MISCONFIGURED HMIS EXPOSE US WATER SYSTEM TO ANYONE WITH A BROWSER

Summary from the TLDR InfoSec newsletter

While conducting a routine scan of industrial-control hosts, Censys researchers discovered an uncommon TLS certificate configuration that led to the discovery of a browser-based HMI platform. These internet-exposed platforms could be used to view and control water systems without authentication. Censys sent a bulk notification to the EPA, and the number of systems that were either read-only or fully controllable was reduced from 300 to 20.