Cybersecurity Under Pressure. Real Attacks, Real Lessons

Antonio González

This podcast breaks down real cybersecurity incidents to understand what actually went wrong, not in theory, but in practice. Each episode analyzes a recent attack, explains the technical mechanics in clear language, and translates them into concrete lessons for security, engineering, and business teams. Topics covered: OT security, ICS cybersecurity, industrial control systems, critical infrastructure protection, NIS2 compliance, Zero Trust architecture, operational technology resilience, railway cybersecurity, automotive security, and cyber-physical systems.

  1. 5h ago

    Secure at the Factory, Exposed at the Dealership: The BLE Theft Auto Problem

    A vehicle can leave the factory with a carefully designed cybersecurity architecture and acquire a new attack surface before the owner even drives it home. In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine the BLE Theft Auto research into aftermarket Bluetooth Low Energy remote-control and anti-theft systems. Installed by dealerships or vehicle owners, these products can connect smartphone applications to door locks, alarms, lights, immobilizers, ignition systems and other sensitive vehicle functions. Their installation changes the vehicle’s security baseline outside the original development and release process of the manufacturer. The Technical Breakdown explores how proprietary application-layer protocols, weak pairing mechanisms and inadequate key management can turn a security product into an access path. Vulnerable devices may broadcast identifiers that can be detected locally or located through crowdsourced Bluetooth databases, allowing an attacker to identify and target specific vehicles. Depending on the affected system, unauthorised access may enable doors to be unlocked, alarms to be disabled, engines to be immobilised or remote-control functions to be activated. The Operational Decisions examine the fragmented responsibility behind the problem. The OEM may not have designed or approved the device, the dealership may have installed it, the aftermarket supplier controls the firmware and application, and the owner may be expected to perform the update. For dealerships and fleet operators, the immediate challenge is determining which vehicles contain the component, whether the firmware has been updated and what compensating controls are possible when removing the device requires invasive work on the vehicle wiring. In The Pressure Test, you are responsible for product security across a dealership network or vehicle fleet. A serious vulnerability has been disclosed, affected vehicles are already in customer hands and the installed-device inventory is incomplete. You must decide how to identify exposed vehicles, notify customers, verify remediation and manage the residual risk while ownership remains distributed across manufacturers, dealers, suppliers and drivers. The key lesson is that automotive cybersecurity cannot stop at factory release. The vehicle security baseline must account for dealer-installed equipment, aftermarket modifications, software updates, resale and decommissioning. Effective lifecycle governance requires configuration visibility, explicit supplier responsibilities, secure update mechanisms and evidence that every component connected to sensitive vehicle functions remains authorised and supportable. Because a secure vehicle can become vulnerable when someone adds a component that was never part of its original cybersecurity architecture. Thanks for listening to Cybersecurity Under Pressure. Follow the show for more real attacks, technical breakdowns and practical lessons for cybersecurity leaders. Explore all episodes and resources: https://cybersecurityunderpressure.com/episodes

  2. 2d ago

    When the Security Router Becomes the Attack Path: Weidmüller and the Fragility of Industrial Segmentation

    An industrial security router is supposed to protect the factory floor. But when that router is vulnerable, the security boundary itself can become the attacker’s path into production. In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine vulnerabilities affecting Weidmüller industrial security routers and the wider operational problem they expose. These devices may provide firewalling, network segmentation, VPN connectivity and remote access between industrial machines, production cells and external support environments. That defensive role also gives them a privileged position within the architecture. The Technical Breakdown explores what happens when vulnerabilities affect the device responsible for enforcing trust between networks. A compromised router may expose its configuration, interfere with communications or provide a pivot point toward systems that were assumed to be protected behind it. The risk is therefore larger than the individual vulnerability: placing extensive trust in one security appliance also creates a concentration of operational risk. In The Pressure Test, you are responsible for a large, high-speed factory floor built around industrial robotics. The routers protecting the production networks are vulnerable, but taking them offline could interrupt operations, remote maintenance and critical communications. You must decide whether to patch, isolate, replace or continue operating under compensating controls while production, safety and recovery requirements leave little room for error. The Operational Decisions examine the practical constraints behind that choice, including incomplete asset inventories, restricted maintenance windows, legacy dependencies, supplier access and the challenge of proving that segmentation still works after the device enforcing it can no longer be fully trusted. The key lesson is that a security control must also be managed as a potentially vulnerable operational asset. Industrial resilience requires verified firmware baselines, restricted management access, independent monitoring, tested recovery procedures and an architecture that does not place unlimited trust in a single protective device. Because when the security boundary becomes the attack path, everything behind it must be reassessed. Thanks for listening to Cybersecurity Under Pressure. Follow the show for more real attacks, technical breakdowns and practical lessons for cybersecurity leaders. Explore all episodes and resources: https://cybersecurityunderpressure.com/episodes

  3. 4d ago

    Frauscher FDS102: Why Railway Diagnostics Belong Inside the Security Boundary

    A diagnostic system does not have to control the safety function to become operationally critical. In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine the vulnerabilities affecting the Frauscher FDS102 diagnostic environment and the broader lesson they reveal about railway cybersecurity. The disclosures do not demonstrate compromise of the FAdC axle-counting safety logic itself. But that distinction does not make the diagnostic tier insignificant. Diagnostic environments can contain railway signalling information, track layouts, configuration data, privileged functions, backups and the tools required to support preventive and corrective maintenance. The Technical Breakdown traces this diagnostic trust chain from identity and system access to engineering data, administrative capabilities, maintenance workflows and connected railway assets. The central question is not only whether an attacker can reach the safety function directly. It is what becomes possible when a compromised diagnostic environment exposes sensitive engineering knowledge, disrupts maintenance capability or creates a trusted path toward other operational systems. The Operational Decisions explore the difficult choices that follow. Isolating the environment may reduce exposure, but it can also remove visibility and delay troubleshooting. Applying an update may close known vulnerabilities, but it does not automatically restore confidence in the system, its data or the access paths that existed while it was exposed. In The Pressure Test, you are the railway operator in the control room. The clock is running, the diagnostic environment may no longer be trustworthy and continued operations still depend on the capabilities it provides. You must decide what to isolate, what can remain available and what evidence is required before the environment can safely return to service. The key lesson is that “diagnostic” describes a function. It should not define the cybersecurity consequence. Railway resilience therefore requires more than patching. Recovery objectives, backup responsibilities, restoration times and supplier obligations must be explicit, testable and aligned with the operational importance of the diagnostic environment. Because a system that supports maintenance, troubleshooting and recovery is already part of the railway security boundary. Thanks for listening to Cybersecurity Under Pressure. Follow the show for more real attacks, technical breakdowns and practical lessons for cybersecurity leaders. Explore all episodes and resources: https://cybersecurityunderpressure.com/episodes

  4. Sep 4

    When Edit Permissions Become System-Level Code Execution

    Least privilege can look perfectly correct inside an application and still fail one layer below. In this episode, we examine CVE-2026-3014 in Siemens Siveillance Video, a critical vulnerability affecting the Management Server API. An authenticated user with edit permissions can execute arbitrary code in the context of the Management Server Service. That distinction matters. This is not an unauthenticated remote-code-execution scenario. The attacker already needs a meaningful application privilege. But the vulnerability exposes a deeper architectural problem: a permission intended to authorise configuration changes can cross the application boundary and inherit authority from the service and operating system underneath it. We break down that privilege path from the application role to the Management Server API, the Windows service account and ultimately the host on which the management capability runs. For a video-management platform, the consequences extend beyond a single server. Management systems can sit at the centre of cameras, alarms, operator workflows and other physical-security capabilities. The relevant security question therefore becomes not only who can authenticate, but what each authorised identity can ultimately reach if one layer of the architecture fails. The episode then moves into the operational decisions. How should organisations respond when a critical vulnerability affects an actively used management server? Is patching immediately always the safest option? Which administrative identities actually require edit permissions? From where can those accounts reach the management plane? And what architectural controls can reduce exposure while maintaining the physical-security capability? We explore dedicated management enclaves, deny-by-default connectivity, bastion and privileged-access management, MFA, just-in-time administrative access, privileged-session monitoring and service-account hardening as parts of the same defence-in-depth argument. The central lesson is that least privilege cannot be assessed only at the user interface. A defensible architecture must follow privilege across the complete stack: application role → API → service account → operating system → connected assets and management networks Cybersecurity Under Pressure explores real vulnerabilities, their operational consequences and the engineering decisions required to protect cyber-physical systems. Website https://cybersecurityunderpressure.com Telegram https://t.me/cybersecurityunderpressure

  5. Sep 2

    A Critical CVE Is Not an Attack Path: Assessing PLCnext Risk in the Plant

    A critical vulnerability tells you what could be exploited. It does not tell you whether an attacker can actually reach it, what conditions would be required or what the operational consequences would be inside your plant. In this episode, we examine the Phoenix Contact PLCnext advisory as a practical example of why OT vulnerability management cannot stop at CVSS. For PLCnext firmware before version 2026.0.3, CVE-2025-41769 affects the PROFINET service in its default configuration. An unauthenticated remote attacker able to reach that service could trigger a buffer overflow, potentially causing a controller reboot or arbitrary code execution. The wider advisory also covers a denial-of-service condition affecting the PLCnext Engineer interface and a lower-impact SQL injection issue. The vulnerability is clear. The plant-level exposure is not. We break down the questions that determine whether the CVE represents an urgent production risk: which controller versions are actually deployed, whether the affected service is enabled, from which network zones PROFINET is reachable, which engineering conduits cross those zones, what filtering and monitoring exist, and whether an attacker could satisfy the necessary preconditions. The episode then moves from technical exposure to operational decision-making. Should the organisation patch immediately, isolate the controller, introduce compensating controls or continue production while collecting stronger evidence? How should teams respond when asset inventories are incomplete, maintenance windows are limited and an uncontrolled intervention could create its own safety or availability risk? The Pressure Test places those decisions inside a Tier-1 automotive plant with hundreds of robotic systems, continuous production commitments and a critical vulnerability affecting controllers embedded in the manufacturing process. The central lesson is that two plants can carry the same CVE and still face completely different risks. A defensible OT vulnerability assessment must connect the advisory to the real architecture: affected asset → reachable service → attack preconditions → feasible attack path → operational consequence → detection and mitigation Cybersecurity Under Pressure explores real vulnerabilities, their operational consequences and the engineering decisions required to protect cyber-physical systems. Website https://cybersecurityunderpressure.com Telegram https://t.me/cybersecurityunderpressure

  6. Aug 31

    When a Vehicle Detects the Attack but Cannot Safely Block It

    Detecting a cyberattack inside a moving vehicle is only the beginning. The harder question is what the vehicle should do once malicious traffic has been identified. In this episode, we examine the AutoHack dataset and a 2023 Hyundai vehicle experiencing synchronised anomalies across its C-CAN, P-CAN and B-CAN networks. The research provides a rare view of how attacks can propagate across multiple in-vehicle buses and produce observable consequences in a real cyber-physical system. We break down the architecture that makes these attacks possible. The CAN protocol was designed for speed, reliability and deterministic communication—not sender authentication. Once an attacker reaches the network, priority arbitration can be abused to flood the bus, suppress legitimate messages or impersonate an ECU through a carefully timed masquerade attack. The detection problem is equally difficult. Real vehicle traffic is noisy, irregular and event-driven. Diagnostic communication such as UDS does not follow a perfect timing pattern, meaning an intrusion detection system that performs well against a clean laboratory dataset may generate false positives or miss sophisticated attacks under real driving conditions. We then examine how the AUTOSAR Intrusion Detection System Manager processes security events while operating with limited memory, bandwidth and computing capacity. Filtering and rate limitation protect the ECU from resource exhaustion, but they can also discard the event that contains the most valuable forensic evidence. That creates the central operational decision: should the vehicle actively block suspicious communication, even when doing so could interrupt a safety-critical function, or should it continue monitoring while the attack may still be active? The episode pressure-tests a consequence-driven response based on reversible and traceable measures. Rather than immediately severing CAN communication, the proposed decision uses the IDSM in reporting mode, preserves qualified events locally, forwards relevant evidence to the backend SOC and validates stronger blocking controls in HIL environments before deploying them to the production fleet. The final lesson is that automotive cybersecurity cannot be demonstrated by detection accuracy alone. A defensible capability must connect a credible attack, its preconditions, its physical consequences, the observable signal, the detection mechanism and a response that remains safe under real operational constraints. Cybersecurity Under Pressure explores real attack techniques, their operational consequences and the engineering decisions required to protect cyber-physical products. Website https://cybersecurityunderpressure.com Telegram https://t.me/cybersecurityunderpressure

  7. Aug 28

    When the Automotive Update Path Becomes the Attack Path

    The most revealing automotive malware cases do not always begin by exploiting an unknown vulnerability. Sometimes they begin with software that the vehicle already trusts. In this episode, we examine a malware infection chain targeting Android-based automotive head units. At its centre was TWCore, a legitimate system application used for analytics and software updates. Instructions received through an MQTT broker told the application which APK packages to download and install. A parameter called installNotExists allowed software that was not already present on the device to be introduced, including JarService, a dropper that loaded further malicious components. The observed activity focused on ad fraud, reverse-proxy services and botnet-like capabilities. However, the more important cybersecurity lesson concerns authority. The attackers did not first need to defeat the local installation model. A trusted component already possessed the permissions required to introduce executable software. We explore why encrypted communications, authenticated servers and signed packages are not enough when the update architecture cannot independently verify that a specific artefact is authorised for the vehicle, product variant and approved software baseline. The discussion then moves to the operational decisions. How should manufacturers respond when telemetry is incomplete? Should they disable an update service, isolate the backend or wait for stronger evidence? How can they investigate affected vehicles without creating new availability or support risks? And what prevents a compromise in the infotainment domain from reaching gateways or safety-critical systems? The episode concludes with a practical assurance model covering release manifests, package authorisation, runtime inventory, backend monitoring, least privilege and architectural containment. Cybersecurity Under Pressure explores real attacks, their operational consequences and the engineering decisions required to protect cyber-physical products. Website https://cybersecurityunderpressure.com Telegram https://t.me/cybersecurityunderpressure

  8. Aug 26

    When AI Lowers the Barrier to Attacking Siemens S7 PLCs

    Artificial intelligence is changing the economics of industrial cyberattacks. Capabilities that once required specialist PLC knowledge can now be assembled faster by combining AI coding assistants with open-source libraries such as Python-Snap7. In this episode, we examine how Python scripts can interact directly with Siemens S7 controllers, read or modify PLC memory, and turn legitimate engineering functionality into a potential operational attack path. The central issue is not a new industrial protocol or a single vulnerability. It is the reduction of the expertise, time and experimentation previously required to build tools capable of interacting with industrial control systems. We break down the technical mechanism, then move into the decisions defenders face when malicious PLC access is suspected. What does read-write access mean for production integrity? How should an organisation respond when safety constraints, regulatory uptime requirements and incomplete evidence make an immediate shutdown difficult? And how can security teams distinguish legitimate industrial communications from malicious control activity? The episode closes by pressure-testing those decisions against realistic operational constraints and examining what defenders should prioritise as AI continues to lower the barrier to entry for OT attacks. Cybersecurity Under Pressure explores real attack techniques, their operational consequences and the decisions organisations must make before a cyber incident reaches the physical process. Websitehttps://cybersecurityunderpressure.com Telegramhttps://t.me/cybersecurityunderpressure

See All (95)

About

This podcast breaks down real cybersecurity incidents to understand what actually went wrong, not in theory, but in practice. Each episode analyzes a recent attack, explains the technical mechanics in clear language, and translates them into concrete lessons for security, engineering, and business teams. Topics covered: OT security, ICS cybersecurity, industrial control systems, critical infrastructure protection, NIS2 compliance, Zero Trust architecture, operational technology resilience, railway cybersecurity, automotive security, and cyber-physical systems.

Information