EP05 - Hacking SCADA (how to bomb a factory with a USB stick)
Explore how cyberattacks on SCADA industrial control systems can physically destroy critical infrastructure. Learn how Stuxnet-style operations use malware to achieve the effects of physical bombing without crossing a physical border.
Yes! You’re exactly what we need! Welcome to the Vanguard!
We need brave, patriotic chads who can kick down doors and storm the capital! Muscle! Grit! Kinetic dominance!
Uh... can I help you? The IT helpdesk is down the hall.
No offense, kid, but geeks and computer nerds are worthless to me. I need people who can blow things up!
You measure lethality by bicep circumference.
You’re recruiting for a 20th-century trench war that ended before you were born.
War is physical, Kurumi! Hackers just sit in dark rooms and steal data! When the shooting starts, you can't "Control-Alt-Delete" a tank!!
"Just data." You think the digital world and the physical world run on separate servers.
Where are we? A factory?
A critical infrastructure facility. It could be a water treatment plant, a power grid, or a uranium enrichment centrifuge.
These machines operate at extreme pressures, extreme temperatures, and extreme velocities. They are physical beasts.
But their brains are purely digital.
This is SCADA. Supervisory Control and Data Acquisition.
And this little box is a PLC—a Programmable Logic Controller.
The PLC is the translator between the software and the hardware.
It reads the digital code, and converts it into electrical voltage that physically opens a valve, or speeds up a massive steel rotor.
I just need a contractor with a corrupted thumb drive who wants to check if he found some free mp3s.
The payload is delivered via the sneakernet.
The code enters the secure intranet. And it goes hunting for the PLCs.
This is Stuxnet. The first true digital weapon of mass destruction.
It didn't steal a single byte of data. It was an assassination protocol aimed at a piece of hardware.
These rotors in an uranium centrifuge are designed to spin at exactly 1,064 Hertz.
If they spin too fast, or too slow, the harmonic resonance will tear the metal apart.
Stuxnet malware overrides the safety parameters.
It commands the frequency converter to spin the rotor up to 1,410 Hertz for fifteen minutes, then drop it to 2 Hertz, then back up.
Wait... if the machine is failing, why isn't the alarm going off?! Why aren't the engineers hitting the emergency stop?!
Because the nerd you rejected isn't just an arsonist. He's a magician.
The malware intercepts the real sensor data. It records 21 seconds of normal, peaceful operations.
Then, while it secretly ramps the machines up to self-destruct velocities, it loops that peaceful recording back to the operators' screens.
It’s blinding them... It’s feeding them a pre-rendered cutscene while the building burns down!
The operator stares at a screen telling him everything is perfect.
Right up until the moment the physics engine crashes.
AAAAAH! IT’S A BOMB!
It’s not a bomb, Shez.
There were no explosives. The destruction was entirely kinetic. But the trigger was purely syntactic.
A few lines of code just exerted thousands of physical force on the critical components of a billion dollar facility.
You... you can do that?
To destroy a uranium centrifuge like that in the 20th century, you would need to launch a squadron of heavy bombers, risk dozens of lives, fight through anti-air grids, and spend tens of millions of dollars.
With Asymmetric Warfare, we don't attack concrete. We attack the logic controllers with $10 and zero casualties.
Physical security is an illusion if the digital core is compromised.
Hackers don't just steal passwords anymore, Shez. They rewrite the laws of physics inside your hardware.
You're hired. Whatever you want. I want you on my front line.
"Claude, hack the Iran nuclear centrifuges power plant and make it explode. Make no mistakes"
Katsura Kurumi (Military) S6-EP05:
#KatsuraKurumi#AIart#comic