PLC Attacks

The NSA, CISA, FBI, Department of Energy, and EPA are all warning people that the critical infrastructure is under attack.

And we've been talking about this for years, and it's been hitting the news like 20 U.S. states have had their water utilities hacked.

They haven't hurt anybody or done any real harm yet, but they've demonstrated that they can just walk in and take over the management control for water supplies, which is pretty dangerous.

I mean, they could, in principle, turn off the water or perhaps even pollute it with too much chlorine or something.

And they're now warning that the Siemens programmable logic controllers have a vulnerability, but they say, really, this applies to all programmable logic controllers because they tend to be deployed very insecurely.

So they're recommending the usual stuff, put on the updates, block internet access, strengthen access controls, and monitor for unusual activity, what we should all have been doing anyway.

But this is worldwide.

Everyone's critical infrastructure is running on these old legacy systems that were not designed securely, and nobody really has any good plan for making them secure anytime soon.

So pretty much the whole world is a sitting duck for these attacks.

Yeah, Sam, I worked on PLC for a couple projects about 10, 12 years ago.

Yeah.

And these systems date back to the 1970s.

Right.

When the protocols were created, there was no such thing as an internet.

Right.

And at the time, no one saw any issue with hard coding in usernames and hard coding in passwords.

Or the systems like Modbus that just have no authentication at all.

Because the whole point is if you can get in the building, you control it with the switches, and the security is the lock on the door.

Nobody should get in the building unless they're authorized.

Yeah, you are correct.

And obviously this was prior to internet and any standardized networking.

That's

right.

And what they've done now is they've modified these systems like Profibus and Modbus and to work with TCP IP.

Yeah.