00:00:00.000-->00:00:05.000
>>Alright good morning. My name
is Patrick DeSantis, this is my
first time at Def Con. Uh, well

00:00:08.458-->00:00:14.292
my first time speaking at Def
Con, so it’s pretty awesome. Uh
thank you all for coming out.

00:00:14.292-->00:00:19.292
Um, I’m gonna talk about uh
finding back doors on embedded
devices using, ya know pretty

00:00:21.750-->00:00:26.750
common uh not very sophisticated
techniques. Um, so the talk is,
From Box to Backdoor. So I work

00:00:31.458-->00:00:36.458
at Talos and over at Talos we
built a, uh automated kegerator.
Using industrial control systems

00:00:41.125-->00:00:46.125
components. Um, on the screen
there you’ve got, on the left an
Allen Bradley programmable logic

00:00:49.167-->00:00:56.167
controller and on the right, is
a Moxa wireless access point. So
they had the very critical

00:00:56.167-->00:01:01.167
function of pouring beer for us.
So we’ve got automated beer
pouring and the whole point of

00:01:06.625-->00:01:12.417
putting this together was of
course so we could hack it. Um,
because we were going to hack it

00:01:12.417-->00:01:16.750
and figure we’ve got to take a
look at the devices in there.
And see if we can knock off any

00:01:16.750-->00:01:21.750
low hanging fruit. So this is
kind of a story uh, narrative of
just 1 person’s thoughts

00:01:24.250-->00:01:30.417
process, walking through uh
beating the s**t out of 2 very
expensive uh, low ends embedded

00:01:30.417-->00:01:36.500
devices. So the first 1 want
take a look like is the Moxa,
it’s a wireless access point.

00:01:36.500-->00:01:41.500
Um, ya know the, the, the 2 long
didn’t read is it’s just an
802.11 wireless access point and

00:01:43.583-->00:01:49.333
about uh, th- ya know $1000
enclosure but it’s really like a
$40 uh, ya know router that you

00:01:49.333-->00:01:54.333
would have at home. It did rail
mountable. It’s uh marketed as,
as being uh used for your

00:01:57.750-->00:02:04.042
automated guided vehicles and
automated storage retrieval
systems. So these are uh

00:02:04.042-->00:02:09.292
creating ya know mesh networks
on vehicles in like warehouse.
Uh doing a little google you’ll

00:02:09.292-->00:02:14.292
find out that they’re also used
on trains. Which is kind of
scary. Um, ours of course, is,

00:02:16.458-->00:02:21.458
is there to pour beer. Uh and
also it’s unbreakable. Which we
all know [laughter] sure. And i-

00:02:26.292-->00:02:32.333
it took about 5 minutes to know
it was really it. So, ya know
hitting this thing uh, you start

00:02:32.333-->00:02:38.458
out with eh- scanning and doing
your enumeration and walking
through and everything but the

00:02:38.458-->00:02:43.083
device itself was so limited
that it actually made testing
more difficult because every

00:02:43.083-->00:02:48.083
time you scan it, it’s a DOS It
constantly crashes, constantly.
Ya know, like you want a fuzz.

00:02:50.542-->00:02:55.542
Literally sending Get A causes a
psych fault on the web server.
[laughter] So, it’s like how the

00:03:00.500-->00:03:04.708
hell do you fuzz that? It uh you
can’t send anything that doesn’t
s-, if it doesn’t start with a

00:03:04.708-->00:03:09.792
slash, psych fault. It, and from
the outside doing black box
testing I don’t know this is

00:03:09.792-->00:03:13.667
psych fault, ya know I just know
the web server stopped working.
So, I gotta reboot the device.

00:03:13.667-->00:03:18.917
Uh, there is also no OS access,
we have this ya know very
limited shell. Almost all the

00:03:18.917-->00:03:24.208
configuration is done through
the web application so this
isn’t even a very functional

00:03:24.208-->00:03:29.208
shell. Um, so take a look at the
firmware. Uh, it l- hit it with
binwalk, got no results. Look at

00:03:34.875-->00:03:39.875
strings, not very promising for
strings. So, do some entropy
analysis, binwalk fee- uh future

00:03:43.292-->00:03:47.667
binwalk to look at the entropy
of the actual uh binary file.
Looks like it’s probably

00:03:47.667-->00:03:51.583
encrypted. So we’re not gonna
get anywhere looking at the
firmware, we’ve gotta, even

00:03:51.583-->00:03:54.708
though the device is limited and
it constantly crashes we’ve
gotta go back and hit the

00:03:54.708-->00:03:58.917
device. And these are the
services that we have available
to us. We have ssh and telnet,

00:03:58.917-->00:04:04.042
uh both of us, both of those are
going to drop us into that
limited shell. We have Web and

00:04:04.042-->00:04:09.083
then there’s a Moxa supporter
call uh that’s used for
configuration and it’s a whole,

00:04:09.083-->00:04:13.000
that’s a whole can of worms that
could be about 2 or 3 talks by
itself. So I’m not even going to

00:04:13.000-->00:04:17.750
go into that. We’re just gonna
look at the other stuff. So
taking the uh, ya know the the

00:04:17.750-->00:04:24.042
web app is probably the lowest
hanging fruit on there. The,
right from the the very first

00:04:24.042-->00:04:29.708
thing I see at the login page is
the, the username is read-on uh
read-only you can’t edit the

00:04:29.708-->00:04:34.708
user name, which doesn’t make a
lot of sense. Um, h- so is there
eh eh they have a point, is

00:04:37.250-->00:04:42.000
there even a user? If there’s
only 1 user there’s effectively
zero users. On the password

00:04:42.000-->00:04:45.542
field was had a very short max
length I think it might have
been 12 characters. I’m like

00:04:45.542-->00:04:50.875
okay this is not gonna go very
well for the, for this device.
Um but the looking at what it

00:04:50.875-->00:04:55.875
actually sent. [laughter] So
this is the post. It, th- the
whole session is based on the

00:05:02.792-->00:05:07.792
value in the cookie. The post
data, it d- you can put anything
you want on there. It does not

00:05:07.792-->00:05:14.708
matter. Uh, passwords not being
sent in the clear, which is
good. Cause there’s no password

00:05:14.708-->00:05:20.333
being sent. But the only thing
that’s, it’s choosing for
authentication is the uh, the

00:05:20.333-->00:05:25.375
session token in the, the
cookie. Later on after we pull
the binaries off the device,

00:05:25.375-->00:05:30.333
throw in a IDA we’ll find out
that admin user. And it is
hardcoded. Um, it is the only

00:05:30.333-->00:05:35.708
user and it’s right there in the
binaries so you can’t even
change that. So you’ve got you

00:05:35.708-->00:05:39.500
know your username, password,
well there’s only one username
so all you have to do is know

00:05:39.500-->00:05:44.500
the password. As part of
authentication um, eh- the
webserver itself passes the CU

00:05:48.167-->00:05:53.167
uh, a nonce, a number used once.
Um, supposed to be used once. In
this screen we see that we’re

00:05:55.917-->00:06:00.542
passing the time to try and add
some randomness, actually that
doesn’t mean anything. You can’t

00:06:00.542-->00:06:05.125
put anything you want in time
and you’re going to get the same
non-spec. So I don’t know why

00:06:05.125-->00:06:10.958
it’s passing that. IT’s
completely irrelevant, uh and,
and in fact uh it it’s not a

00:06:10.958-->00:06:15.958
number used once. It’s a number
used over and over and over, and
over. And so quick script to uh

00:06:18.875-->00:06:25.500
generate cookies based off of
uh, it’s just password,
concatenate the nonce, uh md4

00:06:25.500-->00:06:32.167
hash. That’s the, the session
value and if we hit the web
server with any type of request

00:06:32.167-->00:06:37.167
it’ll at least once every 5
minutes our nonce will never
change. Um, so the, the first I

00:06:39.750-->00:06:45.375
don’t know 7 or so up there are
all the same, it’s every minute
and then I skipped it to 10

00:06:45.375-->00:06:49.250
minutes so you can see the last
3 are actually different nonces.
So is, if you’re running this

00:06:49.250-->00:06:56.167
script then the nonce will never
change. We only have one user.
Uh and it’s not using the

00:06:56.167-->00:07:02.292
password for authentication so
essentially there’s only one
valid session token at a time

00:07:02.292-->00:07:07.292
and it will never change as long
as the device doesn’t go to
idle. So, can we steal that

00:07:09.375-->00:07:14.375
session token? Probably. I
probably wouldn’t be here if we
couldn’t. Uh, so, we start out

00:07:17.500-->00:07:21.125
with ya know, everybody’s
favorite lame web app up
vulnerability, cross site

00:07:21.125-->00:07:25.917
scripting. Um there were a lot
of cross site scripting
vulnerabilities in this web

00:07:25.917-->00:07:31.458
application. But what good is
cross site scripting if you only
have reflective cross site

00:07:31.458-->00:07:34.625
scripting? I hear a lot of
people say things like, th- oh
ya know that’s great you can

00:07:34.625-->00:07:40.292
hack yourself, um but there
should be a lot more respect for
reflective cross site scripting

00:07:40.292-->00:07:45.292
when it’s used um, in web
applications that’ll, do not
lock down that session token. In

00:07:48.125-->00:07:54.833
this case we can embed this in
something like an iframe or an
html in an email. If it’s viewed

00:07:54.833-->00:08:01.083
by somebody who has a valid
session or who has a, a cookie
with a valid session token then

00:08:01.083-->00:08:06.833
it actually passes back that
session token to us. So we’ve
got netcat listener. Somebody

00:08:06.833-->00:08:13.250
opens up ya know, an email or a
webpage, whatever, with our uh
cross site scripting code and we

00:08:13.250-->00:08:19.375
get that valid session token.
Which is all we need to
authenticate. So we have the

00:08:19.375-->00:08:23.958
username it’s hardcoded. The
nonce, we froze it, we stole the
cookie. We can crack the

00:08:23.958-->00:08:29.833
password now, but we don’t’ need
to. Uh, because the nonce isn’t’
changing so our session token

00:08:29.833-->00:08:34.833
will never become invalid unless
the device goes idle or gets
reset. So, we’re logged in.

00:08:37.083-->00:08:42.083
We’ve got that session token.
Uh, once you, ya know, anybody’s
ever done any web app testing

00:08:44.167-->00:08:48.208
before if you’ve looked at
network devices th- this you
probably start drooling when you

00:08:48.208-->00:08:53.917
see this. But, eh- actually
doing some kind of injection in
the ping form on a web app that

00:08:53.917-->00:08:58.708
hasn’t worked ya know in 15
years, right? When is the last
time you just put something in

00:08:58.708-->00:09:03.708
there without any kind of
authentication and got a result?
Serious. [laughter] That was

00:09:08.417-->00:09:13.417
horrible. [applause] So we don’t
have legitimate OS access. But
this busybox, we have command

00:09:20.083-->00:09:25.083
injection, we can bind telnet to
a port and have busybox pass the
shell out to uh, your, so if we

00:09:33.208-->00:09:38.208
have root shell through OS
command injection So, no longer
limited to that uh basic command

00:09:41.917-->00:09:47.708
line interface. No longer
limited by the web app. Full
root there. Uh another way that

00:09:47.708-->00:09:52.708
we could’ve gotten access uh
cross site request forgery. Um,
this form does the same thing as

00:09:56.917-->00:10:01.917
this. And it will auto submit,
so kind of similar to the cross
site scripting if an admin or

00:10:04.000-->00:10:09.208
somebody who has logged in uh
has a valid session in their
browser or valid session token

00:10:09.208-->00:10:14.208
in the browsers, uh cookies. If
you use this page with this
code, this html, um if java

00:10:16.708-->00:10:20.458
scripts enabled it will
automatically, auto submit and
it will open up backdoor for us.

00:10:20.458-->00:10:27.250
Uh netstat, on the top before,
netstat on the bottom after we
can see that, that it’s listing

00:10:27.250-->00:10:34.042
on port 9-9-9-9. So all we have
to do is connect to it. Um there
were, ya know. So we’ve got from

00:10:34.042-->00:10:39.708
the very beginning, freezing the
nonce. To have a permanent
session or a never expiring

00:10:39.708-->00:10:42.917
session and then 2 different
ways to get our command
injection either through cross

00:10:42.917-->00:10:49.250
site request forget or us cross
site scripting. Um and then that
gives us our root shell. So

00:10:49.250-->00:10:54.250
we’re on the box smash and grab,
steal everything. These are all
uh, nips binaries which makes a

00:10:58.958-->00:11:05.750
little tougher to work with but
um you can drop them in IDA and
have all sorts of fun with them.

00:11:05.750-->00:11:10.458
Anybody out there wants to go to
town with these, I only spent 2
weeks total looking at this. So

00:11:10.458-->00:11:15.583
there’s a lot of stuff still
there that I never hit. Um ya
know get with me after and we

00:11:15.583-->00:11:20.583
can talk about it. Get a lot of
CDs out of this if you want to
poke at ‘em. So the talk is

00:11:22.625-->00:11:26.917
about backdoors. Where is the
backdoor. We have command
injection, we have root access,

00:11:26.917-->00:11:31.083
but there is an actual back door
account on here if you take a
look at the accounts that are

00:11:31.083-->00:11:37.792
listed. Um ya know I went
through all these and found that
there is o- only one that is not

00:11:37.792-->00:11:42.792
uh either disabled or has an
invalid um, shell listed and
it’s this 94j whatever user. The

00:11:46.958-->00:11:51.958
password hash uh, you can
decrypt it and it’s just moxaiw
and that doesn’t work. So using

00:11:55.333-->00:12:00.833
the access we have on the device
doing things like grepping
memory because everything in

00:12:00.833-->00:12:05.833
Linux is a file you can ya know
grep through memory. You find
the moxaiw string, um with the

00:12:09.417-->00:12:14.417
percent S. So the, uh format
string and it’s around commands
like change password or create

00:12:17.917-->00:12:22.917
user. Thinking that maybe this
was like really easy try moxaiw
percent S as the password. Uh,

00:12:26.875-->00:12:33.250
it does not work which didn’t
think it would but I wouldn’t
really be surprised if it did.

00:12:33.250-->00:12:39.958
Um, so you, looking at the
binaries that we grabbed when
we, ya know smash and grab, grab

00:12:39.958-->00:12:44.958
all the binaries. Dropped a
couple in IDA, this one ya know,
t- to make it easy to see we

00:12:49.750-->00:12:53.250
know the root password, or we
know the admin password is root
because that’s the default

00:12:53.250-->00:12:58.250
password. So it’s setting the
admin password to root and then
it is setting this backdoor

00:13:05.875-->00:13:10.875
compass to moxaiw and whatever
value is being held in var 120.
Which it is root because it

00:13:13.208-->00:13:18.792
never changed after the admin
password was set. So the
backdoor password is moxaiw

00:13:18.792-->00:13:23.458
root, it’s hardcoded, it's an
initialization binary and it
runs every time we turn the

00:13:23.458-->00:13:29.958
device on. So even if you delete
that user once the device is
rebooted uh the user is back. So

00:13:29.958-->00:13:35.875
now we have uh root shell with
an account we don’t’ have to
exploit it anymore. Um, full

00:13:35.875-->00:13:40.875
operation system backdoor access
to the device. What do we do
with it? We already have root.

00:13:45.375-->00:13:50.792
What else is there? Uh there’ s
a lot of binaries on this
system, we can ya know mess

00:13:50.792-->00:13:56.708
around with it, uh you’ve got
things you can do with like uh
IP tables and tunnels and steal

00:13:56.708-->00:14:02.375
traffic, you can put kernel
modules in there if you want.
Um, but I really just wanna

00:14:02.375-->00:14:07.792
brick the thing. [laughter] Ya
know. S- It’s all, it’s all I’m
interested in. So I, eh, very

00:14:07.792-->00:14:12.792
easy soft brick. We have root,
kill all 5. It kills all the
processes. Except the 1 from

00:14:14.833-->00:14:20.042
which you ran kill all 5. Um and
you can do things like mount and
unmount various file systems in

00:14:20.042-->00:14:25.542
the file system. They’re already
only except for one so, u once
the device reboots it’s right

00:14:25.542-->00:14:32.417
back to normal. Um, soft bricks
are fun but they’re not as fun
as firm bricks are hard bricks.

00:14:32.417-->00:14:38.042
So I don’t know how I did this.
I was trying to brick it and I
bricked it but I didn’t expect

00:14:38.042-->00:14:43.042
it to brick when I did what I
did. So there’s a, a, a seten, I
don’t know what this firmware

00:14:46.250-->00:14:50.375
seten environment a binary is
supposed to do, I was f**kin
around with it, I was passing

00:14:50.375-->00:14:56.458
different options to it. And
then I did a, a mount remount
and I rebooted and that was the

00:14:56.458-->00:15:01.458
last time I ever saw that
device. So that one's done. Uh I
only have 2 of those and I

00:15:05.000-->00:15:08.917
didn’t want to brick the other
one because it’s pouring the
beer. So I’ll probably never

00:15:08.917-->00:15:13.917
know what really happened. But
we’ve got uh 13 CDs on that and
like I said, we, we spent 2

00:15:16.833-->00:15:21.208
weeks total on it. Most of the
time was uh trying to figure out
what was wrong. Didn’t even look

00:15:21.208-->00:15:26.208
at the wireless stuff and that’s
the whole point of the device.
So um, when the patch came out

00:15:28.292-->00:15:31.750
for the device and we went
through the whole responsible
disclosure process. Patch comes

00:15:31.750-->00:15:35.208
out, apply the patch, first
thing I do is try to log in with
the backdoor and it logs me

00:15:35.208-->00:15:38.708
right in. It’s like, what the,
they didn’t even patch the one
think like the, the most

00:15:38.708-->00:15:43.917
important thing. And then
looking at their, they have
their SVN uh notes in here.

00:15:43.917-->00:15:50.708
Naturally it calls out Cisco
Talos um in the, ya know in
their, their SVN notes. But they

00:15:50.708-->00:15:54.292
didn’t patch the vulnerability
that we disclosed. So we waited
a couple weeks and they put out

00:15:54.292-->00:15:59.292
another patch and they actually
fixed the backdoor so the
backdoor isn’t there anymore. Um

00:15:59.292-->00:16:05.042
well it may be, it’s not there
in the way that you can't just
log in the way that ya know. I-

00:16:05.042-->00:16:08.417
I- I’m pretty sure it’s still
there and you can probably
enable it but [laughter] ya

00:16:08.417-->00:16:12.833
know. I tried to log in and it
didn’t let me. That’s, that’s
all I wanna know I don’t want

00:16:12.833-->00:16:17.167
know anymore. I’m moving on to
something else. So let’s hit the
PLC. Uh programmable logic

00:16:17.167-->00:16:23.333
controller, these, if you’re not
familiar with PLCs they’re, ya-
computers that are the boundary

00:16:23.333-->00:16:29.917
between uh the physical world
and your TCP IP network
generally. Uh, that’s an

00:16:29.917-->00:16:34.000
oversimplification and it’s
wrong on like 5 different levels
but for what we’re doing that’s

00:16:34.000-->00:16:38.750
how it works. Uh they have, ya
know they have inputs and they
have outputs and those inputs

00:16:38.750-->00:16:42.125
and outputs they come the
censors and they go to
actuators. So this is what’s

00:16:42.125-->00:16:47.875
controlling our actuators on the
kegerator that’s opening and
closing the tap. Um, though we

00:16:47.875-->00:16:52.083
chose the MicroLogix 1400
because it has inputs and
outputs already in it. You don’t

00:16:52.083-->00:16:57.458
have to buy extra modules so
it’s popular generally because
it's affordable and it has

00:16:57.458-->00:17:02.833
everything built in. It’s got a
Ethernet so you can put it right
on your s- your network, uh you

00:17:02.833-->00:17:09.042
don’t have to buy separate
Ethernet module and it has I/O.
Um, this is what MicroLogix,

00:17:09.042-->00:17:16.625
Allen Bradley, uh Rockwell this
is what they advertise its use.
Um it’s not used in like big

00:17:16.625-->00:17:23.500
SCADA systems but uh some
smaller, smaller SCADA systems.
Micro SCADA systems they call

00:17:23.500-->00:17:28.125
it. Um, we’re gonna hit the
firmware just like the last one
but there isn’t really much

00:17:28.125-->00:17:33.708
going on that we can see.
There’s strings. Can’t really
get a lot out of them. You can

00:17:33.708-->00:17:40.875
see there's some actual text in
there but it’s probably um
probably compressed. And hitting

00:17:40.875-->00:17:45.708
it with binwalk uh, you can see
the addresses, it jumps
essentially right to um, about

00:17:45.708-->00:17:53.583
eh- th- uh what is that 160-->000
hex 160-->000. And it’s all web
files. And all the HTML files

00:17:53.583-->00:17:57.292
and JavaScript and everything
are there. They’re not
encrypted. They’re not

00:17:57.292-->00:18:01.292
compressed. They’re just plain
text. But there’s a whole
section of firmware that binwalk

00:18:01.292-->00:18:09.292
didn’t give any results for. Uh
the first ya know 160-->000 uh hex
bytes there. So if we look for

00:18:09.292-->00:18:14.500
opcodes it’s gonna tell us it’s
ColdFire processor, which open
it up and take a look. It’s

00:18:14.500-->00:18:19.250
actually a ColdFire processor so
that’s good to know. Um, and
here’s our entropy analysis for

00:18:19.250-->00:18:25.167
the firmware file. So, I think
the first half or the first
third of it or so is compressed

00:18:25.167-->00:18:29.875
code and then there seems to be
some data structures, some, some
tables. And then the last part

00:18:29.875-->00:18:38.750
of it is just raw html
JavaScript CSS. Um, I, I,
pointed out SNMP separate here

00:18:38.750-->00:18:46.083
first and anybody who does pen
testing or, or, or security
assessments like do not forget

00:18:46.083-->00:18:51.375
about UDP. Uh, I cannot count
the number of times SNMP has,
has given me more than, than I

00:18:51.375-->00:19:01.208
could have hoped for. And it
turns out this is one of those
times. Um, so you’ve got your

00:19:01.208-->00:19:07.625
basic OID, your basic MIB when
you run uh SNMP enumeration
tool. It’s gonna go through

00:19:07.625-->00:19:13.167
kinda the d- defaults. A lot of
people stop there, don’t stop
there find the vendor's MIB,

00:19:13.167-->00:19:23.333
find their um, their OIDs. Each
vendor has 1 or more. In this
case uh this ISO 3, 6,1, 4, 1,

00:19:23.333-->00:19:30.083
9, 5, 1, 3, 0 uh that is Allen
Brad- one of Allen Bradley’s. So
you can find it here using just

00:19:30.083-->00:19:35.333
the public community string or
you can do google search and
look for uh Allen Bradley MIB

00:19:35.333-->00:19:40.917
and you’ll find that uh, off the
i- you can just get it off the
internet as well. So if you do

00:19:40.917-->00:19:48.667
this SNMP walk on that MIB
instead of on the defaults. So
you add the 1, 3, 6, 1, 4, 1, 9,

00:19:48.667-->00:19:55.500
5 i- it’ll start walking those
OIDs. And something stands out
to me on the bottom of this I

00:19:55.500-->00:20:01.625
see public and private which are
default SNMP community strings
but there is another word there

00:20:01.625-->00:20:09.917
and it’s wheel. What the hell is
wheel? I don’t know. Well let’s
try it. Let’s see what it does.

00:20:09.917-->00:20:21.958
It’s, I can read with it, so I
SNMPwalk community wheel version
and then the IP address. So,

00:20:21.958-->00:20:28.833
example of using the private
community string to set uh, a
value to hacker and then using

00:20:28.833-->00:20:36.708
wheel to set it to uber hacker.
So, wheel is a privileged
undocumented SNMP community

00:20:36.708-->00:20:41.708
string. So even if you’re
looking to lock down the device
you want to change the defaults.

00:20:41.708-->00:20:48.000
There’s one there that you don’t
know about. Uh it makes it hard
to change uh something that if

00:20:48.000-->00:20:53.792
you, you don’t know it's there.
And n- nobodies scanning their
devices, their, ya know running

00:20:53.792-->00:21:02.625
SNMPwalk on their own devices to
uh, this is an example of a
firmware update. SNMP is used to

00:21:02.625-->00:21:10.667
update the firmware on these
devices. So, you, SNMP sets a
value for the path the TFTP path

00:21:10.667-->00:21:18.125
where the file is, the firmware
file. Um, it sets uh IP address
for t- the TFTP server and then

00:21:18.125-->00:21:25.292
it unloads another value, it
essentially change it from 1 to
2. Which initiates um the TFTP

00:21:25.292-->00:21:32.125
transfer. So, if you can talk to
the device and SNMP is enabled
you can modify the firmware.

00:21:32.125-->00:21:37.000
Like, first give, give it your
IP. Ya know you have to set up a
TFTP server, put the firmware

00:21:37.000-->00:21:45.750
on, give it your IP give it the
file name. Hit, ya know send to,
and uh it will start flashing.

00:21:45.750-->00:21:50.542
So it reaches out, it grabs the
firmware, it checks it to make
sure it, it’s uh valid or ya

00:21:50.542-->00:21:57.042
know has it’s integrity check
and if it it passes that then it
actually flashes the firmware to

00:21:57.042-->00:22:08.333
the device. So how’s it checking
to make sure that, that firmware
is actually valid? So they using

00:22:08.333-->00:22:14.833
checksums. Checksums are very
easy to get around. They’re not
used. They shouldn’t be used in

00:22:14.833-->00:22:23.625
place of things like signing.
They should only be used to
validate that, what something ya

00:22:23.625-->00:22:29.167
know like, what I sent to you is
what you received. Not that what
I sent to you is not malicious

00:22:29.167-->00:22:35.125
or is what ya know I created.
Um, there are a lot of ways
around checksums. There are a

00:22:35.125-->00:22:43.875
couple very easy ways just swap
some bytes. As long as the end
result uh i- is what, ya know

00:22:43.875-->00:22:51.500
zero sum. So 1, 2, 3, 4 is the
same as 3, 4, 1, 2 or 4, 2, 4, 2
is the same as 4, 1, 4, 3 you go

00:22:51.500-->00:22:56.875
down 1 and up 1. As long as the,
the math works out the same, it
doesn’t matter what the bytes

00:22:56.875-->00:23:06.375
are. So, something as simple as
um, this changing 6e 6f to 6f
6e, just essentially swipping or

00:23:06.375-->00:23:13.583
swapping ASKI N-O to O-N, uh for
1 of the files on the web
server. And then visiting

00:23:13.583-->00:23:22.250
O-N-T-F-I instead of N-O, it
actually tried to uh, pull that
page. That page doesn’t exist so

00:23:22.250-->00:23:28.000
once you authenticate you get a
server error but it shows that
we just modified firmware and

00:23:28.000-->00:23:37.083
flashed the device with our own
modified firmware. Very basic
example of it. Um, but it’s the

00:23:37.083-->00:23:43.750
first step in uh, a better proof
of concept. So take it to the
next step. Uh, instead of just

00:23:43.750-->00:23:50.500
flipping some bytes let’s
actually change some uh, we’ll
stop ri- ya know, we won’t

00:23:50.500-->00:23:57.292
change code yet, we’ll change uh
some text. So here, changed the
word remote to hacked. And then

00:23:57.292-->00:24:05.917
made the uh, compensating
changes, gonna see, from uh 4-4
to 7-0. To make the math work

00:24:05.917-->00:24:12.958
out right for the checksum. And
then flashed the device and
reboot and it comes up with our

00:24:12.958-->00:24:17.625
new firmware so we are modifying
the firmware on this. Th- the
screen I showed you that showed

00:24:17.625-->00:24:22.583
the breakdown of the firmware.
The first part of it is
compressed. We can go in there

00:24:22.583-->00:24:27.292
and change the instructions the
ColdFire instructions. The
device will take our modified

00:24:27.292-->00:24:34.042
ColdFire instructions. Uh, it w-
will take that that firmware. It
will flash it, it will reboot

00:24:34.042-->00:24:41.208
and there’s another check going
on there that if it doesn’t in
some way execute properly it

00:24:41.208-->00:24:47.917
just reboots again and looks for
the firmware again and downloads
it and flashes it and it kind of

00:24:47.917-->00:24:54.958
gets stuck in a loop there. So,
modifying the actual uh code as
far as uh like executable code

00:24:54.958-->00:25:02.250
takes a little bit more work but
most of this stuff was straight
up web pages anyway. Um, you can

00:25:02.250-->00:25:08.708
put anything you want here. It’s
uncompressed, no encryption. Um,
modify th-the entire web server

00:25:08.708-->00:25:13.750
whoever you want and then just
flash it. That’s really not fun
though so [laughter]. Let’s,

00:25:13.750-->00:25:24.708
let’s get rid of this thing. So
taking a look at the very
beginning of the firmware this

00:25:24.708-->00:25:29.125
is the heDER. Uh it has a
structure to it. Got all the
structure figured out but the

00:25:29.125-->00:25:35.458
only thing that’s important for
this part is the start of it. Uh
it is a ColdFire instruction to

00:25:35.458-->00:25:42.583
jump to uh offset 40,150 bytes
in which is where the actual
code starts. So it jumps over

00:25:42.583-->00:25:50.125
the header. Uh let’s change that
to ya know jump to yourself. Uh
try and create a little bit of a

00:25:50.125-->00:25:54.375
loop. And because we’re using
checksums um I don’t even gotta
know what the checksum is, I

00:25:54.375-->00:26:05.333
just, it was 150 and then make
it zero, zero. And then take
that 1 and put it in 51 and then

00:26:05.333-->00:26:11.292
add 50 to the 54 to get a 4. I
don’t give a s**t what those
bytes are cause we’re just gonna

00:26:11.292-->00:26:17.625
loop and jump to our self
anyway. So we’ve got a soft
brick here. The device flashes

00:26:17.625-->00:26:26.292
itself. It gets stuck in this
loop. Um, give me the firmware.
Is it valid? Yes, flash, reboot.

00:26:26.292-->00:26:32.208
Oh s**t, is there any firmware
out there at the same, same
TFTP? You don’t have to re-do

00:26:32.208-->00:26:36.417
all that. It looks at the same
IP address, same file name. Is
there a firmware there? Yes.

00:26:36.417-->00:26:44.167
Download it or TFTP transfer it.
Flash, reboot, oh s**t, is
there, yeah. So I let this go on

00:26:44.167-->00:26:52.125
for a while, say, hey maybe it
will break. It just keeps going.
Yo- you can disconnect from the

00:26:52.125-->00:26:58.417
network, come back later and
it’s still trying to get the
firmware file from the TFTP

00:26:58.417-->00:27:04.250
server. So it's, as l- if, if
there’s if there’s a TFTP server
at that IP address with the file

00:27:04.250-->00:27:10.875
that it's looking for it’s gonna
pull it. And then it’s just
gonna keep going. Um, if you

00:27:10.875-->00:27:16.292
take the TFTP server down or
block network traffic then y-
you can recover from the brick

00:27:16.292-->00:27:23.458
at that point. So let’s go a
little bit more a** kicking
here. Let’s break it. Tried some

00:27:23.458-->00:27:32.083
like, ya know cool stuff. Uh
call it elegant. Didn’t really
work so, I just kind of said

00:27:32.083-->00:27:41.208
[laughter]. I went in to the uh,
ya know w- what looks like a, a,
a structure table. It looked

00:27:41.208-->00:27:49.083
like addresses. I don’t really
know what they were. I don’t
care what they were. Just move

00:27:49.083-->00:27:55.458
some bytes around. This is,
randomly picking bytes and then
moving them somewhere else.

00:27:55.458-->00:28:12.708
Nothing more advanced than.
[laughter] So we get FGPA
corrupt and I was like f**k

00:28:12.708-->00:28:20.125
yeah. [laughter] And then I
googled it. Like ah. So it’s
actually in the manual. When

00:28:20.125-->00:28:26.875
that happens. Yeah, y- it will
fix itself once. It doesn’t say
that in the manual. I don’t know

00:28:26.875-->00:28:35.292
if ya know, if there’s anyone
from Rockwell or Allen Bradley
in here. Talk to me later. Um I

00:28:35.292-->00:28:40.417
don’t know if it, if it was
tested for the once. Like i- you
tested it once and it worked so

00:28:40.417-->00:28:50.958
you pushed out. I tested it
twice and the exact same thing
twice. It was done, forever. I

00:28:50.958-->00:28:59.542
said, oh s**t. D- wh- like, I
need to confirm this, I need to
validate it. Boss, buy me a new

00:28:59.542-->00:29:13.667
PLC please. Okay. PLC gets in. 5
minutes later, bricked. So. The
one on the kegerator though is

00:29:13.667-->00:29:27.083
still, still working just fine.
[laughter] As long. It’s okay.
[applause] Everybody loves

00:29:27.083-->00:29:38.417
SHODAN right? And nobody puts
PLC’s on the internet. Except
these 1,158 people that nobody

00:29:38.417-->00:29:44.250
has the current firmware
version. Current firmware
version is 21 previous version

00:29:44.250-->00:29:49.333
before that was 16, version
before that there was a series
of 15’s. Uh the newest one out

00:29:49.333-->00:29:58.583
there, there are some 16’s there
are a bunch of 15’s and they go
all the way down to 1. There’s a

00:29:58.583-->00:30:06.167
couple 3’s and some 4’s. A whole
bunch of 5’s. I don’t wanna know
what the hell these are hooked

00:30:06.167-->00:30:11.583
up too. Like, a lot of them were
on, uh wireless. Like Verizon
wireless is the network they

00:30:11.583-->00:30:17.375
were on. I can just imagine
they’re out there somewhere. Out
in the field with like a MIFI or

00:30:17.375-->00:30:31.667
something. And uh and they have
their own IP address. So,
[laughter] somebody fix this.

00:30:31.667-->00:30:40.458
[laughter] So we have a firm
brick but what about a hard
brick? S- I am not an engineer.

00:30:40.458-->00:30:52.167
I’m not an electrician. But I
will tell you, do not f**k with
electricity. Bad things happen.

00:30:52.167-->00:30:59.583
I’m not gonna tell you what I
did. [laughter] It was pretty
stupid. But I knew what I did as

00:30:59.583-->00:31:04.708
soon as I did it. Cause you
heard the pop and I smelled it.
And I Looked around. Does

00:31:04.708-->00:31:12.500
anybody see? Anybody hear? It’s
kinda s**t, it stinks. I tried
to fix it. It’s a fuse I bought

00:31:12.500-->00:31:18.042
some more fuses. Replaced it. Uh
I think I butchered it when I
soldered it. It never came back.

00:31:18.042-->00:31:37.208
So we, I did not hack the hard
brick. It was dumb a**ery that
did it. So, that is, ya know the

00:31:37.208-->00:31:42.083
bro- those are my PLC’s by the
way, um. If anybody wants one. I
actually fixed the, the hard

00:31:42.083-->00:31:49.625
brick. Uh by replacing the logic
board in the one that I blew up
with the logic board from uh. I

00:31:49.625-->00:31:56.500
took the good logic board out of
the hard brick and put it in one
of the firm bricks and got a

00:31:56.500-->00:32:02.083
working PL out of it. So that
was kind of interesting. Um but
the oth- the other 2 are just. I

00:32:02.083-->00:32:07.458
don’t know how to recover them.
I’ve s-, there’s a serial port
on it and I’ve tried to hook up

00:32:07.458-->00:32:11.458
and see if there’s any kind of
serial console we can get to.
Can anyone from Rockwell or

00:32:11.458-->00:32:17.458
Allen Bradley want to help me
fix these? Uh, I would be happy
to share with the world how we

00:32:17.458-->00:32:25.167
fixed them. Uh, also I do need
to point out, um I had it on one
of my slides back here. I’m not

00:32:25.167-->00:32:33.583
going to roll all the way back.
But the newest version of
firmware for the MicroLogix PLCs

00:32:33.583-->00:32:37.542
may do cryptographic firmware
signing. I say maybe because I
haven’t tested it. They have a

00:32:37.542-->00:32:41.458
new hardware version out there,
series C. I don’t have a series
C PLC to test on. So, I can’t

00:32:41.458-->00:32:46.500
say that this, you know it
doesn’t work anymore. You can’t
push your own firmware out to

00:32:46.500-->00:32:51.417
it, I can’t say that. Again
anybody from Rockwell or Allen
Bradley give me a series C PLC

00:32:51.417-->00:32:56.917
and I’ll be happy to test it
out. Um, and then let everybody
know that, hey I couldn’t do

00:32:56.917-->00:33:03.458
this or ya know or I could. But
I want to say thank you to Talos
for uh paying for me to be here

00:33:03.458-->00:33:08.583
and letting me do this on the
clock. And all the beer that was
involved cause testing, when

00:33:08.583-->00:33:13.792
you’re on a kegerator you’ve
gotta. The whole point of the
kegerator is beer so every time

00:33:13.792-->00:33:18.375
we test you have to validate
that it still works that it
still pours beer. And then when

00:33:18.375-->00:33:24.208
it pours beer. Is the beer still
good. Because the beer can go
bad. I also want to thank Moxa.

00:33:24.208-->00:33:29.708
They were really cooperative
with share GPL source code which
can be uh, uh a nightmare for

00:33:29.708-->00:33:34.375
some people. Finding a, an
organization that actually
responds to a request for GPL

00:33:34.375-->00:33:40.042
source code is rare. And ya know
they responded and they shared
in a reasonably amount of time.

00:33:40.042-->00:33:43.625
So I’ve got to give them a shout
out for that. And to Rockwell
for working with us on the

00:33:43.625-->00:33:46.875
coordinated disclosure. Um, and
anybody from Rockwell or Allen
Bradley out there, ya know come

00:33:46.875-->00:33:56.167
find me later. I to uh, I want
some more PLCs. [laughter]
Please. So, I, I have enough

00:33:56.167-->00:33:59.542
time for questions if anybody
wants to ask. Uh shoot any
questions up here. I’ll be happy

00:33:59.542-->00:34:06.250
to answer them. Um if you don’t
want to ask them here, then I’ll
be here all weekend. So, I can’t

00:34:06.250-->00:34:09.250
see anybody out there. The
bright lights are in my face. I
don’t know if there are

00:34:09.250-->00:34:19.167
microphones set up for question
or not. No? OK no microphones
for questions. So. Thank you.

00:34:19.167-->00:00:00.000
[applause]