The Worst News of the Day
(Or How Bad Is It?)
Who is taking land, who is paying for the power and what switches on next. Free, and you can leave whenever you like.
Some 361 machines that open valves and drive pumps across America’s gas country sit wide open on the internet, taking orders from anyone who asks.
The small industrial computers keep gas pipelines running — opening valves, starting pumps, regulating pressure. They’re designed to operate deep inside private control networks. But 361 of them are exposed directly to the public internet.
Worse, they communicate using a 40-year-old industrial protocol that was never designed to authenticate who is sending a command. There is no username. No password. No built-in way to distinguish the authorized operator from a stranger. Send a valid command, and the controller executes it. To the machine, everyone looks like the operator.
Real pipeline controllers a stranger could reach on the open internet.
Passwords, PINs or locks standing between them and anyone who asks.
That reads HIGH. It has read HIGH all summer.
Small industrial computers — controllers — that physically run pipelines and gas plants. They open valves, start pumps, hold pressure. Cruise control for a pipe.
They were built to live on private, walled-off networks. These 361 answer from anywhere, the same way a public website does.
They speak Modbus, a machine language from the 1970s with no login built in. It never checks who is talking. A stranger’s command looks exactly like the operator’s.
Reading a gauge is one thing. These can be told to act — throw a valve, change a setting. That is the difference between watching the tank and emptying it.
Scan the whole country and 68,030 things answer on this one port. Strip out the traps and toys and only a hard little core is real equipment.
99 percent of what answers is decoys, junk and internet noise — including 1,368 honeypots, machines set out on purpose to look vulnerable and waste an attacker’s time. The 361 is what is left after the bait is thrown out.
Texas, Ohio, Louisiana. The exposed controllers cluster in oil-and-gas country.
Violet is oil-and-gas country, where the steel really sits. Grey states are likely inflated: the internet reports where a machine’s address is registered, not where the machine is.
One town in Louisiana sets the price the whole country trades on.
In Erath, Louisiana, sits Henry Hub — the single delivery point the entire U.S. natural-gas futures market prices against. Louisiana carries 268 of these exposed controllers, in the same Gulf Coast corridor whose meters and compressors run on this exact gear.
A faked flow reading, or a valve forced at the wrong meter, does not just move gas. It moves the number the market prices against. That is the chaos worth watching.
Violet points are the real field controllers; grey points are cloud-hosted decoys. Each sits at the location its internet address registers to — not always where the steel is. Tap a dot for its city, network and model.
Every figure here is a public internet scan, dated and repeatable. The Big Drop only watches what is already public — it never touches, probes or logs into anyone’s machine, and no single device is named. The 361 is an estimate built from a confirmed sample, so read it as “a few hundred,” not an exact census. Being reachable is not the same as being attacked. It is the same as leaving the door unlocked. Snapshot 2026-08-31.
Good choice…
I’ll be in touch as soon as I can.
