Following our discovery and quantification of these interfaces, we knew we needed to take action. Based on our previous attempts to notify operators of improperly exposed systems, we thought it unlikely that the utilities running these systems would respond positively to any outreach from us. Instead, we tried a different approach: we contacted both the software manufacturer and the U.S. Environmental Protection Agency (EPA).

Upon sharing our findings with the manufacturer, we were met with a polite but tepid response. They expressed appreciation, but there was no clear indication action would be taken to remediate the exposures. Vulnerability and exposure notifications are often ineffective, so this wasn’t especially surprising.

It may be obvious why we contacted the manufacturer, but may be less so why we reached out to the EPA directly. During the summer of 2024, we compiled a report on exposed water infrastructure in the U.S., and the EPA was interested and engaged in remediating the exposures. We had experience working with them and knew we shared the same goal of removing sensitive water infrastructure from the internet.

On October 8, 2024, we shared raw data for nearly 400 exposed water systems with the EPA, including IP, port, and likely location of the service, pulled from metadata in the HTTP response's HTML title. Using methods outlined above, we also included indications of whether each host was authenticated, read-only, or entirely unauthenticated. The majority of these systems were fully exposed (read-only) or unauthenticated. Upon receipt, our contacts at the EPA prioritized the more than 300 unauthenticated and fully exposed systems and began engaging the EPA Regions for mitigation assistance.

Nine days later, we received confirmation from the EPA that mitigations were in place for 24% of the systems we notified them about. They also contacted the manufacturer, who began assisting their customers with remediation of the exposures.

In mid-November, roughly a month later, 58% of the read-only and unauthenticated systems had been protected and removed from the public internet. The manufacturer also used this incident as an opportunity to strengthen the security posture of affected utilities by helping implement multifactor authentication and other security best practices.