Vulnerable industrial controls directly connected to Internet
My graduate project at university was about air-gap malware, soft TEMPEST and hacking on industrial PLCs (S7-300, Stuxnet and all that :P).<p>What terrified me most is not only the state of ICS nowadays (it&#x27;s pretty much fucked), but also the fact that cyber-security vendors try to make a profit from that by shoving their products down the throats of scared managers.<p>And what @donquchotte says is pretty much true - on facility there I practiced, all PLC were connected via TeamViewer to company network, passwords were written on stickers and slapped on monitors. They used Modbus over TCP, plain-text packets easily viewable with Wireshark.<p>On the first day I accidentally broke my S7 because of wrongly uploaded configuration, it took them 3 days to find some special Siemens laptop to connect to this PLC and reset it. Also tried to play around with Metasploit and follow the work of Beresford [1,2], but the most trivial attack of mine was just flood on PLC&#x27;s IP with random junk - it stopped responding to any commands.<p>[1]: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=33kouEKm0zo" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=33kouEKm0zo</a><p>[2]: <a href="https:&#x2F;&#x2F;github.com&#x2F;moki-ics&#x2F;s7-metasploit-modules" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;moki-ics&#x2F;s7-metasploit-modules</a>