Your Biggest Vulnerability Isn't Yours. Lessons from a Vendor Backdoor in Critical Infrastructure

One click during a routine water-treatment pentest, and we were staring at a live SCADA control panel - pumps spinning, valves indicating, chemical mixing - running on the public internet with no authentication. It relayed any backend command an attacker wanted to send: read alarms, override setpoints, dump the entire configuration including encrypted operator credentials. The vendor's response when this was disclosed? "Just enable authentication." The fix wasn't a fix.

Three years later, that same backdoor still ships, still hits hundreds of internet-exposed deployments, and now there's a new development: we re-analyzed the entire codebase in an afternoon and found 41 more vulnerabilities, including five end-to-end attack chains the original engagement never had time to enumerate. One of those chains is reverse-engineering the vendor's "proprietary encryption" - which turns out to be a hardcoded key the same in every shipped binary (!) In this presentation, we’ll show five working attack chains for this (live, running) software package and do an in-depth walkthrough of one, showcasing the exploitation process. By the end, you’ll understand why your security program's biggest exposure isn't the code your team wrote - it's the vendor software running inside your perimeter.