They tried to sound the alarm in August

all 3 comments

sorted by: hot top controversial new old
[–] 11 points 4 weeks ago (2 children)

“Henriques said. “The takeaway is clear: digital risk extends far beyond workstations and email servers.”

This is not a new takeaway. For many of us who have been in the control and automation industry for decades, we remember things like the Idaho National Labs demo attack and the Siemens equipment Stuxnet attack used to disrupt nuclear enrichment plants. A lot of this accessible equipment runs on old well documented protocols so rogue AI agents would have no issue being able to communicate with a lot of this equipment.

  • source
  • hideshow 2 child comments
  • [–] 3 points 4 weeks ago (1 child)

    It's even worse, though - I read in another article that the username was "admin" and the password autochanged to the day's date every day.

    That's not security… that's, like… leaving the front door open with a big sign saying "COME ON IN, NO CAMERAS!!!" lol

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 4 weeks ago*

    What if I told you some legacy control devices on protocols like modbus don’t even have the concept of users/auth. Just send a request with a valid op, in range register, and a valid crc and the device will just read or write whatever you send it. There are literally tens of thousands of these devices still online and internet accessible globally.

  • source
  • parent