Critical infrastructure under attack: defects become the weapon of choice

“While attackers do take advantage of traditional software flaws, the greater concern for critical infrastructure is that it is widely available within the unsecured internet, where these systems can directly access essential services without proper access control,” added Himaja Motheram, security researcher at threat intelligence firm Censys.

One of the most overlooked fundamental issues, says Sparrow’s Lei, is the numerous critical systems, such as water treatment interfaces or medical imaging systems, which are not verified or default credentials/default credentials exposed to the public internet.

“In these cases, attackers don’t even need to exploit; they can simply log in,” Lei explained. “The core issue is not just a specific class of vulnerability; first of all, systemic exposure and accessibility of sensitive systems should never be reached directly.”