June 30, 2023 10:15 AM (GMT+2) - SIMON GUIOT

In this talk, we will discuss two large vulnerability research projects we did in the past few years and how they come together in the form of sophisticated OT/ICS attacks.

Project Memoria was the largest study into the security of embedded TCP/IP stacks. These stacks are used by hundreds of IT, OT and IoT vendors. We identified close to 100 vulnerabilities on popular open and closed-source implementations, leading to unauthenticated denials of service and remote code execution on many critical devices such as PLCs and RTUs.

OT:ICEFALL was a study into insecurity by design in OT. We identified 59 vulnerabilities affecting devices from 12 major OT vendors, divided into four main categories: insecure engineering protocols, weak cryptography or broken authentication schemes, insecure firmware updates and remote code execution via native functionality. Abusing insecure-by-design native capabilities of OT equipment is the preferred modus operandi of real-world ICS attackers (e.g., Industroyer2, TRITON, and INCONTROLLER).

Exploiting these vulnerabilities, attackers with network access to target devices can remotely execute code, change the logic, files or firmware of OT devices, bypass authentication, compromise credentials, cause denials of service or have a variety of operational impacts.

Putting together exploits from both projects, we show how attackers can achieve deep lateral movement – the ability to move laterally between devices at OT level 1, such as PLCs, to achieve granular control and increased impacts.

Need to do deep lateral movement at lowest level possible since upper layers are usually not developed with harmful features and lot of security ans monitoring is applied to these layers.

Demonstration (real attack scenario)

Attacking a movable bridge by trying to enforce security measures and forcing the bridge to have a self destructive behaviour :

Emergency stop when ascending at full speed

Need to bypass the Safety Modules (SIS) allowing to use bridge features without restriction.

The SIS modules monitor the bridge actions and forbid the bridge or user to input dangerous values by adjusting those values.

BUT usually it can be deactivated for maintenance purposes.

Exploiting multiple CVEs allows for deep lateral movement and deactivating SIS modules.

OT networks are vulnerable and more and more exploited in war contexts.

Whitepaper https://www.forescout.com/resources/l1-lateral-movement-report/