#Critical Infrastructure — insecure by design

high1 source

UK NCSC Flags Surge in Internet-Facing Operational Technology and Edge Device Exploits

The UK's National Cyber Security Centre (NCSC) issued an advisory warning that attacks on operational technology (OT) systems are steadily climbing across critical sectors worldwide. This surge in hostile activity is driven by both state-backed groups and independent threat actors leveraging geopolitical tensions alongside readily available scanning tools. While widespread disruptive incidents remain limited, recent intrusions highlight persistent exposures, including an unconfirmed attack where an internet-exposed programmable logic controller (PLC) allegedly disrupted operations at a UK power facility for four days. The agency is urging operators to audit their industrial environments and immediately ensure that core assets like PLCs and human-machine interfaces (HMIs) are completely isolated from public-facing interfaces. Industrial security experts emphasize that attackers rarely need sophisticated exploits for these initial footholds, often relying instead on misconfigured firewalls, default credentials, forgotten vendor access pathways, and legacy equipment. Research from Claroty's Team82 indicates that 88% of analyzed cyber-physical assets fail to broadcast accurate product codes, severely complicating visibility and risk assessments. Furthermore, their investigation into over 200 physical system breaches revealed that 82% leveraged remote VNC clients to touch exposed components, while 66% involved compromised SCADA platforms or HMIs. To counter these vectors, the NCSC outlines critical baseline hygiene: enforce strong authentication, eliminate direct external routing, strictly segment network boundaries, restrict live remote programming, and maintain validated recovery strategies.

high1 source

Slovak Cyber Authority Uncovers Russian Backdoors and Undocumented Hardware in Speed Cameras

Slovakia's national cybersecurity agency, the NBÚ, published an advisory detailing significant security anomalies in roadside speed enforcement cameras. The investigation focused on the NERO R-ONE family from Cyprus-based SODASUS alongside Cordon-series hardware manufactured by Russia's Simicon and Croatia's NEROline. An audit requested by the Slovak Ministry of the Interior revealed marked discrepancies between the hardware documented on paper and the physical components inside the devices. Security analysts uncovered undisclosed remote access capabilities outside operator control, substandard baseline security, and measurement software that did not match declared specifications. Industry reporting from security consultant Samuel Kohen highlighted that the firmware contained 12 hardcoded Russian telephone numbers and hidden cellular communications hardware. Furthermore, raw video streams were reportedly accessible over unauthenticated RTSP endpoints to anyone with IP connectivity. While marketed under European assembly guarantees and backed by 30 million euros in EU recovery funding, the underlying systems incorporated Russian parts. The Slovak Ministry of the Interior initially rejected Russian supply chain ties before acknowledging the components and terminating agreements with supplier Soitron. The NBÚ has formally warned critical infrastructure operators across the country to verify their deployments and report any operational units for remediation.