Five Ways In Through the Air

Attackers don't need a new trick when an old door is open. In public reporting and in our own field work, the same five weak spots keep coming up. None of them needs an exotic attack. All of them can be fixed.

1. The factory password

A controller, camera, gateway or reader still uses the password it shipped with. Or one password covers the whole fleet. Anyone who knows the default knows the way in.

Safer: find it, give it a unique credential, and check the device still works afterward.

2. The screen anyone can reach

SOURCED

In July 2026, the FBI and EPA reported attacks on internet-facing controllers at water and wastewater systems in at least seven states. Some disrupted operations.³ That was an exposed-network problem, not a radio one. But the lesson travels: a control screen anyone can reach is an open door, however the path gets there.

Safer: remove direct exposure. Allow access only through approved routes.

3. The modem a vendor left behind

Remote support was set up for one project and never taken down. It still works. It still goes around your network.

Safer: give it an owner and a purpose. Remove what nobody needs. Limit what stays.

Old doors are the easiest ones to walk through. Nobody remembers to lock them.

4. The radio nobody watches

For the government-building context, read Book Six: Six Doors Into the Facility.

SOURCED

In April 2026, Toronto Police reported more than 13 million network disruptions linked to devices posing as cell towers.⁴ Phones are the obvious victims. But alarm panels, elevator phones and sensors that rely on cellular need a working radio link too.

A device that suddenly goes quiet, connects somewhere new or starts behaving differently is telling you something. If nobody is listening, nobody hears it.

Safer: learn what normal looks like for each device, and chase down the changes that matter.

5. The fix nobody checked

Someone blocks a suspicious connection in a hurry. The threat stops. So do the badge reads, the alarm reporting or the sensor data the operation runs on. Nobody notices until morning.

Safer: no fix is finished until two checks pass. The risky path is closed. The service still works.

Hear the signal. Prove the risk. Control the path. Then check the service.