Obviously the show is a work of fiction, so a lot of liberties are taken with plot elements for the sake of good storytelling. But the reason the show is so compelling is precisely because many of the things these hackers do is technically plausible, even if their plan is too ambitious to actually succeed in real life, too complex to be carried out by only 4 or 5 people, and with too many layers to be accounted for in the time frame that the show presents.
That being said, I find the show brilliantly done because the writers did not treat the audience like idiots who don't know anything about these whiz-bang computer thingamajigs that can only be operated by socially inept nerd-wizards with their voodoo magic skillz and foreign-language techno-babble.
Here are some examples where the show got things right:
- In the pilot episode, Elliott discovers a rootkit on a compromised server during a DDoS attack on E-Corp's network, which was disguised as a startup daemon. Anyone who's ever run Windows Updates knows you have to reboot the computer afterwards. The DDoS attack was just a ruse to get E-Corp to reboot their servers so the rootkit could load. Rootkits are a real thing, and installing a startup process is a thing that real viruses do.
- Using an exploit to compromise a corporate network and steal a customer database is a common real-life occurrence. Just ask Yahoo! about their 2013 data breach where every single account -- passwords included -- was stolen.
- The commands you see Elliott typing in on various computers are real Linux commands that are used correctly in the show. In multiple scenes throughout the series, Elliott is seen using Kali Linux, which is an actual Linux distro used for penetration testing.
- When Elliott steals someone's data, he burns it onto a music CD using a program called DeepSound, which uses audio steganography to encode data into audio files. DeepSound is a real program you can download for exactly this purpose, and real-world spies have been using steganography for centuries to send hidden messages to each other.
- When touring Steel Mountain's storage facility in Season 1, Episode 5, Elliott connects a Raspberry Pi loaded with malware to their HVAC system, hiding it in an access panel in the bathroom. In the real world, HVAC systems are highly computerized, and highly vulnerable because nobody ever thinks of the air conditioner as a security-sensitive system. The real-world Stuxnet virus infected Iran's nuclear facilities in 2010. The attack vector was the PLC chips they used in their centrifuges, loaded with malware from an infected laptop.
- In Season 1, Episode 6, Elliott installed a backdoor on a police station network by leaving a malware-infected flash drive on the ground in the parking lot. A cop picked up the drive and plugged it into his computer, infecting the network. This too has been done in real life. Elliott was then able to gain access to the prison's network though malware he installed in a police cruiser's car computer, which had a dedicated 3G cellular connection to the prison systems.
There are literally dozens of examples like this throughout the series. A LOT of what they do on the show is super far-fetched, but the technology and tactics they use are all plausible enough for TV without insulting the intelligence of people who actually know stuff about computers, although people who know stuff about mental illness can get righteously indignant about the portrayal of Elliott's psychotic break, and prison officials can still laugh about hacking the cell doors open.
Even if you could real-life hack the HVAC system of the real-world Iron Mountain, and assuming you could crank up the heat without setting off an alarm in a company whose entire business model is providing a temperature- and humidity-controlled vault for companies' backup tapes, there's no way you'd be able to get it hot enough for long enough to physically damage the tapes stored there. You'd need to sustain at least 150 degrees for possibly several days to make that happen.