Skip to Content

Honeypots Lure Industrial Hackers Into the Open

Dummy water-plant control systems rapidly attracted attention from hackers who tinkered with their settings—suggesting it happens to real industrial systems, too.

Just 18 hours after security researcher Kyle Wilhoit connected two dummy industrial control systems and one real one to the Internet, someone began attacking one of them, and things soon got worse. Over the course of the experiment, conducted during December 2012, a series of sophisticated attacks were mounted on the “honeypots,” which Wilhoit set up to find out how often malicious hackers target industrial infrastructure.

man sits in fron of bank of monitors
Hot seat: New research suggests that hackers may be targeting critical infrastructure. The control room in this image, at a coal plant in Illinois operated by City Water, Light & Power, is unrelated to the work.

Wilhoit’s findings provide some of the best evidence yet that people are actively looking for and attempting to take unauthorized control of the type of industrial systems that are used to control everything from energy plants to office HVAC systems. Recent years have seen U.S. politicians speak of and researchers demonstrate the vulnerability of such systems, and thousands are known to be connected to the Internet with weak or nonexistent controls against unauthorized access (see “What Happened When One Man Pinged the Whole Internet”).

“Everybody talks about [industrial control systems] being attacked, but no one has any data to back that up,” says Wilhoit, who works for the computer security company Trend Micro. “I know that my ICS honeypots have definitely been ‘owned,’ and I think there’s a reasonable likelihood that it has happened in the wild.”

Last year, the then-defense secretary Leon Panetta warned that successful attacks had been made on the control systems of U.S. electricity and water plants and transportation systems. But since then, little has been disclosed publicly about such incidents. A March newsletter from the Department of Homeland security’s Industrial Control Systems Cyber Emergency Response Team contains one of the few public disclosures of such an attack, saying that energy management systems at a factory and a state government building in New Jersey were compromised in 2012.

Wilhoit’s work suggests that this may be just the tip of the iceberg. He used three different honeypots, each of which was carefully designed so that an attacker would believe he or she had discovered a computer that controlled physical settings on an industrial system. One of the decoys offered administration Web pages for a water pump that acted like the real thing; another was a physical server installed with software commonly used to control physical industrial equipment; Wilhoit also bought a piece of hardware used to connect a computer to control industrial equipment and installed it in his basement so that it appeared to control the HVAC and lighting of a factory.

A total of 39 attacks were mounted on Wilhoit’s honeypots, some of which involved modifying the settings of the physical system they appeared to control. Attacks appeared to originate from computers in a variety of countries, with 35 percent from China, 19 percent from the U.S., and 12 percent from Laos. Attackers often appeared to use automated tools that search out industrial systems on the Internet before investigating more thoroughly.

The most striking attacks exploited bugs to change the settings of Wilhoit’s imaginary industrial systems. “They were doing things that would change the water pressure, or temperature, or stop the flow on the water pump,” says Wilhoit. “If it is happening to a honeypot, what is happening to real devices with no protections? It is apparent that there is some expertise out there.”

Because the attacks made use of techniques specific to industrial control systems, Wilhoit believes they were carried out by people intent on finding and messing with such systems. Some of the attacks involved sending e-mails to the administrator address he made available. Attachments to those e-mails hid previously unknown malicious software that Trend Micro is now investigating. “I can’t relate all the details,” he says. “It’s substantial as findings go.”

Wilhoit will say that the malware he received appeared to be designed to take over a commonly used controller for industrial control systems. Wilhoit and colleagues at Trend Micro are now operating more honeypots, setting them up in locations around the world to record a global picture of such activity. They are also working on new strategies that could help defend such systems.

Many relatively simple countermeasures do exist to protect industrial systems, but they are not routinely used, says Billy Rios, a security researcher who works on industrial control systems at security startup company Cylance, and who has disclosed hundreds of bugs in common industrial systems. Removing these systems from the publicly accessible Internet is the most crucial defensive measure, says Rios. However, even systems only accessible by a private connection could be reached by targeting a company employees for passwords, and once an attacker gains access to an industrial system there are often many security bugs for them to exploit. “The security of the industry in general is really poor,” says Rios.

Joel Young, chief technology officer of Digi International, which sells hardware used to connect industrial control systems to the Internet, says that the companies he sells to have traditionally thought of reliability and privacy as more important than security. Home energy management systems and smart meters, for example, have been carefully designed with features intended to guard privacy due to public concern about their leaking energy use data. “But if you look at putting a server out to monitor a substation, there’s just no security at all,” he says. “It’s like, who would want to hack into this?”

Rios says that companies that make industrial control systems have begun to pay more attention to security issues, but he’s still finding bugs in new products, and in many older products that remain in use. “These devices have a lifecycle of 20 to 30 years.”

Keep Reading

Most Popular

DeepMind’s cofounder: Generative AI is just a phase. What’s next is interactive AI.

“This is a profound moment in the history of technology,” says Mustafa Suleyman.

What to know about this autumn’s covid vaccines

New variants will pose a challenge, but early signs suggest the shots will still boost antibody responses.

Human-plus-AI solutions mitigate security threats

With the right human oversight, emerging technologies like artificial intelligence can help keep business and customer data secure

Next slide, please: A brief history of the corporate presentation

From million-dollar slide shows to Steve Jobs’s introduction of the iPhone, a bit of show business never hurt plain old business.

Stay connected

Illustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at with a list of newsletters you’d like to receive.