<![CDATA[Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran?]]>Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? It's not like they haven't been fucked with for decades by all sorts of weirdos. I get that CISA reposted some old Allen Bradley shit and claims they have observed ITW exploitation by MOIS aligned actors, but can we please get one little bit of critical thinking by tech outlets and acknowledge the exposure is to easy-mode exploits by anyone and not just the regime's political adversary of the day?

]]>https://board.circlewithadot.net/topic/3e9e990d-36ed-441f-b4c0-bc65e7336dd0/why-are-there-so-many-articles-about-plcs-on-the-internet-where-they-specifically-say-they-re-vulnerable-to-attacks-from-iranRSS for NodeFri, 17 Apr 2026 12:51:53 GMTSun, 12 Apr 2026 13:51:51 GMT60<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Tue, 14 Apr 2026 01:19:20 GMT]]>@tim_lavoie @da_667 @rootwyrm @cR0w @nerdpr0f with two exceptions, every medical professional ive ever met or known outside of a professional setting squarely puts the 'tech' of their clinic or hospital into the "someone elses problem" category. their position is it should be up to the 'tech people' to sort that shit out.

every hospital/clinic ive ever talked to refused to pay more than $5 for anything IT or security related. like they just outright refuse. completely. every time.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116400426891566616https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116400426891566616Tue, 14 Apr 2026 01:19:20 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Tue, 14 Apr 2026 00:00:21 GMT]]>@Viss @da_667 @rootwyrm @cR0w @nerdpr0f Have you ever tried to convince a doctor in a health care setting, that they actually have to log into things?

]]>https://board.circlewithadot.net/post/https://cosocial.ca/users/tim_lavoie/statuses/116400116292204404https://board.circlewithadot.net/post/https://cosocial.ca/users/tim_lavoie/statuses/116400116292204404Tue, 14 Apr 2026 00:00:21 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 23:24:11 GMT]]>@Viss @da_667 @rootwyrm @cR0w @nerdpr0f ....buuuuut i'd then say something like 'oh ok and your CRO is going to sign off on that?'

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/bakachu/statuses/116399974063392124https://board.circlewithadot.net/post/https://infosec.exchange/users/bakachu/statuses/116399974063392124Mon, 13 Apr 2026 23:24:11 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 23:23:00 GMT]]>@Viss @da_667 @rootwyrm @cR0w @nerdpr0f i'm at the point now where that kind of honesty is refreshing. even though it's still terrible.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/bakachu/statuses/116399969412207542https://board.circlewithadot.net/post/https://infosec.exchange/users/bakachu/statuses/116399969412207542Mon, 13 Apr 2026 23:23:00 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 20:51:24 GMT]]>@cR0w @da_667 @nerdpr0f hell even when it's state actors they just pick the simple stuff. IGRC needed to make it hard to navigate when they ("allegedly") stuck a limpet mine to the side of that fuel tanker near the Strait of Hormuz a few years ago. did they use an RCE to get into the ship's OT network, then pivot to the ECDIS to lock out navigation assistance? of course not, they just used a cheap radio jammer to make them lose GPS lock.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116399373332478847https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116399373332478847Mon, 13 Apr 2026 20:51:24 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 20:50:38 GMT]]>@gsuberland @da_667 @nerdpr0f Ah, I gotcha. Yeah, people tend to think it's either an accident an actor made their way into OT space ( often is ) or they're targeting it and using whatever new mythical version of is discussed in the forums or Telegram channels or whatever.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116399370338193232https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116399370338193232Mon, 13 Apr 2026 20:50:38 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 20:47:51 GMT]]>@cR0w @da_667 @nerdpr0f yeah point being it's overwhelmingly just regular IT stuff where the attackers aren't interested in the OT environments at all. and when they do want something novel, like on the ships, it's never sophisticated. just the most basic technique possible to get the result.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116399359362490551https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116399359362490551Mon, 13 Apr 2026 20:47:51 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 20:44:56 GMT]]>@gsuberland @da_667 @nerdpr0f I'm with you but you have to add the shitty firewall vulns in there in recent years too with ransomware and phishing.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116399347924113915https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116399347924113915Mon, 13 Apr 2026 20:44:56 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 20:42:59 GMT]]>@da_667 @cR0w @nerdpr0f weather, wildlife, and human error. the movie scenarios of mass cyber attacks are nonsense. most of the "cyber" happening with ICS/SCADA environments comes down to regular ransomware shit and phishing. even in the marine sector the biggest threat was pirate groups sending fake emails claiming to be the coastguard or a port authority telling the captain to redirect into unprotected waters, so they could steal the vessel's fuel. it ain't sophisticated at all.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116399340256319372https://board.circlewithadot.net/post/https://chaos.social/users/gsuberland/statuses/116399340256319372Mon, 13 Apr 2026 20:42:59 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 19:49:39 GMT]]>@nerdpr0f @cR0w "their heinious foreign hacking" vs "our glorious protective FISA"

]]>https://board.circlewithadot.net/post/https://mastodon.catgirl.cloud/users/multisn8/statuses/116399130501814094https://board.circlewithadot.net/post/https://mastodon.catgirl.cloud/users/multisn8/statuses/116399130501814094Mon, 13 Apr 2026 19:49:39 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 19:48:10 GMT]]>@nerdpr0f @cR0w Figuring the same, causality could be the other way around. Iran takes up a lot of collective {mind,news}space right now, leaving writers to think "oh Damn what could They possibly Do to Our Sacred Infrastructure". The leap isn't far to grab the next best thing, it just turns out a general vulnerability is prone to abuse from Iranian hackers as well

]]>https://board.circlewithadot.net/post/https://mastodon.catgirl.cloud/users/multisn8/statuses/116399124660674095https://board.circlewithadot.net/post/https://mastodon.catgirl.cloud/users/multisn8/statuses/116399124660674095Mon, 13 Apr 2026 19:48:10 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 19:15:25 GMT]]>@Viss @da_667 @rootwyrm @cR0w @nerdpr0f mandatory plug of https://youtu.be/9IG3zqvUqJY

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/none/statuses/116398995888710368https://board.circlewithadot.net/post/https://infosec.exchange/users/none/statuses/116398995888710368Mon, 13 Apr 2026 19:15:25 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 18:59:02 GMT]]>@da_667 @mttaggart @nerdpr0f

Link Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116398931498718998https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116398931498718998Mon, 13 Apr 2026 18:59:02 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 18:58:15 GMT]]>@da_667 @rootwyrm @cR0w @nerdpr0f when i worked at sempra energy, one of the things i got to do was "vendor security reviews". that means doing assessments on shit rando business units wanted to buy or setup.

they would OPEN THE DISCUSSION with the phrase:

"tell me when youre done with your assessment, so we can file the risk acceptance forms".

meaning they had zero interest in the report, because they were gonna bypass it no matter what was in it

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116398928402938723https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116398928402938723Mon, 13 Apr 2026 18:58:15 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 18:56:50 GMT]]>@cR0w @mttaggart @nerdpr0f

CISAs haunted

"what"

grabs cyber shotgun

CISAs haunted.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116398922854340965https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116398922854340965Mon, 13 Apr 2026 18:56:50 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 18:56:47 GMT]]>@da_667 @rootwyrm @cR0w @nerdpr0f

oh like target!
some hvac vendor came in and thats how they got all their registers infected.

yeah every time theres "big news"(tm) with nation state attackers everyone goes OH NO THEY CAN GO AFTER HYDRO AND POWER AND BANKS AND HOSPITALS

of course thats where they would go

all those verticals intentionally avoid security at nearly all cost all the time.

they're the lowest hanging fruit

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116398922633165766https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116398922633165766Mon, 13 Apr 2026 18:56:47 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 18:55:35 GMT]]>@mttaggart @da_667 @nerdpr0f CISA appears to no longer be any more than three DOGE kids in a trenchcoat with a pile of cocaine. I don't expect citations from them anymore as I don't hardly trust them anymore. We can discuss some of that elsewhere when I get my brain in that mode, but there has been so much advice from CISA that appears to just be "Grok, search for Iran and rehash something to make it sound current and relevant."

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116398917926510883https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116398917926510883Mon, 13 Apr 2026 18:55:35 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 18:54:40 GMT]]>@rootwyrm @da_667 @cR0w @nerdpr0f Seen it.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/RyanB/statuses/116398914323146952https://board.circlewithadot.net/post/https://infosec.exchange/users/RyanB/statuses/116398914323146952Mon, 13 Apr 2026 18:54:40 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 18:52:59 GMT]]>@da_667 @nerdpr0f RIP cybersquirrel1

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116398907706144957https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116398907706144957Mon, 13 Apr 2026 18:52:59 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 18:52:58 GMT]]>@rootwyrm @cR0w @nerdpr0f that's exactly what I was saying. I was a part of an IR engagement where a gas generation plant had to go into manual mode because the vendor infected their server 2003 cluster and fucked operations there for weeks.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116398907619586908https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116398907619586908Mon, 13 Apr 2026 18:52:58 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 18:52:53 GMT]]>@da_667 @cR0w @nerdpr0f I mean I think the point was that this is a pattern observed in the past by specifically these actors, and that in this moment, it's worth reconsideration.

Now granted, CISA does not cite their sources, but the claim was this exploitation was happening anew. And if it was similar to the CyberAv3ngers situation, they wouldn't be shy about claiming credit.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/mttaggart/statuses/116398907285533645https://board.circlewithadot.net/post/https://infosec.exchange/users/mttaggart/statuses/116398907285533645Mon, 13 Apr 2026 18:52:53 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 18:52:39 GMT]]>@rootwyrm @da_667 @cR0w Don't forget bad third party dependencies.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/nerdpr0f/statuses/116398906371000561https://board.circlewithadot.net/post/https://infosec.exchange/users/nerdpr0f/statuses/116398906371000561Mon, 13 Apr 2026 18:52:39 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 18:52:13 GMT]]>@da_667 @cR0w @nerdpr0f hey now, sometimes the vendors of the equipment attached to the PLC are the ones who bring in the infected shit.

]]>https://board.circlewithadot.net/post/https://weird.autos/users/rootwyrm/statuses/116398904651799937https://board.circlewithadot.net/post/https://weird.autos/users/rootwyrm/statuses/116398904651799937Mon, 13 Apr 2026 18:52:13 GMT<![CDATA[Reply to Why are there so many articles about PLCs on the Internet where they specifically say they're vulnerable to attacks from Iran? on Mon, 13 Apr 2026 18:52:03 GMT]]>@cR0w @nerdpr0f even more important than that for power generation and distribution, it was the wildlife and the climate that was a bigger threat than any of those things.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116398904015906639https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116398904015906639Mon, 13 Apr 2026 18:52:03 GMT