Via the Google and Shodan search engines, attackers quickly identified the online existence of Wilhoit's Siemens programmable-logic controller and the fake rural Missouri water-pump company he'd created. The second honeypot is a virtualized version of it running in the Amazon EC2 cloud. The first honeypot setup is a network based on physical hardware, including the Siemens Controller Simatic S7-1200 operated out of Wilhoit's St.

The honeypots, which are still in operation, each consist of a SCADA system and a server with salted documents intended to give attackers something to steal in the way of fake operational documents. and 12% from Laos, with a variety of other countries, such as Russia and the Palestinian territories, the source of targeted attacks. About one-third of the attacks came from China, 19% from the U.S. As time went by, there included 12 serious targeted attempts to shut down the water pump and five attempts to modify the pump processes - all of which would have been successful if it had been a real water system.

The existence of his ICS water-pump station mock-up, set up last November, was found by online attackers within a few days and the tampering attempts began.

Honeypot espionage