“Cyber hygiene would have prevented the access: take the controller off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party kit onto the network in a controlled, owned and documented way rather than leaving it on a contractor’s own connection, change known and default credentials, and patch to a current release.”
Yes, it’s a sane suggestion in principle. Yet we live in a world where every toaster is connected to the public internet, sends data to its vendor (probably not only them) and never gets any patches installed – even if it is lucky enough to be still supported a year after being manufactured. Most people are buying this crap for their homes without a second thought, so why wouldn’t they do the same for their companies? I don’t think the problem is going to go away unless governments start to regulate these markets.
I’m still missing one piece of the puzzle here however. It was a coordinated attack against hundreds of devices at the same time. How did the attackers find them? I doubt that these controllers are on Shodan. Did they scan the internet for months to prepare the attack? That would rule out vandalism, that’s the kind of preparation a nation-state actor would do. Or did they hack the vendors who tend to be a sweet target with knowledge of where all the vulnerable devices are?
