Shit Wizard 420

Literally more secure than the (now patched) access to the freezers:

https://ironhackers.es/en/danfoss-ak-sm-800a-cve-2025-41450/

The new order comes amid several reported cyberattacks on U.S. water systems, which officials suspect have links to Iran, according to The New York Times.

I know the article isn’t saying it’s the same, but I wanted to add a clarification that the FBI had said the attacks were only noted in Rockwell Automation/Allen-Bradley Programmable Logic Controllers (PLCs), specifically MicroLogix 1100 and 1400 series.

After remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality.

There have been PLC attacks that resulted from a compromised device being installed but these appear to be about poor security practices.

Someone is in TROUBLE:

At least one organization reported modified PLC project files after noticing ladder logic discrepancies across several sites.

There is literally a physical key you have to turn to change the program. For example:

This is a positive step and something that seems rather basic but unfortunately isn’t common.

I work with municipalities in Ontario, Canada. I was surprised to learn that only Toronto is required by law to maintain a lobbyist registry. Some municipalities have it in their bylaws and do so voluntarily. That still relies on individual staff knowing and understanding the requirements. I’ve been surprised how many times I’ve had to say, “Hey, should this meeting be registered?” and for municipal staff to have no idea it was required or how to comply.