How hackers attack municipal water systems – and why the utilities are so vulnerable