Blog Date: 6/1/2017
Author: Ray Coulombe

The Bowman Avenue Dam in suburban Westchester County, NY, is a small, unassuming dam. The opening is about as wide as a living room and it’s only 20 feet tall. The dam basically keeps a small creek, called Blind Brook, from flooding local basements of suburban houses downstream in Rye Brook, NY.

So why is it noted as one of the biggest international hacking cases of 2013? One of the reasons is that seven Iranian computer hackers penetrated the dam’s computer-guided control system. They did this on behalf on their country’s Revolutionary Guard Corps, which was part of the larger plot that breached about 46 of the nation’s largest financial institutions and blocked hundreds of thousands of customers from their online bank accounts.

Many are questioning why this small, village dam was singled out as part of this major cyber-attack: One idea is that the dam in Rye Brook was a test run for, say, a larger dam or other control system, where a compromise could have disastrous consequences.

Another is that the Iranian hackers confused the Bowman Avenue Dam with the larger and closely named Arthur R. Bowman Dam on the Crooked River in Oregon. This dam is nearly 245 feet tall and 800 feet long—quite a difference when compared to a neighborhood creek.

More than 57,000 industrial control systems (known as SCADA – Supervisory Control and Data Acquisition) are connected to the Internet in our country, many with similarly conceived control systems.

Luckily, all plans around the Bowman Avenue Dam were thwarted as the dam control system was under repair when the attackers attempted to reach the water-flow valves. We may not be so lucky next time, or perhaps there’s an effective exploit waiting to be launched. And as security professionals, we need to think about what other internet-connected infrastructures could potentially be hacked into to cause a major disturbance? In the case of the Bowman Dam, an insecure cellular modem was the entry point.

Businesses, take note of this breach and use it as a security lesson cyber security is holistic and far-reaching—it clearly covers more than just your digital data. Think "Defense in Depth" and don’t stop thinking about it.

Back to Blog List