AOH :: ISN-2073.HTM

Utility hack led to security overhaul

Utility hack led to security overhaul
Utility hack led to security overhaul


By Michael Crawford
FEBRUARY 16, 2006

Apprehending a notorious hacker rarely involves a car chase or a team
of dedicated private investigators, but in the case of Vitek Boden,
life imitated a Hollywood script.

Boden had waged a three-month war against the SCADA (Supervisory
Control and Data Acquisition) system of Maroochy Water Services in
Australia beginning in January 2000, which saw millions of gallons of
sewage spill into waterways, hotel grounds and canals around the
Sunshine Coast suburb. He was caught only after a team of private
investigators hired by Maroochy Water Services alerted police to his

After a brief police pursuit from the Sunshine Coast towards Brisbane,

the technical capability to hack the Scada system.

commands to disrupt various pump stations and that, combined with
proprietary radio equipment and specialized cable, was enough to find
him guilty of what has been dubbed the first case of critical
infrastructure hacking in Australia.

Speaking at the Association of Public Safety Communications Officials
(APCO) conference on Queensland's Gold Coast yesterday, Mark Tripcony,
operations coordinator at Maroochy Water Service, said initially they
thought the disruptions to their pumping station were due to a
neighboring SCADA system or poorly implemented software until late one
night it became clear that some 140 sewage pumping stations were at
the mercy of a hacker.

"We eventually annihilated all the little things we thought might be
causing faults, which were excessive station alarms, pumps running
continually or being turned off, software configuration settings

"But one night around 11 p.m., a systems engineer was changing
configurations in pumping stations and immediately realized they were
being changed back. ... This happened for about half an hour and we
then realized we were being hacked and had to catch the culprit,"  
Tripcony said, adding that at one stage Vitek had turned off every
single alarm in their system and sent sewage running through the
drains in a neighboring suburb.

We had private investigators put cars along all the bridges and
overpasses from the Sunshine Coast to Brisbane, because we knew the
investigators waited until they saw him on the highway and contacted
police to intercept the car.

"When police went to intercept him, he did a runner; the police then
find the last recorded event and messages sent which exactly matched
our SCADA radio monitoring systems."

Vitek was arrested, charged and found guilty on 30 charges of computer
hacking, theft and causing environmental damage and jailed for just
over two years.

Maroochy Water Services had earlier had to "let it slip" to the
authorities they believed they were the victims of a hacking attack,
because the Environmental Protection Authority was trying to prosecute

Since the attack, Maroochy Water Service has spent upwards of $55,309
changing every physical lock for pumping stations; it has also
implemented strict access key controls and adopted further auditing

InfoSec News v2.0 - Coming Soon! 

Site design & layout copyright © 1986-2014 CodeGods