{
  "id": 5560243,
  "title": "A Brick, a Post-it, and admin/admin — How I Learned OT Security by Building a Factory in My Bedroom",
  "url": "https://urgent.news/2026/09/04/a-brick-a-post-it-and-admin-admin-how-i-learned-ot-security-by",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-04T12:55:22.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/andreaoliva/a-brick-a-post-it-and-adminadmin-how-i-learned-ot-security-by-building-a-factory-in-my-bedroom-1538"
  },
  "original_language": "en",
  "account": "In the depths of my bedroom, I discovered the first vulnerability of a chemical plant: a brick propping open a locked door. Nestled within the computer room lay a sticky note containing credentials, a testament to the lax security measures in place. Seizing the opportunity, I entered the system using the universally recognized default credentials, \"admin/admin,\" effortlessly bypassing three layers of security.\n\nThis tale serves as a stark reminder that learning OT (operational technology) security requires hands-on experience, as textbooks alone cannot adequately prepare one for the challenges faced in real-world industrial environments. The journey begins with a simple three-command setup: connecting to the Docker API, granting necessary permissions, and initializing the simulated chemical plant using GRFICSv3, an open-source project that replicates an entire factory within Docker containers on a personal computer.\n\nUpon entering the plant's virtual brain and operator interface, I was shocked to find that the default credentials granted me complete control over the system. With a single click, I witnessed the 3D representation of the plant respond to my commands, a chilling realization that anyone with basic knowledge could gain access to an industrial process without any formal training.\n\nDelving deeper into the network, I discovered the Modbus protocol, a fundamental communication standard in the industrial world, which lacks any form of authentication. Armed with this knowledge, I crafted a simple Python script to interact with the plant's Modbus interface, reading and writing values with ease. What started as mere curiosity quickly transformed into a profound understanding of the vulnerabilities present in OT systems.\n\nThe moment of truth arrived when I transferred control to the operator interface and manually manipulated the valves, observing the plant's reaction in real-time. With a single command, I was able to close a valve, subsequently zeroing the corresponding register and affecting the plant's output. This exercise vividly illustrated the potential consequences of a successful OT breach, where unauthorized manipulation can have far-reaching implications on the physical world.\n\nThe experience left an indelible impression, highlighting the urgent need for robust OT security measures. The digital and physical realms are now inextricably linked, with the individual who holds the key—or the brick—to the PLC cabinet possessing the power to control an entire industrial facility. As the curtain falls on this tale, it serves as a stark reminder that the stakes are higher than ever before, demanding our unwavering attention and vigilance in safeguarding the critical infrastructure that powers our modern world.",
  "summary": "THE BRICK AND THE POST-IT My chemical plant's first vulnerability wasn't a bug, a piece of malware, or a port left open to the internet. It was a brick. In the computer room — the one with a door held open by a brick — I found a sticky note with credentials on it. They weren't even the right credentials for the system I wanted to break into. But they made me think the way whoever wrote them…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}