> Best of all, they tend to have mini web servers exposing device APIs, completely written in straight C code. Well of course, that's what the 10 year old vend

> Best of all, they tend to have mini web servers exposing device APIs, completely written in straight C code. Well of course, that's what the 10 year old vendor SDK uses, why do extra work? /s The state of industrial/embedded security in general is so poor I'm surprised there aren't more stories like this coming out. To give a concrete example, the industrial world was using modbus since the late 1970s and when Ethernet came around in the 1980s someone thought "well let's just encapsulate modbus data in TCP" and thus was born ModbusTCP. Not a single thought was given to security. There's millions if not billions of dollars of industrial equipment using ModbusTCP today that cannot be secured without being replaced completely. I've yet to see anyone pushing a secure protocol to replace ModbusTCP in industrial environments. When a utility is hacked (not if) and the attackers get into the SCADA network, it's going to cause a bloodbath of epic proportions.