A stranger can change your pump's speed, and it takes twelve bytes

Here is a thing that sounds like a movie and is actually a Tuesday. A pump running at full speed drops to a crawl. Nobody at the control screen touched it. The screen even drew the change as it happened and had no record of anyone making it. Somewhere on the network, a device that should not have been talking to the pump said "run slower," and the pump obliged.

There was no hack in the Hollywood sense. No password was cracked, because there was no password. The pump speaks Modbus, a protocol from 1979 that was designed for a wire running inside a locked panel. On that wire, being connected was the permission. You were inside the cabinet, inside the plant, past the fence. Nobody needed to prove who they were, because getting to the wire already proved it.

Then the wire grew. It got an IP address so the maintenance team could reach it. The plant network got joined to the office network so the reports would flow. A remote-access account appeared so a vendor could log in from home. And the locked panel, the thing that was actually doing the security, quietly stopped being the boundary. The protocol never changed. The world around it did.

So today, anyone who can reach the network segment the pump lives on can do what I did in a lab this week: read every value the pump reports, and write the ones that move it. The command that changed the speed was twelve bytes. A code that means write, the number of the register that holds the speed, and the new value. There is no room in that message for a credential. The pump cannot tell my laptop from the control system. Something asked it to change, so it changed.

The reflex, when people hear this, is to blame Modbus and reach for encryption. That is the wrong lesson and an expensive one. You cannot meaningfully bolt security onto a protocol that half the devices on your floor will never support, and if you try, you have spent a year armouring the messenger while the door stays open. The pump is not the problem. The fact that a random laptop can reach the pump at all is the problem.

Which is good news, because that fix is mostly free. Put the control devices on their own network segment that the office and the VPN cannot reach directly. Let the things that only need to read the pump have a path that cannot write to it. And watch for the one command that should never appear, a write to a setpoint from a machine that has never written anything, because that is loud and easy to catch. None of that is a six-figure appliance. Most of it is an afternoon with the network you already own.

I captured the whole thing, the reading, the write, the decode down to those twelve bytes, in a lab built on equipment I own. If you want the receipts and the exact anatomy of the message that moved the pump, that is the lab write-up. The short version is the part worth remembering: the danger is real, the protocol is not the villain, and the boundary that stops it is one you can draw this week.