They tried to sound the alarm in August

you are viewing a single comment's thread
view the rest of the comments
[–] 11 points 1 month ago (2 children)

“Henriques said. “The takeaway is clear: digital risk extends far beyond workstations and email servers.”

This is not a new takeaway. For many of us who have been in the control and automation industry for decades, we remember things like the Idaho National Labs demo attack and the Siemens equipment Stuxnet attack used to disrupt nuclear enrichment plants. A lot of this accessible equipment runs on old well documented protocols so rogue AI agents would have no issue being able to communicate with a lot of this equipment.

  • source
  • hideshow 2 child comments
  • [–] 3 points 1 month ago (1 child)

    It's even worse, though - I read in another article that the username was "admin" and the password autochanged to the day's date every day.

    That's not security… that's, like… leaving the front door open with a big sign saying "COME ON IN, NO CAMERAS!!!" lol

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 month ago*

    What if I told you some legacy control devices on protocols like modbus don’t even have the concept of users/auth. Just send a request with a valid op, in range register, and a valid crc and the device will just read or write whatever you send it. There are literally tens of thousands of these devices still online and internet accessible globally.

  • source
  • parent