According to security firm Dragos, an employee in Oldsmar, Florida, visited a malicious website targeting water utilities on May 18, just hours before a person entered the city’s water treatment plant and tried to poison the drinking water.<\/p>\n\n\n\n
The site did not play a role in the incident, but the situation was worrying, the security firm said.<\/p>\n\n\n\n
“Watering-hole attacks” have become relatively common in computer hacking crimes targeting specific industries and users. <\/p>\n\n\n\n
Florida is often a target.<\/p>\n\n\n\n
The site is owned by a water utility in Florida and was compromised in December by hackers with malicious code targeting water utilities.<\/p>\n\n\n\n
During the 58 days the site was infected, more than 1,000 computers visited the site.<\/p>\n\n\n\n
One visit by an unauthorized person used the site to adjust chemicals that treat drinking water for about 15,000 residents of a small town northwest of Tampa.<\/p>\n\n\n\n
The change was immediately recognized and canceled.<\/p>\n\n\n\n
According to Dragos, the malicious code collected more than 100 pieces of detailed information about visitors.<\/p>\n\n\n\n
Information such as CPU type, operating system, browser, time zone, and geolocation were just a few examples of information that the code could access.<\/p>\n\n\n\n
The code also led visitors to two different websites that collected cryptographic hashes that uniquely identified each connecting device and uploaded fingerprints to a database.<\/p>\n\n\n\n
Although the safety flaws did not cause extreme damage, as the majority of the attacks were caught immediately, Dragos researcher Kent Backman said this should be a wake-up call for water plants.<\/p>\n\n\n