All Posts

When Valid Credentials Don't Mean "Authorized": What the Salt Typhoon Breach Teaches Critical Infrastructure Defenders

By Norris Cornell IAM | SCADA CybersecurityDecember 19, 2024 Executive Summary In October 2024, U.S. authorities confirmed that Chinese state-sponsored actors—tracked as Salt Typhoon—had compromised at least nine major U.S. telecommunications providers. The breach, which persisted for over a year undetected, accessed call records from more than one million users, intercepted private communications of high-profile political figures, and compromised CALEA lawful intercept syst

npcornell

Dec 18, 202512 min read

The Water Sector's Default Password Problem

November 25, 2023. A remote booster station serving 6,000 people in Pennsylvania was accessed by a hostile actor. The international media followed. Defacement banners appeared on the HMI. Operators were forced to switch to manual operation. Here's what didn't happen: No zero-day. No exploit chain. No malware. No sophistication. A publicly available default password. Shodan scanning. Transparent trust in factory credentials. This is Aliquippa. And it's the perfect example of t

npcornell

Dec 16, 20255 min read

ICS Taught Me More About Input Validation Than OWASP Ever Did

Part 1 of the "When Software Meets the Physical World: AppSec Lessons From ICS" series Introduction: The Lesson ICS Taught Me Early Before I entered cybersecurity, I spent nearly 20 years as an electronics technician working with sensors, control circuits, and embedded systems. When I started researching SCADA and ICS security for my graduate work, I recognized something familiar: the same trust failures I'd seen at the hardware level — sensors lying, signals drifting, inputs

npcornell

Dec 9, 20253 min read

Logic Follows Lies: How PLCs and RTUs Fail Under Adversarial Conditions

If inputs lie, logic will follow. Industrial control systems don't reason. They don't question. They don't validate truth. They evaluate. A PLC or RTU accepts whatever value reaches its input buffers and applies deterministic logic to it with absolute confidence. And when those upstream signals are manipulated—whether sensor readings, timing references, or permissive bits—the controller's logic becomes the attack surface. In Part 2 of this series (building on my BSides Delawa

npcornell

Dec 7, 20255 min read

Inputs Lie: Your System Trusts Signals It Shouldn’t

ICS/OT Security Series — Part 1 If you lie to an industrial system about its inputs, it will execute that lie faithfully into the physical world. No hesitation. No intuition. Just deterministic logic doing exactly what it was designed to do. In my last post, I talked about how satellite signals—GPS, GNSS, RF—are largely undefended against spoofing and manipulation. The gap isn’t just theoretical. It lives inside your industrial control systems. Most ICS/OT security conversati

npcornell

Dec 2, 20253 min read

Satellite Cybersecurity: When Cyber Meets the Spectrum

How SIGINT, ICS, and Application Security Converge in the Invisible Domain We Depend On Every day, critical infrastructure runs on signals we can't see. Satellite timing guides the power grid. GNSS signals coordinate automation sequences. RF links relay data to SCADA systems. Software systems make decisions based on timing they assume is trustworthy. Yet most cybersecurity programs treat satellites and RF systems as "someone else's problem." I recently gave a talk at BSides D

npcornell

Nov 29, 20259 min read