

Forescout researchers reported that in the towns where cyberattacks on U.S. water utilities were recently recorded, they discovered 22 Rockwell Automation programmable logic controllers (PLCs) directly accessible from the internet. Nineteen of them operated over the network of the same mobile carrier.

A scan conducted on August 3 counted 4,407 exposed Rockwell controllers worldwide, 2,844 of them in the United States. Forescout stresses, however, that these are accessible devices rather than water utilities or confirmed victims: the company has no evidence that any of these PLCs was compromised.

No vulnerability was needed

By the researchers' assessment, the described consequences of the attacks could have been achieved without exploiting any vulnerability at all. The attackers changed IP addresses and set passwords on controllers that were already accessible from the network — as a result, operators lost visibility and sometimes control over the connected equipment. Neither the government warnings nor Forescout's analysis explains how the attackers found, selected and gained initial access to their targets.

Water utilities in at least seven states reported incidents starting July 27 — the FBI and the Environmental Protection Agency (EPA) said so on July 30. No agency has yet attributed the campaign.

The EtherNet/IP protocol left open on port 44818 creates an unauthenticated channel through which, depending on the configuration, a controller can be identified or have parameters written to it. Forescout found more than 70% of the exposed devices in the United States on the networks of major mobile carriers; an independent snapshot by Censys from July 30 showed a similar picture, with Verizon, AT&T and T-Mobile accounting for 59% of the hosts.

Old hardware and recommendations

Half of the results were MicroLogix 1400 devices, another 8% were MicroLogix 1100; both lines were also mentioned in the FBI and EPA warning. On 19 of the 22 "town" controllers, the firmware was vulnerable to CVE-2017-16740 (a buffer overflow in Modbus TCP, rated 8.6 by Rockwell). Exploitation, however, requires Modbus TCP to be enabled, and Forescout was unable to verify that.

The MicroLogix 1100 was discontinued back in 2022. For those locked out by an attacker-set password, Rockwell issued instructions for resetting to factory settings and loading a known-clean project — but this route requires an up-to-date offline copy of the controller's logic. The FBI notes that at least one victim discovered altered project files after spotting discrepancies in the ladder logic between sites.

The researchers' main takeaway sounds mundane: firmware updates fix specific bugs, but they "do not make it acceptable to connect a PLC directly to a public network." The single most effective thing defenders can do right now is take controllers off the open internet.

Source: The Hacker News