Cyber Hacking- Why the US is Vulnerable

[Billy_Bob]

PLC (Programable Logic Controller)'s are at the heart of many of our automated systems in our water plants, waste water plants, electrical power generating plants, switching devices, telecommunications control systems, defense systems, and on and on.

When those who employ these devices leave the default passwords, they become points of danger for any system they control. Hackers from Iran have already proven they can get in and create destruction.

In late 2023, hackers tied to Iran’s Islamic Revolutionary Guard Corps broke into programmable logic controllers at American water utilities using a technique that required no special tools and no insider access. They simply tried the factory-default passwords that shipped with the devices. It worked. Now, more than two years later, federal officials say the underlying vulnerabilities remain widespread, and the same class of attack could reach far beyond water systems into the electrical grid, manufacturing, and other sectors where PLCs govern physical machinery.

A series of joint advisories from CISA, the EPA, the FBI, and the NSA has laid out the threat in unusually direct terms. The agencies identified the attackers as “CyberAv3ngers,” a persona linked to the IRGC, and confirmed that the group had compromised Unitronics-brand PLCs at multiple U.S. water and wastewater facilities. As of mid-2026, the federal government continues to treat this campaign as an active and evolving threat to critical infrastructure, with CISA advisory AA26-097A extending the technical guidance and indicators of compromise first published in December 2023.

Now you know why people who deal in networking safeguard their systems and their passwords. However, there are many who are simply too damn lazy to manage the passwords to their systems control devices.

CISA warns Iran-linked hackers can shut down US power plants by targeting the PLCs that run 80% of grid endpoints

[AOF-AID-NGOs]

Actually, the DPRK has had some of the "best" teaching programs for special students that show ability at tech stuff and the DPRK has been at this for longer than some may realize. There was a time they were considered better at that stuff than either the PRC or the former USSR or the present Russian Federation.

Interesting tidbit of information is that it started because the present Kim was very interested in that stuff when he was younger --- much younger. I, and an admin/mod team on a site actually had personal experience on that bit of --- well, it caught us by surprise, to put it mildly. I reckon I still have that archive on one of my storage devices. But the whole admin/mod team on that site quickly caught wind of it, so I reckon some are running their own sites now and remember that incident. First time we had seen a DPRK user agent beyond their borders. Come to think of it, maybe the only time in a commercial venue.

And about that password stuff, I understand that Microsoft is trying to get all folks to change from password use to some other system that I can't remember the name of as I type. But I remember having some significant trouble with access to an MSN account I've had for way many years. I don't even remember how I got around that, but I kept the log. My domain names are registered with that account, so I can't be blocked by some weird new supposedly secure system they came up with.

Frankly, the most important piece of security equipment is connected to our necks. Used to be called 'horse sense' but I don't hear that term used much these days. I guess horses used to be pretty smart, until that Mr. Ed showed up in Hollywood. WKRP news boss thinks hogs are smarter. Me, I know my wife is smarter than I. I learned that lesson really fast.

[Billy_Bob]

I was around for the first phase of digital biometrics. It manifested itself in prisoner management. Fingerprints, pictures, voice prints, and the like.

Some of the digital technology today is very hard to deceive.

That said, we have a lot of low level IT folk who are just happy not to go in and change passwords to nodes and logic controllers. This is asking for your site to be hacked and severe damage done.

Your point about women is dead on right! Wives and girlfriends will always find out if you have deceived them in any way. I used to tell my wife that "homie don't play that game." 26 years of law enforcement tends to stop one from doiof that kind of BS.