# Avoid Exploitation of Unitronics PLCs used in Public Water Systems

- Link: https://www.agilicus.com/avoid-exploitation-of-unitronics-plcs-used-in-public-water-systems/
- Published: 2023-11-29T20:06:04+00:00
- Author: Don Bowman

Recently some Human Machine Interface (HMI) used in Public Water systems, specifically
wastewater treatment plants, have come under attack. The first I read of it was 
in “I[ranian hacker group CyberAv3ngers allegedly breach Municipal Water Authority of Aliquippa](https://industrialcyber.co/industrial-cyber-attacks/iranian-hacker-group-cyberav3ngers-allegedly-breach-municipal-water-authority-of-aliquippa/)“,
which was immediately followed by me heading to Google Maps and typing in “[Aliquippa](https://www.google.ca/maps/place/Aliquippa,+PA)“.
Reading through the various articles, I was able to piece it together, how this 
Exploitation of Unitronics PLCs used in Public Water Systems was happening:

![Exploitation of Unitronics PLCs used in Public Water Systems](https://www.agilicus.
com/www/24ef784f-image.png)

 1. For political reasons, someone has chosen Unitronics PLC and HMI as a target
 2. These are commonly [used](https://www.unitronicsplc.com/industries/waterwaste-water/)
    in public water systems
 3. Simple weakness like default password were used
 4. Simple holes through firewalls, missing Zero Trust, were used
 5. Most people focused on the specific grafitti/damage, rather than on the lateral
    traversal (the onwards damage) that might have come

### CISA advisory on Exploitation of Unitronics PLCs used in Public Water Systems

CISA issued an [advisory](https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems)
on this Exploitation of Unitronics PLCs used in Public Water Systems with some good
information and recommendations, specifically:

 * Change the Unitronics PLC default password—validate that the default password“**
   1111**” is not in use.
 * Require **multifactor authentication** for all remote access to the operational
   technology network, **including** from the **corporate**/IT network and external
   networks.
 * Disconnect the PLC from the open internet. If remote access is necessary, implement
   a Firewall/VPN in front of the PLC to control network access to the remote PLC.
   A VPN or gateway device can enable multifactor authentication for remote access
   even if the PLC does not support multifactor authentication. Unitronics also 
   has a secure cellular based longhaul transport device that is secure to their
   cloud services.
 * **Back** **up** the logic and configurations on any Unitronics PLCs to enable
   fast recovery. Become familiar with the process for factory resetting and deploying
   configurations to a device in the event of being hit by ransomware.
 * If possible, utilize a TCP port that is **different** than the default port TCP**
   20256**. Cyber actors are actively targeting TCP 20256 after identifying it through
   network probing as a port associated to Unitronics PLC. Once identified, they
   leverage scripts specific to PCOM/TCP to query and validate the system, allowing
   for further probing and connection. If available, use PCOM/TCP filters to parse
   out the packets.
 * Update PLC/HMI to the latest version provided by Unitronics. to avoid Exploitation
   of Unitronics PLCs used in Public Water Systems

![Shodan Unitronics PLC](https://www.agilicus.com/www/4adf342a-image.png)

The only think i really quibble with here is the Firewall/VPN. I strongly recommend
a per-resource authentication + authorisation, as provided by a Zero Trust product,
shamelessly plugging Agilicus AnyX here. You really need the comfort of strong authentication,
single-sign-on, multi-factor, and, fine-grained audit. A VPN is just an Ethernet
cable with more length, no specific controls on the lateral traversal.

Using everyone’s favourite tool, [shodan.io](https://shodan.io/). we can see there
are at least a few Unitronics HMI devices hanging out there for ease of access. 
And, all have the default ports open, leading me to suspect, maybe more.

So, if you are using these (or similar devices), and worried about the balance of
removing team efficiency by removing access versus having some hacker waltz in, 
have I got a solution for you.

And, I would love to talk with you about it, using either the Chat icon on this 
page, email info @ agilicus,com, or [Contact](https://www.agilicus.com/contact-us/).
If you would like to pick a specific time, [Book a meeting](https://www.agilicus.com/book-calendar-meeting/).