Over 100 smart irrigation systems were left exposed on the internet without a password last month, allowing anyone to access and tamper with water irrigation schedules for crops, tree plantations, cities and building complexes.
The exposed irrigation systems were discovered by Security Joes, a small security company based in Israel. The problem is the ICC PRO system, an intelligent irrigation system designed by Motorola.
Security Joes co-founder Ido Naor told ZDNet last month that companies and city officials had installed ICC PRO systems without changing the factory default settings, which do not include a password for the default account.
Naor says the systems could be easily identified online with the help of IoT like Shodan.
Once attackers locate an ICC PRO system accessible online, Naor says all they have to do is type in the “default admin username” and press Enter to gain access to a smart irrigation control panel.
Here, Naor says that attackers can stop watering actions, change settings, control the amount of water and pressure supplied to pumps, or lock down irrigation systems by deleting access for specific users.
More than 100 ICC PRO irrigation systems were found exposed online without a password last month, when Naor first identified this issue.
The security researcher said that more than half of the exposed systems were located throughout Israel, with the rest spread across the world.
Naor informed CERT last month, which then contacted the affected companies, Motorola, and also shared the findings with other CERT groups in other countries.
The report began to improve last week. Naor acknowledged Motorola's stance on this development after the company sent a letter to customers about the risks of exposing the irrigation system to the internet.
As a result of these alerts, the number of ICC PRO instances with internet access began to decline from 94 last week to 78 today, as companies began placing their irrigation systems behind firewalls or on private networks.
However, while the situation has improved, systems still exposed online today continue to not have a password set on the default account.
