From Box to Backdoor: Discovering Just How Insecure an ICS Device is in Only 2 Weeks