The researchers working on Project Basecamp found significant security issues with programmable logic controller (PLC) they tested. Some PLCs were too brittle and insecure to even tolerate security scans and probing.
The D20 ME PLC by General Electric – a widely deployed industrial system – fared the worst. Wightman’s analysis of the device, which retails for around $15,000, revealed that the D20 relied on both hardware and firmware that was more than two decades old and was rife with hidden “back door” administrative accounts, remotely exploitable vulnerabilities and absent any security controls. Here he highlights a bypass on the D20 controller that Wightman said was highly unusual in a shipped product – and that could be a source of failure.
