The Default Password That Unlocked the World
For decades, industrial control systems—from water treatment plants to power grids—shipped with universal default logins that were rarely changed. This episode explores how a design choice intended for convenience became a systemic vulnerability, leading to real-world infrastructure breaches and a fundamental shift in how we secure the physical world.
Listen in the Fylom app.
Industrial controllers prioritize operational uptime over security because physical access was once the only threat.
Hardcoded passwords in communication cards often act as permanent backdoors that operators cannot easily change.
The SCADA StrangeLove project centralized hundreds of default logins that were previously engineering shortcuts.
Legacy infrastructure installed in the late nineties lacks the memory to support modern authentication protocols.
Hackers used the default password one one one one to hijack a Pennsylvania municipal water authority.
CISA now classifies static default passwords as a fundamental design flaw rather than a user error.
- 01Intro1 min
- 02The Engineering of Convenience2 min
- 03The Open Secrets2 min
- 04The Inertia of Infrastructure2 min
- 05When the World Logged In3 min
- 06The End of the Default Era1 min
- 07Outro1 min
- GitHub - arnaudsoullie/ics-default-passwords: List of default passwords for Industrial Control Systems
- Researchers Publish Default Passwords for ICS Products
- SCADA/ICS Default Password List
- [PDF] Guide to Industrial Control Systems (ICS) Security
- [PDF] Industrial Control System Security NIST SP 800-82 - CSRC
- Passwords like '1234' are still one of the biggest threats in IoT/OT
- SCADA vuln imperils critical infrastructure, feds warn
- SecLists/Passwords/Default-Credentials/scada-pass.csv at master · danielmiessler/SecLists
- Poland's Water Hack Prosecution Names Russians But ...
- Secure by Design Alert: How Manufacturers Can Protect Customers by Eliminating Default Passwords
- CISA Urges Manufacturers Eliminate Default Passwords to Thwart ...
- Default Credentials — Critical Severity (CVSS 9.8)
- CISA Urges Manufacturers to Eliminate Default Passwords After ...
Fylom generates episodes like this on any topic you're curious about.
Fylom episodes are researched, written, and voiced by AI. Automated checks help catch inaccuracies, but episodes aren't reviewed by a human and AI can still get things wrong. Treat them as a starting point, not a source of record — more in our accuracy disclaimer.