SAINTCON 2026: Your Biggest Vulnerability Isn’t Yours. Lessons from a Vendor Backdoor in Critical Infrastructure
Catch Tom Pohl at SAINTCON 2026!
During a routine penetration test of a water treatment facility, our team reached a live SCADA control panel with a single click. It was exposed to the internet with no authentication. An attacker could read alarms, change setpoints and download the full configuration, including operator credentials.
When we reported it, the vendor’s fix was to tell customers to turn on authentication.
Three years later, the same backdoor is still shipping in hundreds of internet-exposed deployments. When Tom’s team went back and analyzed the code, they found 41 more vulnerabilities, including five complete attack chains. One relies on “proprietary” encryption that uses the same hardcoded key in every copy of the software.
In his talk, Tom will demonstrate all five attack chains live, then walk through one step by step. The takeaway: your biggest vulnerability may not be in code you wrote, but in vendor software running inside your network.
Your Biggest Vulnerability Isn’t Yours: Lessons from a Vendor Backdoor in Critical Infrastructure
Thursday, October 29 · 1:30–2:30 PM
Main Track 2 (Ballroom B), SAINTCON 26, Provo, UT
More Information: https://saintcon.org/schedule/1267297/
Speakers
Director of Penetration Testing
LMG Security
Tom is the Director of Penetration Testing for LMG Security, a seasoned hacker, and the winner of many hacking competitions, including Wild West Hackin’ Fest, Circle City Con, THOTCON, BSidesLV, and DEFCON. Tom is a seasoned presenter at major security conferences such as DEFCON, BSidesLV, CornCon, and SecDSM, and he has led technical training classes for many organizations. In addition, Tom also discovered several vulnerabilities that have been covered in a number of major industry publications. Prior to working for LMG, Tom was the head of software architecture at Businessolver for nearly 20 years.
