start	end	text
0	4520	Uh, good morning everyone. So as Larry just mentioned, today we're gonna talk about an ICS
4520	10360	specific talk and we will discuss, uh, the specific use of some Modbus function by, uh,
10360	17120	Schneider in order to perform some, uh, bad actions on PLC. Just a quick introduction, this
17120	22260	is nothing new. Uh, everything that I'm gonna mention today was discovered, uh, maybe 10
22260	29260	years ago, mostly by, uh, reverse ICS from Digital Bond at the time. However, um, I will try
29260	35860	to show how it is still relevant even in newer PLCs and, uh, also how we can use that to
35860	42300	perform a new kind of attack. So just a few words about me, my name is Arnaud Soulier, I'm
42300	47700	French as you can probably hear. Um, I mostly do pen tests, a bit of research and
47700	52520	development. I'm a manager at WaveStone, that doesn't mean I manage anyone. Um, I really,
52520	58400	really love ICS, really fun to play with and I've given a lot of, um, ICS workshop where I
58400	64240	teach people how to perform, uh, entry level pen testing on ICS at, uh, Black Hat Europe,
64240	69920	Brucon, Defcon, besides Las Vegas. And, um, I also like other things like Active Directory
69920	77060	security and other stuff I'm not gonna talk about today. So I'm not sure that everyone is
77060	82160	familiar with ICS here so I'm just gonna try to give a crash course in 1 minute or something
82160	88280	like that. So ICS mean industrial control systems. Those are the system in charge of, uh,
88280	93960	let's say managing all the automation at plants and factories in all kind of sector. If we
93960	99860	take a look at this diagram you will see that an ICS is composed, um, on the far right side
99860	105920	of sensors and actuators. A sensors will give you an information, for example a switch will
105920	111760	tell you if it's, uh, switched on and off. And, uh, one actuators will perform an action. For
111760	116520	example, if you take the simplest example, it's a light bulb. You see that it emits light or
116520	121860	not. Those physical device, they are managed by PLCs. That's the device we're gonna talk
121860	127220	about today. That stands for programmable logic controllers. And mostly it's an embedded
127220	131900	computer with electrical inputs and outputs. That's the main difference between a standard
131900	138860	computer and a PLC. Those PLCs are then managed by, uh, some classical IT stuff like, uh,
138860	143360	Windows servers and workstation running what we will call today a SCADA software. I'm not
143360	148120	digging into the detail of SCADA versus DCS and stuff like that. Today we're gonna call
148120	153640	that SCADA. And somehow this is connected to the corporate network to get some information or
153640	162810	send some, uh, batch, uh, orders. Okay, so there are a lot of ICS protocols. Today we're
162810	168830	gonna talk about, uh, Modbus. It's one of the most widely used I think, uh, discovered, um,
168830	174470	invented in 1979 by a company that was at the time called Modicon and later bought by
174470	181050	Schneider Electric. Um, it was designed to work over serial lines, um, so RS, uh, 485
181050	186210	mostly. There are two versions of the protocol, the binary and the ASCII. And if you take a
186210	192950	look at a frame format, you will see that it's composed of the address of the PLC. Then what
192950	198130	is called the PDU, the protocol data unit with one function code and the data and, uh, some
198130	204590	kind of cyclic or linear, um, redundancy check to make sure that we have data integrity. So
204590	208870	what do I talk about the frame format? Just to show you that, uh, there is no security
208870	214110	built into the protocol. There is no encryption, there is no authentication. So that was not
214110	219450	really a problem when we were using that over serial lines. However, later they tried to use
219450	225350	Modbus over TCP. So they just removed the integrity checks because that's handled by, uh,
225350	233210	the, uh, TCP, uh, layer. And, uh, a Modbus TCP frame format also has the PDU, so the
233210	239870	function code and the data. And as a transaction identifier, that's, uh, let's say, um, a
239870	245470	random number that is used to make sure that, uh, the request and the response match. A
245470	250470	protocol identifier which is usually, uh, has the value 1, not really useful. The length of
250470	254690	the packet and the unit identifier. Most of the time the unit identifier is set to 1
254690	259250	because we already have the IP address to identify which PLC we talk to. So we do not need
259250	265450	to use this, uh, field. Mostly Modbus is used to perform read and write actions. So here
265450	270670	you have the most function, uh, most common function code. Um, it's mostly used to read
270670	275930	some information. A coil which is 1 byte or, um, a register that is 8 byte. As you can
275930	281290	see, when Modbus was transferred to TCP, they did not added, uh, any kind of security. So
281290	286230	still no security. So this is a protocol that's used for ICS. There is no authentication, no
286230	292950	encryption. You can perform other kind of actions. For example, there are some basic
292950	299110	diagnostic functions built in like the, um, function read device information. Um, that's a
299110	306390	screenshot of, um, this kind of, uh, request to this PLC which is a Schneider M340. As you
306390	311070	can see, we can, uh, know the fact that it's a Schneider Electric PLC and also get the
311070	317850	detailed hardware information. So BMX P34. So that's interesting. But there are other kind
317850	324890	of Modbus function codes that are used and not part of the standard. So we will focus on
324890	329710	the Schneider PLC. So, uh, I do not have knowledge of all the PLCs that are produced by
329710	336030	Schneider. However, I've encoded, uh, several, uh, kind of products. The first one and the,
336030	341490	the oldest are the Quantum 1, then the Premium, then this one, the M340. And then we have
341490	350050	newer, newer models, the TM221 or 241 and the M580. So those PLCs, they are programmed, uh,
350050	356330	by engineers using a specific Schneider software which is called Unity Pro. And, um, what
356330	361210	we're gonna see is that Unity Pro is actually relying on some specific Modbus function code
361210	367130	to discuss with the PLC and to program it. So how do we do that? It's quite simple. You
367130	372270	install a demo PLC, you install Unity Pro, you launch Wireshark and you take a look at the
372270	377790	packet dump. So as you can see, here's a packet dump when I log in to a, to a PLC and I
377790	383150	upload a new program. It runs on top of Modbus TCP. Uh, the function code is 90. It's
383150	388250	already part of the Wireshark de-sector. So as mentioned, uh, the use of Modbus function
388250	392610	code 90 is not something new. It has been known for years. And when I first started working
392610	397810	on it, uh, I had a chat with, um, I think it's Alex Lagut, a Wireshark developer in France,
397810	403150	and he was kind enough to add this to the Wireshark Modbus TCP de-sector. So now if you
403150	408010	take a look at, um, Modbus traffic, you will be able to know when there is, uh, somebody
408010	416370	performing admin actions on a Schneider PLC. Um, something else that's really important, I
416370	421730	mentioned that in the introduction, uh, all of this is already known. The fact that you can
421730	427330	upload a road program to a PLC is known, uh, since at least 2012. It was done by, uh,
427330	434350	reverse ICS. Um, so what I did was during a, an assessment, I think it was maybe 5 years
434350	441830	ago, I was, uh, facing a Schneider PLC so I take a deep look at what, um, uh, Red did and
441830	446610	what I try to do is try to build on that to add additional features or to make the, the
446610	454390	Metasploit modules more reliable. Okay, so now we, we see that using Modbus function called
454390	459810	90 we can do everything that can be done with Unity Pro, the programming software. So what
459810	464750	kind of evil things can we do? First thing, not really offensive, is to gather some
464750	470910	information about the, the PLC and the project and I'm gonna try to demo that. So here on my
470910	477310	setup, just to, to be clear, I have a Schneider PLC M340 and this is my laptop that will host
477310	517530	both the attacking VM and the legitimate, uh, HMI workstation. Well, actually I did not plan
517530	524150	on how I was going to type and, uh, have the mic at the same time. Thanks a lot. Okay, so
524150	528750	the idea is that I'm using a, a new Metasploit module that I just developed this week and, uh,
528750	542240	I'm gonna try to see what kind of information we can gather from, uh, the PLC. And hopefully
542240	547780	it will work. Yes. So as you can see, um, I'm able to get the same information as, uh, using
547780	555140	the Modbus function code, uh, 43. So the BMX is the hardware CPU of the PLC. That's the name
555140	560680	of the project that's on the, the PLC. And from time to time I'm also able to get the host
560680	565500	name running the, the, the name of the workstation running this programming software, the
565500	569680	version of, uh, the Unity software and the comments in this project. I think there are no
569680	580160	comments. That's why we are, do not have anything here. Uh, okay. So that was the, the, the
580160	585580	first thing. Uh, next we can start and stop the PLC. So, uh, that's, does not mean we are
585580	590560	gonna have to shut it on or off, but actually the PLC will stay on. We can still perform admin
590560	595360	action, but it will not execute the program. That's basically what start sub did. I'm not
595360	600800	gonna demo that today. Why? It's quite simple. Uh, there is a module in Metasploit. It works.
601020	604960	It works greatly when you want to stop the PLC, but it does not work so well when you want to
604960	609820	start it again. You actually have to unplug the electrical, uh, plug of the PLC and put it back
609820	614840	again. So in order to, let's say, do not waste too much time today, I'm not gonna demo that,
614840	619560	but it works quite well starting and stopping the PLC. Uh, another thing that I want to show
619560	624060	you is how to download the ladder logic. What I call ladder logic is actually the, the
624060	632000	program that the PLC is executing. So that is also something that Red had worked on, but
632000	636920	during my assessment a few years back, I discovered that it was not working correctly. Why?
636920	643800	It's quite simple. Um, I think he used a demo, uh, program, so really small in size. So he,
643800	647580	there was a misconfiguration with the, the size of a counter in the specific Schneider
647580	676260	protocol. Okay, so here you can see that I'm gonna attempt to download the program and to
676260	687970	store it at this, uh, location. Okay, so there are a few Modbus requests that are sent to the
687970	694550	PLC. The Ethernet card is flashing and in a few seconds we should have the program. It's a
694550	704030	very simple program, just, um, managing a traffic light, so it's quite, uh, it's quite fast.
704030	708430	Okay, so here I have my file. So now what I'm gonna do, I want to make sure that the file that
708430	713210	I downloaded is the real one. So I'm gonna switch to the other VM, which is a, uh, Windows
713210	723070	one. Uh, I'm gonna connect to the PLC. Oh yeah, it's not working. Yes, it works. Uh, I'm gonna
723070	745230	download the project, uh, from the PLC to my PC. Okay, so now I have, I have on my PC the, the
745230	750170	same program as the one running on the PLC using the legitimate software. I'm gonna save that as
750170	761580	an archive on my desktop. Okay. If I take a look at the desktop, I'm gonna try to find the
761600	771100	file. Okay, it's here. I just have to rename, rename it because it's actually a zip file. And if
771100	776200	you take a look inside the zip file, you see that there's a hidden folder called binappli. And in
776200	781160	this file we have, uh, uh, in this folder we have the station.apx file, which, uh, actually the
781160	787140	one, uh, that has the, the PLC ladder logic. So I'm copying this file to, um, uh, to a share to
787140	799960	the other VM. Okay, I'm replacing the file. And if I go back here on my Kali Linux machine, uh,
799960	807400	okay, so I'm actually doing a binary diff between the file I just downloaded and the one that I
807400	813880	just copied from the legitimate software. And as you can see, the files are identical. So the
813880	819080	module works. It's possible to download the ladder logic. Uh, it should be possible to upload
819080	823200	it as well. However, I have the same kind of issue with the counter and the size of the
823200	828020	counter. So at the moment, the module in Metasploit, uh, or the one that I developed does not
828020	841410	work correctly. Okay, so those were the thing that already existed. But since this is Defcon, I
841410	846470	wanted to, to have something, uh, to have something new. Uh, so one feature that was really
846470	850830	interesting to me was the, what we call forcing the outputs. Uh, I don't know if you have
850830	856190	already worked on the PLC. Forcing the outputs is used during the development phase, uh, that
856190	861510	allows you to bypass the control, uh, the, the ladder logic of the PLC and directly set the
861510	868490	outputs to on or off or any kind of, uh, arbitrary value. Um, and that helps you debugging,
868490	875050	uh, especially when working with, uh, other entities. So that's interesting why the way PLCs
875050	881230	are developed, most of the time, um, on the SCADA HMI, you do not read the values of the
881230	886910	outputs. You read the values of some intermediary, uh, variables. So for example, if I go
886910	907100	back on my, um, Windows workstation. So here I'm gonna launch the, the SCADA software. Okay,
907100	911580	so basically this controls the, the, um, the PLC. As you can see, I can switch the lights on
911580	917420	and off. The way it works is that I'm not directly reading the outputs because that's not a
917420	923580	feature, uh, that this, uh, specific software has. What I'm doing is actually, if I take a look
923580	941100	at the code, let me zoom on that. So as you can see here, I have 3, uh, variables, red, green,
941100	946340	and orange, that will set the outputs to, uh, 1 or 0. That's the way it works. So I have
946340	952980	modbus values that are, uh, um, managing the values of the outputs. From what I've been able
952980	957960	to discuss with, uh, people, engineers working in automation, most of the case that's how it
957960	962980	works in ICS. You never use directly, uh, the outputs. You use some kind of intermediary
962980	967620	variables because in real life, uh, you will use some complex function block and it's not as
967620	974200	simple as just, uh, uh, 1, um, 1 switch. Okay, so that's interesting because what happens if I
974200	979760	want to directly modify the, the outputs, uh, what will happen on the HMI screen? Probably
979760	990540	nothing. So that's what I'm gonna demo here. Uh, let me see, okay, I go back to Kelly. So here
990540	995780	I'm just gonna use the other module. I will launch, uh, a specific action that will set, uh,
995780	1003700	every output value to 0 then 1 and, um, that for all the 8 outputs that I have on this, uh,
1003700	1009900	specific, um, PLC. So the idea is that I should be able to modify the real process without the
1009900	1045780	operator noticing anything on the screen. So that's what I'm gonna try to do. Okay, so the
1045780	1051220	module is running so at some point we should see the light changing. It should not be, uh, part
1051220	1061380	of the, the HMI screen. Let's wait a few seconds. Yes. So as you can see I'm switching the, the
1061380	1067620	first output to 1. But that's not displayed on the screen. Then I'm gonna do the orange one, set
1067620	1081360	to 1 then 0. But it's gonna stay orange on the screen. There's a 5 second delay that, that may be
1081500	1092080	a bit much. And the light, the last one will be the green one. No, the orange again. Okay. So as
1092080	1096300	you can see I was able to barely influence the physical process without having any kind of
1096300	1108600	information displayed back to the, uh, to the operator. Okay, so that's interesting. Uh, other
1108600	1113440	topics I'd like to work on in the future is the ability to hot patch the PLC. Because actually
1113440	1118480	when you program the PLC you have to stop it, upload the program and start it again. So in the
1118480	1124140	physical process anyone will notice that. However, using Unity 4 you can also hot patch. That
1124140	1128060	means you can perform some small modification of the ladder logic without having to stop the
1128060	1131960	PLC. So that's really interesting. And I'd like to have a Metasploit module that does the
1131960	1137080	same. Uh, for the record I also have another module in the works that does not force the
1137080	1142380	output's value but the register's value. So you can actually modify any action inside the
1142380	1151600	ladder logic, uh, as you wish. Okay, so that was true for the premium, the quantum and the M340
1151600	1159680	PLCs. Uh, what about the new ones? So in 2015 I bought the, the new, uh, released TM221. So
1159680	1165160	those are entry level PLCs and what I've discovered is that even if they are not programmed by
1165160	1170820	Unity Pro but another soft, software called SoMachineBasic, they actually still use the same
1170820	1175920	function code. So even the PLCs released 2 years ago, even if we know that there was no
1175920	1182760	authentication on admin actions since, since, uh, almost 10 years, uh, the new PLCs still have
1182760	1187440	the same problem. Uh, however, the, the exploits, they do not work out of the box. You
1187440	1191340	actually have to perform some kind of modification, change some offsets. So it's
1191340	1195960	vulnerable but you cannot prove it at the moment. Uh, one of my colleague, Alexandrine,
1195960	1201120	the, she already had, uh, ported some modification to the Metasploit module so you can now
1201120	1205760	start and stop those device, uh, without any kind of, uh, authentication directly from
1205760	1213640	Metasploit. So that was, uh, 3 years ago. Um, I recently learned that the new high end, uh, M580
1213640	1219640	PLC adds IPSec authentication. So between the engineering station and the PLC. So that's a
1219640	1225560	good thing. They actually use IPSec not for encryption but only the, uh, uh, authentication
1225560	1230180	header part. So that allows you to make sure that, uh, if you want to program the PLC, you
1230180	1235660	have to know the pre-shared key. So that's a good thing. However, that's quite new. Uh, it's
1235660	1241800	the high end PLC so the, uh, CPU is, uh, at least, uh, I think $4,000. So at the moment I
1241800	1245620	haven't, do not have the money to have that in my lab. Uh, so I cannot vouch for it. But
1245620	1250440	that's the good idea, that's a good idea and that's the way things should work. So we can
1250440	1254540	hope that in the future it will work. However, this is something quite new and you will
1254540	1259280	probably not see that in plants and factory for, uh, at least 5 to 10 years.
1262490	1268730	Okay, so what do we do now? Um, is it possible to, let's say, configure the PLC in a way that
1268730	1274410	allows you to, uh, defeat those kind of attacks? To the extent of my knowledge, no. Uh,
1274410	1279570	actually there are very few things you can do on a PLC. Uh, I think that on some Schneider
1279570	1285410	PLCs you can, there is some kind of integrated firewall but it works not like a firewall
1285410	1290470	because you can actually send a modbus- it's at the application layer, let's say, not at the
1290470	1296590	network layer. But you could use that to prevent, uh, unauthorized action. Using newer PLC
1296590	1300670	will work only if you buy the light, the latest one. So it might also be difficult to
1300670	1306910	implement in, uh, I would say in, uh, existing or legacy environment. And of course what
1306910	1311050	you can do is perform network security monitoring. As mentioned, those attacks are not
1311050	1314930	new. Uh, the exploits are new but the vulnerability is known for a long time. So there
1314930	1319430	are signatures for this modbus function code. So if you're using, uh, any kind of network
1319430	1324330	security monitoring in your ICS, you will be able to detect any kind of attack. I would say
1324330	1329270	that you should log anytime, uh, an engineering station logs to a PLC to perform admin
1329270	1335370	action. And of course if you have an unknown workstation doing modbus, uh, 90 traffic to a
1335370	1342830	PLC, that should raise a really, really red alert. Okay, so to sum things up, uh, most
1342830	1349470	China PLCs, uh, that you will find in, uh, ICS, in, uh, assessment are vulnerable for, uh, 10
1349470	1354270	years to this unauthorized access vulnerability. Uh, attackers can leverage that to do
1354270	1359030	whatever the hell they want with the PLC, including, uh, forcing directly the outputs which
1359030	1363730	might allow them to perform some kind of stealthy attacks on your process. So what can
1363730	1371860	you do? Um, I would say at the moment you have to deal with it. Okay, so before I take any
1371860	1376240	question, I'd like to say that everything is at this GitHub address at the moment. I really
1376240	1380440	hope to be able to clean up the code and, uh, do a pull request to Metasploit, but they're
1380440	1385860	quite picky about code quality and at the moment it's, uh, it's pretty shitty so, uh, in a few
1385860	1391300	month, uh, I hope to be able to do a pull request to put that directly into Metasploit. Uh,
1391300	1396700	but you can find that today on GitHub as well as the slides and a few videos of me, uh,
1396700	1408570	pentesting PLCs. So do you have, uh, any questions? Also, I'd be happy to play with other
1408570	1413750	kind of PLCs. If you have, for example, Schneider PLC that I do not have, it would be easier
1413750	1420310	for me to try to understand the protocol. So if you have, uh, uh, M580 or TM241, I'd be
1420310	1424150	interested in testing that. Or you can also download the modules, test on your own and give
1424150	1431730	me some feedback on GitHub. I would love that. Okay, so if there are no question, thanks
1432450	1438030	everyone. And, uh, I'll be around the ICS village, uh, a lot, I think during DEF CON. And if
1438030	1443830	you are interested into ICS, of course, you just go, uh, across the hall and you will find a
1443830	1444990	lot of PLCs to play with.