ICS Defense

Securing your Industrial Control Systems

[hackaday @hackaday]

Breaking Enigma with an FPGA, Just like at Bletchly Park https://t.co/DBVjErEqL0

[Jill Ammon @HTBJill]

OT breaches escalate fast, and the Asahi attack shows how IT weaknesses trigger production outages. Hack The Box outlines the attacker playbook and the detection gaps MSSPs need to close. https://t.co/1L772L8AD5
#MSSP #OTSecurity #IndustrialCybersecurity

[BBWriteup @bbwriteup]

"Secret knock: How MFG lets us open an undocumented bootloader on the Siemens Simatic S7–1200" by Marcel Rick-Cen

#BugBounty #Cybersecurity #Hacking #InfoSec

https://t.co/mvFlAhQ1xk

[Tom Dörr @tom_doerr]

open source anti-rootkit tool for Windows, helps find hidden malware and system info

[Nikki Siapno @NikkiSiapno]

HTTP 2 vs HTTP 3 — What's the Difference?

• 1996 → HTTP 1
• 1997 → HTTP 1.1
• 2015 → HTTP 2
• 2022 → HTTP 3

But what’s the difference? Starting at the foundation:

🔹 𝗛𝗧𝗧𝗣 𝟭.𝟭:

✓ 𝗣𝗲𝗿𝘀𝗶𝘀𝘁𝗲𝗻𝘁 𝗰𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝗼𝗻𝘀 — Reuses connections instead of opening new ones
✓ 𝗖𝗵𝘂𝗻𝗸𝗲𝗱 𝘁𝗿𝗮𝗻𝘀𝗳𝗲𝗿𝘀 — Sends data in parts instead of waiting for the full response
✓ 𝗜𝗺𝗽𝗿𝗼𝘃𝗲𝗱 𝗰𝗮𝗰𝗵𝗶𝗻𝗴 — Introduced headers for better caching and connection management
🅇 𝗦𝗲𝗾𝘂𝗲𝗻𝘁𝗶𝗮𝗹 𝗿𝗲𝗾𝘂𝗲𝘀𝘁𝘀 — Requests block each other (HoL blocking at the request level)
🅇 𝗠𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝗰𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝗼𝗻𝘀 𝗻𝗲𝗲𝗱𝗲𝗱 — Browsers used multiple TCP connections for speed

It introduced core features still used today.

🔹 𝗛𝗧𝗧𝗣 𝟮:

✓ 𝗠𝘂𝗹𝘁𝗶𝗽𝗹𝗲𝘅𝗶𝗻𝗴 — Multiple requests in a single TCP connection
✓ 𝗛𝗲𝗮𝗱𝗲𝗿 𝗰𝗼𝗺𝗽𝗿𝗲𝘀𝘀𝗶𝗼𝗻 (𝗛𝗣𝗔𝗖𝗞) — Reduces metadata size
✓ 𝗦𝘁𝗿𝗲𝗮𝗺 𝗽𝗿𝗶𝗼𝗿𝗶𝘁𝗶𝘇𝗮𝘁𝗶𝗼𝗻 — Ensures critical resources load first
🅇 𝗛𝗲𝗮𝗱-𝗼𝗳-𝗹𝗶𝗻𝗲 (𝗛𝗼𝗟) 𝗯𝗹𝗼𝗰𝗸𝗶𝗻𝗴 — A lost packet blocks all streams

While HTTP 2 optimized TCP, it remained constrained by TCP’s head-of-line blocking.

🔹 𝗛𝗧𝗧𝗣 𝟯:

✓ 𝗕𝘂𝗶𝗹𝘁 𝗼𝗻 𝗤𝗨𝗜𝗖 (𝗨𝗗𝗣) — No more TCP bottlenecks
✓ 𝗜𝗻𝗱𝗲𝗽𝗲𝗻𝗱𝗲𝗻𝘁 𝘀𝘁𝗿𝗲𝗮𝗺𝘀 — Packet loss in one stream doesn’t affect others
✓ 𝗙𝗮𝘀𝘁𝗲𝗿 𝗵𝗮𝗻𝗱𝘀𝗵𝗮𝗸𝗲𝘀 — Combines transport + encryption setup in one step
✓ 𝗠𝗮𝗻𝗱𝗮𝘁𝗼𝗿𝘆 𝗲𝗻𝗰𝗿𝘆𝗽𝘁𝗶𝗼𝗻 (𝗧𝗟𝗦 𝟭.𝟯) — Security by default
✓ 𝗖𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝗼𝗻 𝗺𝗶𝗴𝗿𝗮𝘁𝗶𝗼𝗻 — Seamless across network changes

𝗜𝗻 𝗮 𝗻𝘂𝘁𝘀𝗵𝗲𝗹𝗹: HTTP 2 optimized TCP, but HTTP 3 rewrites the game with QUIC, making it faster, more reliable, and encrypted by default.

💬 Which fact surprised you? 💭

--
Thanks to our partner Augment Code who keeps our content free to the community.

𝗗𝗶𝗱 𝘆𝗼𝘂 𝗵𝗲𝗮𝗿 about Augment Code releasing Auggie CLI to GA?

Check it out: https://t.co/6phY8IdPY3

[Nick Bax.eth @bax1337]

🚨 Hackers are using Microsoft Teams to pwn people and steal their crypto.

The attack is deceptively simple and relies on social engineering as well as malware.

They've already stolen millions of dollars from both project founders and normal users.

How it works🧵

[Check Point Research @_CPResearch_]

We analyzed #Yurei, a new ransomware group, and their open-source-based ransomware🔒. This research shows how open-source malware lowers the barrier, so that even low-skilled threat actors can run successful operations.
https://t.co/fXJ4QrFpka

[ESET Research @ESETresearch]

#ESETresearch has discovered #HybridPetya ransomware on VirusTotal: a UEFI-compatible copycat of the infamous Petya/NotPetya malware. HybridPetya is capable of bypassing UEFI Secure Boot on outdated systems. @smolar_m https://t.co/UQAcC4O3Pu 1/8

[The Security Transformation Research Foundation @Transform_Sec]

Maritime #cybersecurity is the iceberg no one sees coming

https://t.co/PAbsoydkh2

@HelpNetSecurity #OT #OTsecurity #cyberthreats #security #business #leadership #CISO #CIO #CTO #CEO #COO #shipping #logistics #operations #tech #maritimesecurity #cyberattacks #globaltrade

[IIoT World @IIoT_World]

Mark your calendars: Industrial IoT & ICS Cybersecurity events are happening worldwide this October. From free online sessions to major global conferences—there’s something for everyone. https://t.co/2MS8ypUgZh

#IIoT #Cybersecurity #OTsecurity @Fisher85M @rtehrani @avrohomg

[SecurityWeek @SecurityWeek]

Train Brakes Can Be Hacked Over Radio—And the Industry Knew for 20 Years - https://t.co/j33qyP9H1U

[Claroty @Claroty]

On this episode of the Nexus Podcast, #Team82 researcher Noam Moshe provides some technical details on #IOCONTROL, how and where it’s been used and what defenders should be doing about it. 🎧 Listen to the full episode ➡️ https://t.co/5EFH1r5T8C

[Marco (Marc) Ayala @ICS_SCADA]

IEEE Spectrum - GPS Spoofing Attacks Are Dangerously Misleading Airliners https://t.co/RC1mTxRQ1Y

[Sulaiman Alhasawi @alhasawi]

"Open Source Tools for OT Defenders" https://t.co/dRl8I1EH5y .This article is a curated list from my recent ICS Arabia Podcast 🎙️ episode with @sshashlan #ICSArabia #OTCybersecurity #OTSecurity #BlueTeam #OpenSource #CyberSecurity

[Fortinet @Fortinet]

What are the latest challenges and solutions in maritime #cybersecurity? ⚓ 🔐

Read our SANS white paper and get highlights on recent attacks, regulatory updates, and resilience strategies for securing vessels, ports, and #OTSecurity systems. 👉 https://t.co/qZAI5agKWz

[The Security Transformation Research Foundation @Transform_Sec]

Rising OT/ICS #cybersecurity incidents reveal alarming trend

https://t.co/yETv7IqDCe

#OTsecurity #security #tech #business #leaders #leadership #management #ICS #infrastructure #manufacturing #energy #operations #CISO #CIO #CTO #CEO #COO #CNI #criticalinfrastructure

[Dragos, Inc. @DragosInc]

ICYMI: This week, #DragosIntel experts did a deep dive on the new #FrostyGoop ICS malware. Get the full details of how the threat was leveraged in an attack and learn how you can mitigate your risk. Watch now → https://t.co/aTEJClmpn4 #ICSsecurity #OTsecurity #cybersecurity

[Sulaiman Alhasawi @alhasawi]

PLC Scanning: Safe Practice or Security Risk? https://t.co/1uZJ87kUnY #plc #scan #siemens #rockwell #Phoenixcontact #OTsecurity #icssecurity

[IoT Guide @iotguide]

ICS malware FrostyGoop disrupted heating in Ukraine, remains threat to OT worldwide
https://t.co/xPjD9C99MN #OTSecurity #IoTSecurity #IoTMalware

[Shivam Chamoli @shivamchamoli18]

Free Masterclass OT/ICS Security

Watch now: https://t.co/FRlsKAJrqV

#otsecurity #security #cybersecurity #icssecurity #learntorise #infosectrain