This article is concerned with the security issue in the state estimation problem for a networked control system (NCS). A new model of joint false data injection (FDI) attack is established wherein attacks are injected to both the remote estimator and the communication channels. Such a model is general that includes most existing FDI attack models as special cases. The joint FDI attacks are subjected to limited access and/or resource constraints, and this gives rise to a few attack scenarios to be examined one by one. Our objective is to establish the so-called insecurity conditions under which there exists an attack sequence capable of driving the estimation bias to infinity while bypassing the anomaly detector. By resorting to the generalized inverse theory, necessary and sufficient conditions are derived for the insecurity under different attack scenarios. Subsequently, easy-to-implement algorithms are proposed to generate attack sequences on insecure NCSs with respect to different attack scenarios. In particular, by using a matrix splitting technique, the constraint-induced sparsity of the attack vectors is dedicatedly investigated. Finally, several numerical examples are presented to verify the effectiveness of the proposed FDI attacks.