1
00:00:00,000 --> 00:00:01,300
Uh, good morning everyone.

2
00:00:01,300 --> 00:00:15,180
So as Larry just mentioned, today we're gonna talk about an ICS specific talk and we will discuss, uh, the specific use of some Modbus function by, uh, Schneider in order to perform some, uh, bad actions on PLC.

3
00:00:15,240 --> 00:00:18,260
Just a quick introduction, this is nothing new.

4
00:00:18,260 --> 00:00:27,100
Uh, everything that I'm gonna mention today was discovered, uh, maybe 10 years ago, mostly by, uh, reverse ICS from Digital Bond at the time.

5
00:00:27,100 --> 00:00:37,700
However, um, I will try to show how it is still relevant even in newer PLCs and, uh, also how we can use that to perform a new kind of attack.

6
00:00:39,020 --> 00:00:44,700
So just a few words about me, my name is Arnaud Soulier, I'm French as you can probably hear.

7
00:00:44,700 --> 00:00:48,320
Um, I mostly do pen tests, a bit of research and development.

8
00:00:48,320 --> 00:00:51,620
I'm a manager at WaveStone, that doesn't mean I manage anyone.

9
00:00:51,660 --> 00:01:06,320
Um, I really, really love ICS, really fun to play with and I've given a lot of, um, ICS workshop where I teach people how to perform, uh, entry level pen testing on ICS at, uh, Black Hat Europe, Brucon, Defcon, besides Las Vegas.

10
00:01:06,480 --> 00:01:13,460
And, um, I also like other things like Active Directory security and other stuff I'm not gonna talk about today.

11
00:01:14,940 --> 00:01:23,120
So I'm not sure that everyone is familiar with ICS here so I'm just gonna try to give a crash course in 1 minute or something like that.

12
00:01:23,440 --> 00:01:26,380
So ICS mean industrial control systems.

13
00:01:26,380 --> 00:01:33,560
Those are the system in charge of, uh, let's say managing all the automation at plants and factories in all kind of sector.

14
00:01:33,560 --> 00:01:42,140
If we take a look at this diagram you will see that an ICS is composed, um, on the far right side of sensors and actuators.

15
00:01:42,140 --> 00:01:48,580
A sensors will give you an information, for example a switch will tell you if it's, uh, switched on and off.

16
00:01:48,580 --> 00:01:51,660
And, uh, one actuators will perform an action.

17
00:01:51,660 --> 00:01:55,020
For example, if you take the simplest example, it's a light bulb.

18
00:01:55,020 --> 00:01:57,260
You see that it emits light or not.

19
00:01:57,560 --> 00:02:00,500
Those physical device, they are managed by PLCs.

20
00:02:00,500 --> 00:02:02,600
That's the device we're gonna talk about today.

21
00:02:02,600 --> 00:02:05,220
That stands for programmable logic controllers.

22
00:02:05,220 --> 00:02:10,100
And mostly it's an embedded computer with electrical inputs and outputs.

23
00:02:10,100 --> 00:02:13,700
That's the main difference between a standard computer and a PLC.

24
00:02:13,860 --> 00:02:22,980
Those PLCs are then managed by, uh, some classical IT stuff like, uh, Windows servers and workstation running what we will call today a SCADA software.

25
00:02:22,980 --> 00:02:27,160
I'm not digging into the detail of SCADA versus DCS and stuff like that.

26
00:02:27,160 --> 00:02:29,160
Today we're gonna call that SCADA.

27
00:02:29,180 --> 00:02:36,940
And somehow this is connected to the corporate network to get some information or send some, uh, batch, uh, orders.

28
00:02:39,370 --> 00:02:42,290
Okay, so there are a lot of ICS protocols.

29
00:02:42,290 --> 00:02:44,910
Today we're gonna talk about, uh, Modbus.

30
00:02:45,010 --> 00:02:55,590
It's one of the most widely used I think, uh, discovered, um, invented in 1979 by a company that was at the time called Modicon and later bought by Schneider Electric.

31
00:02:55,790 --> 00:03:01,730
Um, it was designed to work over serial lines, um, so RS, uh, 485 mostly.

32
00:03:01,890 --> 00:03:05,190
There are two versions of the protocol, the binary and the ASCII.

33
00:03:05,190 --> 00:03:11,030
And if you take a look at a frame format, you will see that it's composed of the address of the PLC.

34
00:03:11,590 --> 00:03:23,770
Then what is called the PDU, the protocol data unit with one function code and the data and, uh, some kind of cyclic or linear, um, redundancy check to make sure that we have data integrity.

35
00:03:24,110 --> 00:03:26,230
So what do I talk about the frame format?

36
00:03:26,230 --> 00:03:30,410
Just to show you that, uh, there is no security built into the protocol.

37
00:03:30,410 --> 00:03:32,590
There is no encryption, there is no authentication.

38
00:03:32,830 --> 00:03:36,730
So that was not really a problem when we were using that over serial lines.

39
00:03:36,790 --> 00:03:40,950
However, later they tried to use Modbus over TCP.

40
00:03:41,290 --> 00:03:48,370
So they just removed the integrity checks because that's handled by, uh, the, uh, TCP, uh, layer.

41
00:03:48,590 --> 00:03:54,750
And, uh, a Modbus TCP frame format also has the PDU, so the function code and the data.

42
00:03:54,810 --> 00:04:04,510
And as a transaction identifier, that's, uh, let's say, um, a random number that is used to make sure that, uh, the request and the response match.

43
00:04:04,970 --> 00:04:09,790
A protocol identifier which is usually, uh, has the value 1, not really useful.

44
00:04:09,790 --> 00:04:12,530
The length of the packet and the unit identifier.

45
00:04:12,530 --> 00:04:18,570
Most of the time the unit identifier is set to 1 because we already have the IP address to identify which PLC we talk to.

46
00:04:18,570 --> 00:04:20,770
So we do not need to use this, uh, field.

47
00:04:21,510 --> 00:04:25,010
Mostly Modbus is used to perform read and write actions.

48
00:04:25,010 --> 00:04:28,430
So here you have the most function, uh, most common function code.

49
00:04:28,490 --> 00:04:31,590
Um, it's mostly used to read some information.

50
00:04:31,590 --> 00:04:35,330
A coil which is 1 byte or, um, a register that is 8 byte.

51
00:04:35,470 --> 00:04:41,150
As you can see, when Modbus was transferred to TCP, they did not added, uh, any kind of security.

52
00:04:41,150 --> 00:04:42,870
So still no security.

53
00:04:42,910 --> 00:04:45,050
So this is a protocol that's used for ICS.

54
00:04:45,050 --> 00:04:47,170
There is no authentication, no encryption.

55
00:04:48,810 --> 00:04:51,050
You can perform other kind of actions.

56
00:04:51,050 --> 00:04:57,750
For example, there are some basic diagnostic functions built in like the, um, function read device information.

57
00:04:57,790 --> 00:05:05,910
Um, that's a screenshot of, um, this kind of, uh, request to this PLC which is a Schneider M340.

58
00:05:06,050 --> 00:05:13,050
As you can see, we can, uh, know the fact that it's a Schneider Electric PLC and also get the detailed hardware information.

59
00:05:13,050 --> 00:05:14,930
So BMX P34.

60
00:05:15,330 --> 00:05:16,610
So that's interesting.

61
00:05:16,610 --> 00:05:22,770
But there are other kind of Modbus function codes that are used and not part of the standard.

62
00:05:23,470 --> 00:05:25,950
So we will focus on the Schneider PLC.

63
00:05:25,950 --> 00:05:30,210
So, uh, I do not have knowledge of all the PLCs that are produced by Schneider.

64
00:05:30,210 --> 00:05:34,710
However, I've encoded, uh, several, uh, kind of products.

65
00:05:34,710 --> 00:05:40,530
The first one and the, the oldest are the Quantum 1, then the Premium, then this one, the M340.

66
00:05:40,530 --> 00:05:47,210
And then we have newer, newer models, the TM221 or 241 and the M580.

67
00:05:47,330 --> 00:05:54,370
So those PLCs, they are programmed, uh, by engineers using a specific Schneider software which is called Unity Pro.

68
00:05:54,730 --> 00:06:03,990
And, um, what we're gonna see is that Unity Pro is actually relying on some specific Modbus function code to discuss with the PLC and to program it.

69
00:06:04,650 --> 00:06:05,910
So how do we do that?

70
00:06:05,910 --> 00:06:06,930
It's quite simple.

71
00:06:07,010 --> 00:06:13,410
You install a demo PLC, you install Unity Pro, you launch Wireshark and you take a look at the packet dump.

72
00:06:13,650 --> 00:06:19,010
So as you can see, here's a packet dump when I log in to a, to a PLC and I upload a new program.

73
00:06:19,010 --> 00:06:20,870
It runs on top of Modbus TCP.

74
00:06:21,110 --> 00:06:22,790
Uh, the function code is 90.

75
00:06:22,790 --> 00:06:25,070
It's already part of the Wireshark de-sector.

76
00:06:25,070 --> 00:06:29,750
So as mentioned, uh, the use of Modbus function code 90 is not something new.

77
00:06:29,750 --> 00:06:31,250
It has been known for years.

78
00:06:31,310 --> 00:06:42,370
And when I first started working on it, uh, I had a chat with, um, I think it's Alex Lagut, a Wireshark developer in France, and he was kind enough to add this to the Wireshark Modbus TCP de-sector.

79
00:06:42,370 --> 00:06:50,910
So now if you take a look at, um, Modbus traffic, you will be able to know when there is, uh, somebody performing admin actions on a Schneider PLC.

80
00:06:53,190 --> 00:07:01,090
Um, something else that's really important, I mentioned that in the introduction, uh, all of this is already known.

81
00:07:01,090 --> 00:07:06,170
The fact that you can upload a road program to a PLC is known, uh, since at least 2012.

82
00:07:06,170 --> 00:07:08,670
It was done by, uh, reverse ICS.

83
00:07:08,930 --> 00:07:29,170
Um, so what I did was during a, an assessment, I think it was maybe 5 years ago, I was, uh, facing a Schneider PLC so I take a deep look at what, um, uh, Red did and what I try to do is try to build on that to add additional features or to make the, the Metasploit modules more reliable.

84
00:07:30,290 --> 00:07:39,490
Okay, so now we, we see that using Modbus function called 90 we can do everything that can be done with Unity Pro, the programming software.

85
00:07:39,490 --> 00:07:41,970
So what kind of evil things can we do?

86
00:07:42,230 --> 00:07:49,390
First thing, not really offensive, is to gather some information about the, the PLC and the project and I'm gonna try to demo that.

87
00:07:49,990 --> 00:08:02,050
So here on my setup, just to, to be clear, I have a Schneider PLC M340 and this is my laptop that will host both the attacking VM and the legitimate, uh, HMI workstation.

88
00:08:35,850 --> 00:08:41,950
Well, actually I did not plan on how I was going to type and, uh, have the mic at the same time.

89
00:08:42,570 --> 00:08:43,670
Thanks a lot.

90
00:08:43,690 --> 00:08:52,470
Okay, so the idea is that I'm using a, a new Metasploit module that I just developed this week and, uh, I'm gonna try to see what kind of information we can gather from, uh, the PLC.

91
00:09:01,500 --> 00:09:03,200
And hopefully it will work.

92
00:09:03,200 --> 00:09:03,700
Yes.

93
00:09:03,700 --> 00:09:10,640
So as you can see, um, I'm able to get the same information as, uh, using the Modbus function code, uh, 43.

94
00:09:10,660 --> 00:09:14,140
So the BMX is the hardware CPU of the PLC.

95
00:09:14,380 --> 00:09:17,480
That's the name of the project that's on the, the PLC.

96
00:09:17,560 --> 00:09:29,180
And from time to time I'm also able to get the host name running the, the, the name of the workstation running this programming software, the version of, uh, the Unity software and the comments in this project.

97
00:09:29,180 --> 00:09:30,080
I think there are no comments.

98
00:09:30,080 --> 00:09:31,800
That's why we are, do not have anything here.

99
00:09:33,160 --> 00:09:34,620
Uh, okay.

100
00:09:38,600 --> 00:09:40,900
So that was the, the, the first thing.

101
00:09:40,980 --> 00:09:43,760
Uh, next we can start and stop the PLC.

102
00:09:43,760 --> 00:09:49,540
So, uh, that's, does not mean we are gonna have to shut it on or off, but actually the PLC will stay on.

103
00:09:49,540 --> 00:09:53,160
We can still perform admin action, but it will not execute the program.

104
00:09:53,160 --> 00:09:54,780
That's basically what start sub did.

105
00:09:54,800 --> 00:09:56,540
I'm not gonna demo that today.

106
00:09:56,540 --> 00:09:56,940
Why?

107
00:09:56,940 --> 00:09:58,020
It's quite simple.

108
00:09:58,040 --> 00:09:59,800
Uh, there is a module in Metasploit.

109
00:09:59,900 --> 00:10:00,800
It works.

110
00:10:01,020 --> 00:10:05,660
It works greatly when you want to stop the PLC, but it does not work so well when you want to start it again.

111
00:10:05,660 --> 00:10:10,460
You actually have to unplug the electrical, uh, plug of the PLC and put it back again.

112
00:10:10,520 --> 00:10:17,520
So in order to, let's say, do not waste too much time today, I'm not gonna demo that, but it works quite well starting and stopping the PLC.

113
00:10:18,100 --> 00:10:21,680
Uh, another thing that I want to show you is how to download the ladder logic.

114
00:10:21,680 --> 00:10:26,680
What I call ladder logic is actually the, the program that the PLC is executing.

115
00:10:28,340 --> 00:10:36,460
So that is also something that Red had worked on, but during my assessment a few years back, I discovered that it was not working correctly.

116
00:10:36,460 --> 00:10:36,920
Why?

117
00:10:36,920 --> 00:10:38,060
It's quite simple.

118
00:10:38,060 --> 00:10:42,680
Um, I think he used a demo, uh, program, so really small in size.

119
00:10:42,680 --> 00:10:48,500
So he, there was a misconfiguration with the, the size of a counter in the specific Schneider protocol.

120
00:11:12,080 --> 00:11:18,500
Okay, so here you can see that I'm gonna attempt to download the program and to store it at this, uh, location.

121
00:11:25,310 --> 00:11:28,830
Okay, so there are a few Modbus requests that are sent to the PLC.

122
00:11:30,170 --> 00:11:34,150
The Ethernet card is flashing and in a few seconds we should have the program.

123
00:11:34,150 --> 00:11:40,270
It's a very simple program, just, um, managing a traffic light, so it's quite, uh, it's quite fast.

124
00:11:43,670 --> 00:11:45,690
Okay , so here I have my file.

125
00:11:45,710 --> 00:11:49,730
So now what I'm gonna do, I want to make sure that the file that I downloaded is the real one.

126
00:11:49,810 --> 00:11:53,790
So I'm gonna switch to the other VM, which is a, uh, Windows one.

127
00:11:54,950 --> 00:11:57,390
Uh, I'm gonna connect to the PLC.

128
00:11:57,830 --> 00:11:59,470
Oh yeah, it's not working.

129
00:12:00,590 --> 00:12:01,890
Yes, it works.

130
00:12:02,230 --> 00:12:07,070
Uh, I'm gonna download the project, uh, from the PLC to my PC.

131
00:12:22,750 --> 00:12:29,070
Okay, so now I have, I have on my PC the, the same program as the one running on the PLC using the legitimate software.

132
00:12:29,070 --> 00:12:31,630
I'm gonna save that as an archive on my desktop.

133
00:12:36,840 --> 00:12:37,720
Okay.

134
00:12:38,220 --> 00:12:42,560
If I take a look at the desktop, I'm gonna try to find the file.

135
00:12:42,700 --> 00:12:43,960
Okay, it's here.

136
00:12:44,860 --> 00:12:48,340
I just have to rename, rename it because it's actually a zip file.

137
00:12:50,600 --> 00:12:55,300
And if you take a look inside the zip file, you see that there's a hidden folder called binappli.

138
00:12:55,600 --> 00:13:03,940
And in this file we have, uh, uh, in this folder we have the station.apx file, which, uh, actually the one, uh, that has the, the PLC ladder logic.

139
00:13:03,940 --> 00:13:08,520
So I'm copying this file to, um, uh, to a share to the other VM.

140
00:13:08,540 --> 00:13:10,380
Okay, I'm replacing the file.

141
00:13:11,480 --> 00:13:29,400
And if I go back here on my Kali Linux machine, uh, okay, so I'm actually doing a binary diff between the file I just downloaded and the one that I just copied from the legitimate software.

142
00:13:30,040 --> 00:13:33,060
And as you can see, the files are identical.

143
00:13:33,120 --> 00:13:34,700
So the module works.

144
00:13:34,700 --> 00:13:37,280
It's possible to download the ladder logic.

145
00:13:37,640 --> 00:13:39,820
Uh, it should be possible to upload it as well.

146
00:13:39,820 --> 00:13:43,480
However, I have the same kind of issue with the counter and the size of the counter.

147
00:13:43,480 --> 00:13:49,000
So at the moment, the module in Metasploit, uh, or the one that I developed does not work correctly.

148
00:13:56,710 --> 00:13:59,830
Okay, so those were the thing that already existed.

149
00:13:59,830 --> 00:14:04,190
But since this is Defcon, I wanted to, to have something, uh, to have something new.

150
00:14:04,510 --> 00:14:09,930
Uh, so one feature that was really interesting to me was the, what we call forcing the outputs.

151
00:14:09,930 --> 00:14:12,970
Uh, I don't know if you have already worked on the PLC.

152
00:14:12,970 --> 00:14:25,990
Forcing the outputs is used during the development phase, uh, that allows you to bypass the control, uh, the, the ladder logic of the PLC and directly set the outputs to on or off or any kind of, uh, arbitrary value.

153
00:14:25,990 --> 00:14:31,990
Um, and that helps you debugging, uh, especially when working with, uh, other entities.

154
00:14:32,110 --> 00:14:41,810
So that's interesting why the way PLCs are developed, most of the time, um, on the SCADA HMI, you do not read the values of the outputs.

155
00:14:41,810 --> 00:14:45,710
You read the values of some intermediary, uh, variables.

156
00:14:45,710 --> 00:14:50,330
So for example, if I go back on my, um, Windows workstation.

157
00:14:55,420 --> 00:14:58,140
So here I'm gonna launch the, the SCADA software.

158
00:15:06,580 --> 00:15:10,040
Okay, so basically this controls the, the, um, the PLC.

159
00:15:10,040 --> 00:15:12,220
As you can see, I can switch the lights on and off.

160
00:15:13,300 --> 00:15:20,900
The way it works is that I'm not directly reading the outputs because that's not a feature , uh, that this, uh, specific software has.

161
00:15:20,960 --> 00:15:25,200
What I'm doing is actually, if I take a look at the code,

162
00:15:30,120 --> 00:15:32,220
let me zoom on that.

163
00:15:36,880 --> 00:15:45,180
So as you can see here, I have 3, uh, variables, red, green, and orange, that will set the outputs to, uh, 1 or 0.

164
00:15:45,180 --> 00:15:45,980
That's the way it works.

165
00:15:45,980 --> 00:15:52,000
So I have modbus values that are, uh, um, managing the values of the outputs.

166
00:15:52,000 --> 00:15:58,880
From what I've been able to discuss with, uh, people, engineers working in automation, most of the case that's how it works in ICS.

167
00:15:58,880 --> 00:16:01,220
You never use directly, uh, the outputs.

168
00:16:01,220 --> 00:16:11,760
You use some kind of intermediary variables because in real life, uh, you will use some complex function block and it's not as simple as just, uh, uh, 1, um, 1 switch.

169
00:16:12,060 --> 00:16:19,520
Okay, so that's interesting because what happens if I want to directly modify the, the outputs, uh, what will happen on the HMI screen?

170
00:16:19,520 --> 00:16:20,480
Probably nothing.

171
00:16:20,480 --> 00:16:22,500
So that's what I'm gonna demo here.

172
00:16:23,120 --> 00:16:27,620
Uh, let me see, okay, I go back to Kelly.

173
00:16:29,720 --> 00:16:32,160
So here I'm just gonna use the other module.

174
00:16:32,160 --> 00:16:46,300
I will launch, uh, a specific action that will set, uh, every output value to 0 then 1 and, um, that for all the 8 outputs that I have on this, uh, specific, um, PLC.

175
00:16:46,300 --> 00:16:52,160
So the idea is that I should be able to modify the real process without the operator noticing anything on the screen.

176
00:16:52,160 --> 00:16:53,900
So that's what I'm gonna try to do.

177
00:17:25,000 --> 00:17:29,120
Okay, so the module is running so at some point we should see the light changing.

178
00:17:29,120 --> 00:17:33,760
It should not be, uh, part of the, the HMI screen.

179
00:17:33,940 --> 00:17:35,580
Let's wait a few seconds.

180
00:17:39,260 --> 00:17:39,860
Yes.

181
00:17:39,860 --> 00:17:42,760
So as you can see I'm switching the, the first output to 1.

182
00:17:43,160 --> 00:17:45,160
But that's not displayed on the screen.

183
00:17:45,360 --> 00:17:49,080
Then I'm gonna do the orange one, set to 1 then 0.

184
00:17:50,120 --> 00:17:52,500
But it's gonna stay orange on the screen.

185
00:17:59,100 --> 00:18:02,420
There's a 5 second delay that, that may be a bit much.

186
00:18:02,680 --> 00:18:04,980
And the light, the last one will be the green one.

187
00:18:05,520 --> 00:18:06,820
No, the orange again.

188
00:18:10,140 --> 00:18:10,900
Okay.

189
00:18:11,520 --> 00:18:19,620
So as you can see I was able to barely influence the physical process without having any kind of information displayed back to the, uh, to the operator.

190
00:18:26,460 --> 00:18:28,100
Okay, so that's interesting.

191
00:18:28,100 --> 00:18:32,840
Uh, other topics I'd like to work on in the future is the ability to hot patch the PLC.

192
00:18:32,840 --> 00:18:37,640
Because actually when you program the PLC you have to stop it, upload the program and start it again.

193
00:18:37,640 --> 00:18:41,340
So in the physical process anyone will notice that.

194
00:18:41,340 --> 00:18:44,040
However, using Unity 4 you can also hot patch.

195
00:18:44,040 --> 00:18:48,420
That means you can perform some small modification of the ladder logic without having to stop the PLC.

196
00:18:48,420 --> 00:18:50,100
So that's really interesting.

197
00:18:50,100 --> 00:18:52,620
And I'd like to have a Metasploit module that does the same.

198
00:18:53,040 --> 00:18:59,280
Uh, for the record I also have another module in the works that does not force the output's value but the register's value.

199
00:18:59,280 --> 00:19:04,700
So you can actually modify any action inside the ladder logic, uh, as you wish.

200
00:19:07,100 --> 00:19:12,820
Okay, so that was true for the premium, the quantum and the M340 PLCs.

201
00:19:12,820 --> 00:19:14,140
Uh, what about the new ones?

202
00:19:14,140 --> 00:19:19,420
So in 2015 I bought the, the new, uh, released TM221.

203
00:19:19,420 --> 00:19:31,480
So those are entry level PLCs and what I've discovered is that even if they are not programmed by Unity Pro but another soft, software called SoMachineBasic, they actually still use the same function code.

204
00:19:31,480 --> 00:19:43,620
So even the PLCs released 2 years ago, even if we know that there was no authentication on admin actions since, since, uh, almost 10 years, uh, the new PLCs still have the same problem.

205
00:19:43,620 --> 00:19:47,200
Uh, however, the, the exploits, they do not work out of the box.

206
00:19:47,200 --> 00:19:50,800
You actually have to perform some kind of modification, change some offsets.

207
00:19:50,800 --> 00:19:54,300
So it's vulnerable but you cannot prove it at the moment.

208
00:19:54,360 --> 00:20:06,640
Uh, one of my colleague, Alexandrine, the, she already had, uh, ported some modification to the Metasploit module so you can now start and stop those device, uh, without any kind of, uh, authentication directly from Metasploit.

209
00:20:07,000 --> 00:20:09,320
So that was, uh, 3 years ago.

210
00:20:09,360 --> 00:20:16,460
Um, I recently learned that the new high end, uh, M580 PLC adds IPSec authentication.

211
00:20:16,460 --> 00:20:19,140
So between the engineering station and the PLC.

212
00:20:19,140 --> 00:20:20,080
So that's a good thing.

213
00:20:20,080 --> 00:20:26,080
They actually use IPSec not for encryption but only the, uh, uh, authentication header part.

214
00:20:26,080 --> 00:20:32,540
So that allows you to make sure that, uh, if you want to program the PLC, you have to know the pre-shared key.

215
00:20:32,540 --> 00:20:33,680
So that's a good thing.

216
00:20:33,680 --> 00:20:35,300
However, that's quite new.

217
00:20:35,400 --> 00:20:41,220
Uh, it's the high end PLC so the, uh, CPU is, uh, at least, uh, I think $4,000.

218
00:20:41,220 --> 00:20:44,120
So at the moment I haven't, do not have the money to have that in my lab.

219
00:20:44,120 --> 00:20:45,460
Uh, so I cannot vouch for it.

220
00:20:45,460 --> 00:20:49,420
But that's the good idea, that's a good idea and that's the way things should work.

221
00:20:49,760 --> 00:20:52,160
So we can hope that in the future it will work.

222
00:20:52,400 --> 00:20:59,280
However, this is something quite new and you will probably not see that in plants and factory for, uh, at least 5 to 10 years.

223
00:21:02,490 --> 00:21:04,950
Okay, so what do we do now?

224
00:21:05,050 --> 00:21:11,570
Um, is it possible to, let's say, configure the PLC in a way that allows you to, uh, defeat those kind of attacks?

225
00:21:11,570 --> 00:21:13,810
To the extent of my knowledge, no.

226
00:21:13,990 --> 00:21:18,030
Uh, actually there are very few things you can do on a PLC.

227
00:21:18,050 --> 00:21:31,290
Uh, I think that on some Schneider PLCs you can, there is some kind of integrated firewall but it works not like a firewall because you can actually send a modbus- it's at the application layer, let's say, not at the network layer.

228
00:21:31,290 --> 00:21:34,650
But you could use that to prevent, uh, unauthorized action.

229
00:21:35,450 --> 00:21:39,190
Using newer PLC will work only if you buy the light, the latest one.

230
00:21:39,190 --> 00:21:45,670
So it might also be difficult to implement in, uh, I would say in, uh, existing or legacy environment.

231
00:21:46,070 --> 00:21:49,230
And of course what you can do is perform network security monitoring.

232
00:21:49,230 --> 00:21:51,550
As mentioned, those attacks are not new.

233
00:21:51,550 --> 00:21:54,610
Uh, the exploits are new but the vulnerability is known for a long time.

234
00:21:54,610 --> 00:21:57,390
So there are signatures for this modbus function code.

235
00:21:57,390 --> 00:22:03,950
So if you're using, uh, any kind of network security monitoring in your ICS, you will be able to detect any kind of attack.

236
00:22:04,010 --> 00:22:09,970
I would say that you should log anytime, uh, an engineering station logs to a PLC to perform admin action.

237
00:22:09,970 --> 00:22:18,190
And of course if you have an unknown workstation doing modbus, uh, 90 traffic to a PLC , that should raise a really, really red alert.

238
00:22:19,810 --> 00:22:32,470
Okay, so to sum things up, uh, most China PLCs, uh, that you will find in, uh, ICS, in, uh, assessment are vulnerable for, uh, 10 years to this unauthorized access vulnerability.

239
00:22:32,570 --> 00:22:42,930
Uh, attackers can leverage that to do whatever the hell they want with the PLC, including, uh, forcing directly the outputs which might allow them to perform some kind of stealthy attacks on your process.

240
00:22:42,990 --> 00:22:44,170
So what can you do?

241
00:22:44,190 --> 00:22:47,130
Um, I would say at the moment you have to deal with it.

242
00:22:50,560 --> 00:22:55,820
Okay, so before I take any question, I'd like to say that everything is at this GitHub address at the moment.

243
00:22:55,820 --> 00:23:10,820
I really hope to be able to clean up the code and, uh, do a pull request to Metasploit, but they're quite picky about code quality and at the moment it's, uh, it's pretty shitty so, uh, in a few month, uh, I hope to be able to do a pull request to put that directly into Metasploit.

244
00:23:10,820 --> 00:23:17,940
Uh, but you can find that today on GitHub as well as the slides and a few videos of me, uh, pentesting PLCs.

245
00:23:18,260 --> 00:23:20,280
So do you have, uh, any questions?

246
00:23:26,590 --> 00:23:29,590
Also, I'd be happy to play with other kind of PLCs.

247
00:23:29,590 --> 00:23:35,730
If you have, for example, Schneider PLC that I do not have, it would be easier for me to try to understand the protocol.

248
00:23:35,730 --> 00:23:41,470
So if you have, uh, uh, M580 or TM241, I'd be interested in testing that.

249
00:23:41,470 --> 00:23:45,350
Or you can also download the modules, test on your own and give me some feedback on GitHub.

250
00:23:45,350 --> 00:23:46,530
I would love that.

251
00:23:49,670 --> 00:23:53,190
Okay, so if there are no question, thanks everyone.

252
00:23:53,190 --> 00:23:57,710
And, uh, I'll be around the ICS village, uh, a lot, I think during DEF CON.

253
00:23:57,710 --> 00:24:04,990
And if you are interested into ICS, of course, you just go, uh, across the hall and you will find a lot of PLCs to play with.