Cyber security of critical infrastructures has become a topic of discussion again in Turkey.
A cyber security researcher using the username "itsmelsec" claimed that he detected 430 new industrial control panels that were open to the internet and that he accessed some systems by trying number sequences commonly used in Turkey as passwords.
According to the researcher's posts, the systems allegedly accessed include water pumps, wastewater facilities, drinking water lines and valve control systems.
In his post on his social media account, the researcher claimed that he was able to access many control panels by trying number sequences such as "1071" and "1453", which are frequently used in door locks and similar systems.
According to Donanım Haber; The shared screenshots show information such as the operating status of the pumps, tank levels, pressure in the pipelines and the location of the valves.
It is also noteworthy that some interfaces include options to start and stop pumps and open and close valves.
However, the presence of these controls on the screen does not alone prove that the researcher can perform physical operations on the systems in question.
The images shared by the researcher include control screens that are claimed to belong to different public institutions and facilities.
One of them has the ASKİ logo and the phrase "Kuşadası Yeniköy Wastewater Pumping Facility". It can be seen that the elevation pump pool level and the operating frequencies of three pumps are monitored on the panel.
Another image shows the ILBANK and ASKİ logos, as well as the control interface for a pressure maintaining valve chamber.
The posts included a screen titled “Andon Maslak Pump” and another facility control panel showing different hot water lines and pumps.
In one of the images published by the researcher, there is a control screen called "Karasu Regulator" bearing the State Hydraulic Works (DSI) logo.
It can be seen that the panel in question includes the status of the five covers and the on-off options.
Another image titled "Şanlıurfa Organized Industrial Zone Valve Control System" shows the status of the incoming and outgoing water valves and their control buttons.
Industrial control systems are used to remotely monitor and manage physical processes such as pumping, storing and purifying water.
If these systems are directly open to the internet and are not protected by strong authentication methods, there may be a risk of unauthorized access.
Depending on the access level, an attacker could not only view the system but also interfere with physical processes if the system configuration allows.
For this reason, the use of easily guessable or default passwords on control panels open to the internet is considered a serious security risk.
The researcher also stated that no institution has yet contacted him regarding the vulnerabilities he claimed to have discovered.
Following the sharing, it has not yet been independently verified whether the systems in question actually belong to the relevant public institutions and to what extent the access level is.
ASKİ General Manager Memduh Aslan Akçay, in his statement to Yeni Ankara following similar allegations that were brought to the agenda before, said that the shared screenshots did not overlap with the systems within ASKİ.
Akçay said, "There is no security vulnerability, but we still continue to do our checks to ensure our security. We are aware of how important cyber security is and we try to keep security at the maximum level."
It was a matter of curiosity whether the relevant institutions would make a separate statement regarding the systems included in the new posts.
