Ravindra BagaleCourses & study guides मराठी Track your progress

43. IoT and OT Security – Cameras, Smart Devices, Plant Networks

43.6 Internet Exposure Awareness – Your Lab Only

By Last updated:

Search engines and scanners exist that map banners on the public internet (Shodan-class services). Exam / Blue use: check whether YOUR company / YOUR lab EIP accidentally published a camera or MQTT. Banned: mass-querying strangers, building target lists, "for fun" screenshots of random hospitals.

Safe habit:

  1. Know your own public IPs (AWS Elastic IP, home WAN – with permission)
  2. From outside (phone mobile data), try to reach your own management ports – expect fail
  3. If something answers that should not – close it, rotate creds, review UPnP/NAT
  4. Never paste other people's device IPs into class WhatsApp
Red team (attacker) does Blue team (defender) detects / stops
Uses public search to find open 554/1883/502 Asset inventory + periodic own-IP exposure check
Screenshots random cams for clout Illegal / unethical; Blue reports exposure to owner only
Assumes "obscure port = safe" Assume scan; require auth + VPN even on odd ports

Ravindra Bagale's Tip

Students create a free Shodan account and scan their neighbours. That is out of scope. Interview: "I use exposure search against assets I am authorized to review." Now let's move on.

Lab

Write a 5-step "own EIP check" runbook for Sahyadri's AWS lab (ports 22, 80, 1883, 502, 554). Mark each expected closed on WAN. Do not query third-party ranges.

Extended teaching notes

Why this lesson matters

Cameras, sensors and plant controllers often ship with weak defaults. Segment them from IT, change passwords, block inbound internet, and watch outbound traffic.

Real examples

Global: Mirai showed what default passwords on routers/cameras can do at scale. Indian SME (sample): a factory puts PLCs on a separate VLAN reachable only via a jump host.

Mini case study

Suppose we are on a purple-team exercise for an Indian mid-size company (sample data). Red notes a technique from this lesson against a lab clone. Blue must show the control that stops it, the log that would have fired, and the ticket that hardens production. That is the standard this course trains you for.

Defender's worksheet (do this today)

  1. Write the lesson title, date and the exact lab target you are allowed to use.
  2. List three owned systems (VMs, apps, or cloud accounts) where this lesson applies.
  3. Run one safe check from the lesson on a lab system only. Paste the command and output.
  4. Write a two-sentence fix you would give a teammate.
  5. Name one related public advisory (CERT-In, CISA, NVD, or a vendor bulletin) with its date.

Indian workplace (sample data)

Suppose we are a junior analyst at Infosys, TCS, Wipro or a fintech SOC in Bengaluru/Pune. Turn this lesson into one checklist item with an owner, a due date and a place to store evidence (ticket + screenshot).

Global practice

Compare your notes with OWASP, CIS Benchmarks, NIST CSF/IR guidance or a cloud Well-Architected security question. Write five lines on what overlaps.

Everyday analogy

Explain the risk and the fix to a family member without jargon. If they can repeat the warning, you understand it well enough to teach juniors.

Key terms

  • Control: a safeguard (patch, config, process, detection).
  • Finding: a weakness backed by evidence.
  • Remediation: the fix plus how you verified it.
  • Scope: systems you have written permission to touch.
  • Least privilege: only the access the task needs.
  • Defence in depth: several layers so one failure does not end the story.

Common mistakes

  • Skipping written permission "just for a quick scan".
  • Practising on hostel, office or public targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying attack steps onto production to "verify". Defenders verify with versions, configs and patches.
  • Publishing screenshots that contain secrets, cookies or internal hostnames.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Fix > spectacle.

Extra depth

Re-read the original short section at the top of the page, then this expansion. Together they should exceed a solid lesson length. If anything still feels thin, add your own lab screenshot and a paragraph in your notebook — that personal evidence is what interviews ask for.

  • Permission before tools.
  • Patch and config before exploits.
  • Logs and backups before blame.
  • Teach one junior the warning from this page.

Real incident: Volt Typhoon ‘Silent Train’ – hacked home and office routers hid zero-day attacks on network management systems (Oct 2026)

1. What happened

In this lesson you learnt to check what YOUR devices show to the internet. This real case shows why. A SOHO router is the small router in a home or small office (SOHO = small office, home office). Example: the Wi-Fi box your internet company gave you. Its web admin page is the page where you change the Wi-Fi name and password. If that page can be opened from the internet, strangers can try to break in.

  • On 28 October 2026, Black Lotus Labs, the research team of the US network company Lumen, published a report on a hidden network it calls Silent Train.
  • Lumen says Volt Typhoon, a China-linked state-sponsored hacking group, used Silent Train. Lumen tracked it for three years, from November 2023. The Hacker News calls it "now-disrupted".
  • Silent Train was built from hacked home and office routers, IoT devices and some company devices. Lumen saw more than 27 device types, for example TP-Link and Zyxel routers, Netgear Orbi Wi-Fi systems, Intelbras modems and Fortinet firewalls.
  • The group used it to attack management platforms. A management platform is one central tool that controls many computers or network devices. Example: one IT dashboard that can install software on 5,000 office laptops. One break-in there gives control of all of them.
  • Lumen confirmed four zero-day campaigns and one likely one. A zero-day is a flaw that attackers use before the maker knows about it, so there is no patch yet. The products were Versa Director (CVE-2024-39717), N-able N-central (CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127) and VeloCloud Orchestrator (CVE-2026-16812). Quest KACE was the likely one, with more than 30 victims.
  • Lumen warned hundreds of victims: telecom companies, government, defence companies, satellite and emergency communication providers, IT service companies, and water, energy, transport and aviation organisations. Most targets were in Hawaii, California and Texas in the USA.

2. How the hack happened (public reporting only – high-level)

  1. The attackers broke into home and office routers and IoT devices through their web admin pages that were open to the internet. Some of these devices had no known flaw, so Lumen thinks the group also used unknown flaws there.
  2. On each hacked device they added only a few small things for a short time, so they could pass traffic through it.
  3. They joined the devices into a chain. Each device in the chain is a hop (a relay). Example: a letter that goes through four post offices before it reaches you. You only see the last post office, not the person who sent it.
  4. A session started on rented servers outside the USA. It passed through hacked devices in other countries, then through a hacked device inside the USA as the last hop. So to the victim, the traffic looked like a normal US home or office address.
  5. Through this chain they attacked the management platforms, often with a zero-day. After getting in they stole passwords, used the tools' own built-in features, and in some cases deleted or changed logs.
  6. When the work was done (about four hours on average), they removed everything from the routers and broke up the chain. The next time, they used new devices.

3. How to stop it / defend (this lesson: internet exposure)

Why: an admin page that is open to the internet is a door. Your router can be used to attack a big company, and the attack will look like it came from YOUR internet address.

Controls you can use:

  1. Turn off remote management on your home and office router. The admin page should open only from inside your own Wi-Fi.
  2. Update the router firmware, change the default admin password, and replace old routers that no longer get updates.
  3. For companies: never put admin pages of management platforms on the internet. Put them behind a VPN, a jump host or a separate management network. A jump host is one locked-down server that admins log in to first, and only it can reach the admin pages.
  4. Patch management platforms first. They control everything else, so they are the top target.
  5. Keep logs in a central place, away from the devices, and keep them for a long time. Then an attacker who deletes logs on one device cannot hide the story.
  6. Watch for unusual admin activity: logins at odd hours, new admin users, unexpected file transfers or setting changes.

Example 1: find your own public IP address (the address the internet sees). Run these steps one by one.

  1. Connect your laptop to your home Wi-Fi and open a terminal.
  2. Run curl -s https://ifconfig.me
  3. Output: one address, like 203.0.113.25.
  4. What it means: this is your router's address on the internet. Every website you visit sees this address. If someone hacks your router, their attack traffic also comes from this address.

Example 2: check from OUTSIDE if your router's admin page answers. Do this only on your own router.

  1. Switch your phone to mobile data (Wi-Fi off) and turn on its hotspot. Connect your laptop to the hotspot, not to your home Wi-Fi.
  2. Run curl -s -o /dev/null -w "%{http_code}\n" --max-time 5 http://203.0.113.25:8080/ (put your own address from Example 1).
  3. Output: 000 means nothing answered. That is good. 200 or 401 means a page answered.
  4. What it means: if a page answers from outside, your admin page is open to the internet. Log in to the router from home, turn off remote management, update the firmware, and run the check again. Try the common admin ports 80, 443, 8080 and 8443 the same way.

Example 3: on a Linux server you own, see which services listen to the whole network.

  1. Log in to your own server or lab VM.
  2. Run sudo ss -tlnp
  3. Output: lines like LISTEN 0 128 0.0.0.0:22 and LISTEN 0 128 127.0.0.1:3000.
  4. What it means: 0.0.0.0 means "listen on every network, including the internet". 127.0.0.1 means "only this machine". Every admin service on 0.0.0.0 must have a strong reason, a firewall rule and a login. If not, change it to 127.0.0.1 or close it.

4. How to take care so it won't happen again (checklist)

  • [ ] Remote management is off on every home and office router, and the default admin password is changed.
  • [ ] Router and IoT firmware is updated, and devices that no longer get updates are replaced.
  • [ ] Once a month, the outside check (Example 2) is run on your own public IP addresses, and every open admin port is explained or closed.
  • [ ] Admin pages of management platforms, firewalls and SD-WAN tools are reachable only through a VPN, jump host or management network.
  • [ ] Management platforms get security updates first, within days.
  • [ ] Logs go to a central place and are kept for a long time.
  • [ ] Someone gets an alert for admin logins at odd hours, new admin users and unexpected setting changes.
  • [ ] If you get a warning that your device was used in an attack: disconnect it, reset it to factory settings, update the firmware, set a new strong password, and check what else it could reach.

Source: Lumen Black Lotus Labs, "Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access", 28 October 2026; BleepingComputer, "Volt Typhoon hides zero-day attacks using 'Silent Train' framework" (Bill Toulas), 28 October 2026; The Hacker News, "Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns" (Ravie Lakshmanan), 28 October 2026.

Check if you're safe: Website Security Checklist

Real incident: Europe supermarket fridges – internet-exposed cooling controllers were switched to defrost and freezers heated up to 50°C (Nov 2026)

1. What happened

In this lesson you learnt that anything you can reach from the internet, an attacker can try to reach too. This real case shows what happens when the control panel of a normal shop machine, a fridge, is left open like that.

  • Big shops keep their fridges and freezers on a small computer called a refrigeration controller. It has a web page, so a technician can change temperatures and fix problems from far away. This kind of machine is called OT (operational technology): computers that control real, physical things.
  • Overnight into Monday 2 November 2026, attackers changed the settings of fridges and freezers in more than 115 shops in seven European countries: Belgium, Sweden, Luxembourg, Ireland, the Netherlands, Estonia and Finland.
  • Some units were switched off. Others were put into defrost mode, so they warmed up. In one Swedish ICA shop the temperature was set to +50°C and staff could not change it back. Shops had to throw away chilled and frozen food. One Delhaize shop in Belgium said it lost about €100,000 of food.
  • Chains that confirmed problems include Delhaize (about 40 shops in Belgium and Luxembourg), Carrefour Belgium (15), Intermarché Belgium (about 15), SuperValu Ireland (13), Coop Sweden (7 of 800), ICA Sweden, Spar Belgium (5), Kesko in Finland, an Ikea store in Belgium and at least 17 small shops in the Netherlands.
  • Sabcobel, a Belgian company that runs many of these fridges, said the attacker used the same weakness as in an attack on hundreds of French supermarkets in October 2026. In France, the controllers that were hit were Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB models that were reachable from the internet.
  • ICA said the hit shops were outside its central network. Coop said some of its fridges were linked to a 4G mobile connection, which made them more exposed.
  • Experts told the Guardian that no malware was needed. Nobody has claimed the attack. The EU called it a deliberate attempt to disrupt the food supply chain.

2. How the hack happened (public reporting only – high-level)

  1. Shops connected their fridge controllers to the internet, so technicians could manage them from anywhere.
  2. Some of these control pages could be reached straight from the internet, without a VPN. Some sat outside the main company network, for example on a 4G link.
  3. Such open panels can be found by anyone who searches the internet for them.
  4. The attacker used a known weakness in the controller software, the same one used in France in October, to take control. No malware was installed.
  5. At night, when shops were closed, the attacker switched units to defrost, switched some off, or set very high temperatures, and in some cases locked the settings.
  6. Staff found the problem early in the morning. Technicians had to cut the units off the network. Some units needed physical changes, not just a software update.

3. How to stop it / defend (this lesson: internet exposure)

Why: a control panel that is open to the internet is a door with a sign on it. Patching helps, but the strongest step is to not have the door facing the street at all.

Controls you can use:

  1. Make a list of every device with a remote control page: fridges, cameras, AC, UPS, door locks. You cannot protect what you do not know about.
  2. Check from the outside what is open. Look at your own public address the way an attacker would (Examples 1 and 2 below, on your own systems only).
  3. Never put a device panel directly on the internet. Put it behind a VPN or a secure remote access service. Sabcobel says most of its customers moved to a secure connection after France.
  4. Do not forget the side doors. A 4G modem inside a machine, or a shop outside the main network, is still part of your attack surface. Add it to the list.
  5. Install the vendor's security fixes fast, and follow their advice. Sabcobel said the damage would have been worse if it had not started fixing units after the French attack.
  6. Use strong, unique passwords on every device panel, and never keep the factory login.
  7. Get an alert when settings or temperatures change, and make sure a real person gets it at night. Delhaize warned managers by SMS around 4 a.m.
  8. Have a plan B: know how to cut a device off the network fast, and how to keep stock cold (some shops used refrigerated trucks).

Example 1: find your public address (the one the whole internet sees).

  1. Open a terminal on a computer inside your own network or lab.
  2. Run curl -s https://ifconfig.me
  3. Output: one line, like 203.0.113.25.
  4. What it means: this is the address an attacker on the internet would scan. Here we use a sample address. Use your own.

Example 2: check from outside which panel ports answer (only on an address you own).

  1. Use a lab machine that is outside that network, for example your own cloud VM.
  2. Run nmap -Pn -p 80,443,8080 203.0.113.25
  3. Output: lines like 80/tcp closed http, 443/tcp closed https and 8080/tcp open http-proxy.
  4. What it means: something answers on port 8080 from the whole internet. Often this is a device web panel. It should not be open to everyone.

Example 3: see which program is listening, and on which network.

  1. Log in to the Linux machine or gateway that has the panel.
  2. Run sudo ss -tlnp | grep 8080
  3. Output: like LISTEN 0 128 0.0.0.0:8080 0.0.0.0:* users:(("panel",pid=812,fd=6)).
  4. What it means: 0.0.0.0 means the panel listens on every network, including the internet side. Change it to listen only on the VPN or inside network.

Example 4: close the port in the firewall.

  1. On the same machine, run sudo firewall-cmd --list-ports
  2. Output: 8080/tcp.
  3. What it means: the firewall lets port 8080 in. Remove it with sudo firewall-cmd --remove-port=8080/tcp --permanent, then run sudo firewall-cmd --reload.
  4. Run Example 2 again. Port 8080 should now show filtered or closed.

4. How to take care so it won't happen again (checklist)

  • [ ] I have a list of every device that has a remote control page, including ones on 4G.
  • [ ] I check my own public addresses from outside at least once a month.
  • [ ] No device panel is open straight to the internet; remote access goes through a VPN.
  • [ ] Factory logins are changed, and every panel has a strong, unique password.
  • [ ] I install vendor security fixes quickly and read their advisories.
  • [ ] Setting changes and alarms reach a real person, even at night.
  • [ ] I know how to cut a device off the network fast, and I have a plan B.

Source: BleepingComputer, "Hackers disrupt refrigeration systems at European supermarkets" (Bill Toulas), 2 November 2026; BBC News, "Shop freezers in seven European countries hit by cyber-attack" (James Gregory), 2 November 2026; The Guardian, "Who is hacking Europe’s supermarket fridges and freezers, and why?" (Robert Booth and Miatta Mbriwa), 2 November 2026.

Ravindra Bagale's Tip

Here is a simple test. Switch off your WiFi and use mobile data. If you can open a device control page from your phone like that, so can any attacker in the world. Put it behind a VPN today. Shops in seven countries lost their frozen food in one night because of open fridge panels.

Check if you're safe: Website Security Checklist