Hi, I'm Ran Levy. Welcome back to Malicious Life in collaboration with side music. Picture a truly depressing building.

It's 10 stories high, built of cement and dreyer than the sky is blue.

The pretty wooded areas are than the sky is blue.

The pretty wooded areas on either side of the parking lots only serve to enhance just how ugly the building truly is with its water damage, dirty radiators sticking out from the windows, and an extended entryway that looks like it was designed during whatever the worst era of modern art was.

And you can see where the motor connects each face of the building with the other faces,

as if the whole thing were glued together like the four slices of a gingerbread

house.

Though it is no architectural masterpiece, this actual building I'm describing to you has housed many talented people doing significant work over the years.

The chemists, engineers and technicians who've passed through its halls made notable progress in weapons and ammunition technology throughout the 20th and into the 21st century, when a group of men who met behind those ugly concrete walls

managed to create the most dangerous malware in existence today.

We left part one of this two-part episode with our hackers having breached the Petro-Rabe Petrochemical

plant and uploaded custom malware we now know as Triton onto its most sensitive safety systems. But the pathway that allowed

them to do that was fraught with oversights, some obvious, some less so.

Those of us from IT are used to using effective, even state-of-the-art tools on computers that are, if not

new, probably only a few years old.

We can upgrade our tech often because it's not prohibitively expensive and it's mobile.

Replacing a laptop, for example, is as easy as buying a new one and dropping your old one in the trash.

You can imagine how difficult it is to do this when your machines are 10,000 pounds and connected to a system of dozens, even hundreds of pipes, cables and other 10,000 pounds machines, all running 24-7 all year,

because critical infrastructure isn't a 9-to-5 business.

Industrial systems can live for decades because of how difficult they are to replace

and how necessary they are to the functioning of the machines connected to them.

For example, a Schneider safety instrumented system, SIS, is built to stay on for years and years non-stop. There are SISs that have been running longer

...