CU
Cybersecurity Under Pressure. Real Attacks, Real Lessons
Antonio González
Cybersecurity Under Pressure examines real incidents, technical research and security decisions across industrial systems, railways and connected vehicles. Antonio González connects attack mechanisms with engineering constraints, operational resilience and product-security evidence. Explore OT and ICS security, automotive and railway cybersecurity, software supply chains and the decisions behind secure operations.
- 146 episodes
- daily
- Avg 35 min
- English
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
- CUMonday · 41 min
Stopping Fake Emergency Braking in Connected Cars
Can a connected vehicle reject a forged emergency-braking warning without suppressing a legitimate safety message? This episode examines false emergency electronic brake light warnings in connected-car and V2X environments. We break down the trust boundary between a valid sender credential, a plausible road event and the vehicle response that follows. Cryptographic validity can authenticate a source, but it does not automatically prove that the reported event is true. The discussion covers message authentication, plausibility checks, certificate and credential revocation, duplicate and anomalous-event detection, safe degradation, incident response and the operational limits of automated blocking. It also separates prevention, detection and containment, because each control proves something different. Key lessons: • Bind message acceptance to authenticated and authorized senders • Correlate warnings with vehicle, sensor and situational context • Design revocation and trust updates for real driving conditions • Avoid fail-open and fail-silent responses • Validate the complete path from received warning to vehicle action The episode does not assume that every V2X deployment is vulnerable or that a forged warning necessarily causes braking. Impact depends on the protocol, implementation, vehicle state and the control path exposed by the receiving system. You can also listen to Cybersecurity Under Pressure on PlayPodcast.net.
- CUSaturday · 4 min
OT Maintenance Windows: Monitoring Temporary Access | CUP Focus
Planned downtime concentrates contractors, temporary access, firmware changes and disabled alerts in the same period. This CUP Focus explains why maintenance windows require tighter monitoring and evidence, not relaxed controls. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Kinetic AI and Critical Infrastructure: Connecting Cyber and Physical Risk OT Remote Access: Closing the Path When the Work Ends OT Session Hijacking: Revoking Trusted Engineering Access Legacy VPNs in OT: Remote Access and the Cost of Disruption
- CUFriday · 38 min
Oldsmar Revisited: Remote Access and the Limits of the Evidence
Editorial context: The February 2021 Oldsmar incident was initially reported as an unauthorized remote-access attempt to alter water-treatment dosing. In 2023, the FBI said it could not confirm that a targeted cyber intrusion had initiated the incident. Treat the reported attack sequence discussed in this episode as an account with unresolved evidentiary limits, rather than a proven intrusion. Authorities reported no significant effect on treated water and no danger to the public. Revisit the Oldsmar case through the operational questions it raises for water utilities: who can reach an operator workstation, what authority a remote session carries, how process changes are detected, and what evidence supports a response decision. The practical focus is remote-access governance, independent process safeguards, operator visibility and incident evidence. Lessons derived from the reported scenario do not establish what actually caused the Oldsmar event. Sources and further reading: Original Pinellas County Sheriff report: https://www.pinellassheriff.gov/21-015-detectives-investigate-computer-software-intrusion-at-oldsmar-s-water-treatment-plant FBI investigation records: https://vault.fbi.gov/attempted-hacking-of-oldsmar-water-treatment-plant-on-february-5-2021 WUSF, April 2023 follow-up: https://www.wusf.org/local-state/2023-04-13/official-hack-oldsmar-city-water-treatment-plant-2021 CISA advisory AA21-042A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-042a Cybersecurity Under Pressure. Real Attacks, Real Lessons.
- CUThursday · 2 min
Railway Diagnostic Security: Protecting Privileged Access | CUP Micro Brief
A railway diagnostic platform may not execute the safety function, but it can expose topology, privileged sessions and a pivot path toward operational assets. This CUP Micro Brief explains why monitoring systems still belong inside the security boundary. Related CUP episodes: Frauscher FDS102: Securing Railway Diagnostic Access Legacy Railway Security: Patching and Validation Constraints Railway OT Segmentation: Protecting the Certified Core Railway Cybersecurity: Service Risk Beyond the SIL Boundary
- CUThursday · 5 min
Industrial 5G Security: Protecting the Wireless Conduit | CUP Focus
A wireless conduit cannot be protected like a copper port. This CUP Focus connects 5G device identity, subscriber credentials, edge routing and passive application monitoring without adding latency to deterministic industrial traffic. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Industrial 5G Jamming: Protecting Control When the Radio Fails Industrial 5G Security: Designing for Lost Connectivity When 40 Milliseconds Become an OT Incident | CUP Micro Brief FRMCS Security: Why a Mobile Network SLA Is Not a Safety Case
- CUOctober 28 · 40 min
How Volt Typhoon Weaponizes Active Directory
Volt Typhoon turns trusted administration into a path toward critical infrastructure. This episode examines how stolen credentials, Active Directory compromise and living-off-the-land activity can undermine confidence in the systems operators depend on. We explore the identity boundary between enterprise IT and operational technology, the evidence defenders need to distinguish legitimate administration from an intrusion, and the recovery decisions that follow a suspected domain compromise. Sources and further reading: Joint CISA advisory AA24-038A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a Joint CISA advisory AA23-144A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a Cybersecurity Under Pressure. Real Attacks, Real Lessons.
- CUOctober 27 · 2 min
Industrial Router Security: When SMS Authentication Fails Open | CUP Micro Brief
An industrial router disables SMS password checks after five failed attempts. This CUP Micro Brief examines the availability logic behind the fail-open design and why it becomes dangerous on a cellular attack surface. Related CUP episodes: Weidmüller Router Security: When Segmentation Becomes an Attack Path Industrial Network Security: Designing for Operational Resilience Legacy VPNs in OT: Remote Access and the Cost of Disruption OT Remote Access: Closing the Path When the Work Ends
- CUOctober 27 · 4 min
SBOM and VEX: Proving Vulnerability Reachability | CUP Focus
Component presence and practical exposure are different facts. This CUP Focus explains how static and dynamic reachability analysis support VEX decisions, reduce false positives and create defensible evidence when an actively exploited vulnerability appears. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Cyber Resilience Act: Evidence and the 24-Hour Reporting Clock SBOM and VEX: Turning Vulnerability Data into OT Risk Decisions SBOM and VEX: Challenging Supplier Vulnerability Claims NIST IR 8536: Verifying the Software Supply Chain
- CUOctober 26 · 36 min
A Trusted Engineering Workstation Can Still Deploy a Malicious Flow
An unauthenticated flow editor can turn an industrial gateway into a code-execution platform. This episode examines the Siemens SIMATIC IoT2050 Advanced case and the operational choices around patching, access restrictions and containment. Siemens advisory SSA-834709 documents CVE-2026-58115 in affected devices running Industrial OS with Node-RED installed before V4.3.4.1. An unauthenticated attacker who can reach the vulnerable HTTP interface may create malicious flows and execute code with maximum privileges. Siemens recommends updating to V4.3.4.1 or later. Editorial clarification The factory and incident-response situations in the discussion are hypothetical. Compromise of this gateway does not by itself prove authority to write to a PLC or manipulate a physical process. That depends on reachable services, protocols, credentials and controller-side controls. Any dependence of HMI visibility or alarms on this gateway must also be established for the actual installation; it is not a product-wide finding in the Siemens advisory. The discussion overstates the difficulty of detection at approximately 16:48. Legitimate-looking HTTP traffic can make malicious intent difficult to distinguish, but detection is not inherently impossible. Flow-change records, access logs, approved-configuration comparisons and host or network monitoring may provide evidence, depending on deployment and coverage. Containment must follow the plant-specific response plan and process-safety assessment. Neither disconnecting every gateway nor keeping every connection alive is a universal rule. Preserve required safe control and trustworthy monitoring while restricting the attacker's access. These qualifications take precedence over broader language in the discussion. Chapters 00:00 Introduction 00:47 The Siemens Node-RED case 07:24 The Technical Breakdown 16:48 The Operational Decisions 25:19 The Pressure Test 32:56 The Key Takeaways 35:34 Closing Cybersecurity Under Pressure. Real Attacks, Real Lessons. https://cybersecurityunderpressure.com/ Primary sources Siemens ProductCERT SSA-834709: https://cert-portal.siemens.com/productcert/html/ssa-834709.html Node-RED security guidance: https://nodered.org/docs/user-guide/runtime/securing-node-red NIST SP 800-82 Rev. 3: https://csrc.nist.gov/pubs/sp/800/82/r3/final
- CUOctober 24 · 3 min
Connected Vehicle Security: From Cloud API to In-Vehicle Control | CUP Focus
The API gateway may validate a remote command while the internal vehicle network accepts it without equivalent checks. This CUP Focus explains why cloud authorization, telematics and in-vehicle trust must be assessed as one attack path. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Your License Plate Is the Password: What the Kia API Hack Revealed When a License Plate Becomes a Password | CUP Micro Brief Jeep Hack Lessons: Testing Vehicle Gateway Trust Boundaries Automotive Extortion: Protecting Cloud, APIs and the Update Chain
- CUOctober 23 · 52 min
A Station Identifier Is Not Proof of Station Identity
What happens when an EV charging backend accepts a station identifier without proving which station is actually connecting? This episode examines the Monta OCPP authentication weakness described in CVE-2026-95102 and CISA ICSA-26-274-02. We break down how identifier-based trust can enable station impersonation, why possession of an ID is not authentication, and what operators should enforce at the WebSocket and deployment layers. We also separate demonstrated impact from broader speculation: the issue supports unauthorized station identity claims, but it does not by itself prove widespread exploitation or direct compromise of vehicles or the power grid. Key lessons: • Treat station identity as an authenticated claim • Enforce credentials or certificates at connection time • Bind provisioning, authorization, and revocation to each charger • Monitor duplicate or anomalous station connections • Validate deployment controls, not only protocol support
- CUOctober 22 · 2 min
BLE Vehicle Security: The Risk of a Shared Authentication Key | CUP Micro Brief
Researchers found two million aftermarket vehicle devices sharing one Bluetooth authentication key. This CUP Micro Brief shows how manufacturing convenience became a scalable path to vehicle functions. Related CUP episodes: BLE Theft Auto: How Aftermarket Devices Bypass Vehicle Security Aftermarket Car Alarm Security: Managing Vehicle Modifications UC San Diego Research: Aftermarket Anti-Theft Device Security Your License Plate Is the Password: What the Kia API Hack Revealed
- CUOctober 22 · 3 min
Vehicle-to-Grid Security: Coordinated Charging and Grid Risk | CUP Focus
V2G can support the energy system, but aggregated charging and discharging also create a coordinated control surface. This CUP Focus follows the path from distributed vehicle batteries to frequency disturbance, demand spikes and cascading grid protection events. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: EV Charging Cybersecurity: How Charger Attacks Could Affect the Grid EV Charging and Grid Security: When Mobility Becomes Infrastructure Automotive IDPS, VSOC and PSIRT: From Alert to Response When EV Charging Becomes a Cyber-Kinetic Risk | CUP Micro Brief
- CUOctober 21 · 2 min
Clean Code Does Not Prove a Safe Process | CUP Micro Brief
Clean code and verified binaries do not prove that a physical process is safe. This CUP Micro Brief explains how attackers can change parameters and references without changing the software, and why independent production evidence matters. Related CUP episode: Why Clean Code Causes Industrial Disasters
- CUOctober 21 · 37 min
How Reading PLC Data Crashes Industrial Systems
A monitoring function should observe a PLC, not destabilize it. But when diagnostic access, shared buffers and runtime synchronization interact badly, a read operation can become an availability event. This episode examines how an improper synchronization flaw in a CODESYS runtime can turn routine PLC monitoring into a denial-of-service path. We follow the chain from memory handling and race conditions to plant-level consequences, then test the usual responses: patch immediately, isolate the engineering path, restrict monitoring access, or compensate until a controlled maintenance window is available. The central lesson is operational: read-only intent does not guarantee read-only impact. Asset owners need to treat engineering and monitoring services as active trust boundaries, validate vendor fixes against the real process, and detect abnormal diagnostic behavior before it becomes loss of control or loss of visibility. Chapters 00:00 Context and Central Question 09:44 The Technical Breakdown 19:20 The Operational Decisions 26:41 The Pressure Test 34:01 The Key Takeaways Cybersecurity Under Pressure: Real Attacks, Real Lessons. https://cybersecurityunderpressure.com/
- CUOctober 20 · 1 min
Security Appliance Risks: The Hardcoded Master Key | CUP Micro Brief
A security appliance can become the weakest trust boundary when its vendor embeds an unchangeable master key. This CUP Micro Brief explains why the resulting blast radius extends far beyond one device. Related CUP episodes: Johnson Controls Airwall: The Risk Behind a Hardcoded Key Industrial Firewall Security: The Hidden Software Lifecycle Windchill Security: Restoring Trust in Engineering Data Industrial Network Security: Designing for Operational Resilience
- CUOctober 20 · 2 min
Industrial 5G Network Slicing: The Limits of Isolation | CUP Focus
A private 5G slice can separate traffic without creating an independent physical network. This CUP Focus examines the SDN controller, hypervisor and cross-slice paths that can turn software-defined isolation into a shared point of failure. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Industrial 5G Security: Designing for Lost Connectivity Industrial 5G Jamming: Protecting Control When the Radio Fails When 40 Milliseconds Become an OT Incident | CUP Micro Brief FRMCS Security: Why a Mobile Network SLA Is Not a Safety Case
- CUOctober 19 · 33 min
When a Vendor Breach Hits Spain’s Railway Network
A supplier compromise can reach rail operations without directly attacking signalling or rolling stock. This episode examines what happens when trust placed in vendors, remote access, credentials, maintenance channels and shared services becomes an operational risk. We trace the path from supplier exposure to the decisions that matter for infrastructure operators: isolating affected access, validating identities, preserving service, collecting evidence and deciding when recovery is safe. The analysis connects third-party risk with NIS2, supply-chain assurance, incident response and OT resilience. You’ll learn: Why a vendor VPN is not the real trust boundary How shared credentials and remote maintenance expand the attack path What to contain first without disrupting railway operations Which evidence supports a defensible recovery decision What operators and suppliers should change before the next incident Chapters 00:00 Why vendor compromise becomes railway risk 05:04 From supplier access to operational exposure 12:13 Trust boundaries, credentials and remote maintenance 18:44 Containment without disrupting service 27:35 Key takeaways for operators and suppliers More analysis: https://cybersecurityunderpressure.com/
- CUOctober 18 · 1 min
Third-Party ICS Access: The VPN Is Not the Trust Boundary | CUP Micro Brief
Remote access for an ICS integrator is not merely a VPN configuration. It is a temporary operational trust boundary. This CUP Micro Brief explains why access to native industrial protocols and critical parameters must be constrained, monitored and corroborated with physical evidence. Related CUP episode: Third-party ICS Access Is an Operational Trust Boundary, Not a VPN Problem