1
00:00:00,000 --> 00:00:06,580
Good morning everyone. So as Larry just mentioned today we're going to talk about an ICS specific talk and we will discuss

2
00:00:06,580 --> 00:00:12,060
the specific use of some modules function by Schneider in order to perform some

3
00:00:12,840 --> 00:00:17,820
bad actions on PLC. Just a quick introduction. This is nothing new.

4
00:00:18,400 --> 00:00:23,560
Everything that I'm going to mention today was discovered maybe 10 years ago, mostly by

5
00:00:24,300 --> 00:00:29,480
reverse ICS from Digital Bond at the time. However, I will try to

6
00:00:29,480 --> 00:00:37,120
show how it is still relevant even in newer PLCs and also how we can use that to perform a new kind of attack.

7
00:00:38,880 --> 00:00:44,200
So just a few words about me. My name is Arnaud Soulier. I'm French as you can probably hear.

8
00:00:44,680 --> 00:00:51,060
I mostly do pen tests, a bit of research and development. I'm a manager at WaveStone. That doesn't mean I manage anyone.

9
00:00:51,620 --> 00:00:58,960
I really, really love ICS. Really fun to play with. And I've given a lot of ICS workshop where I teach people

10
00:00:58,960 --> 00:00:59,320
how to

11
00:00:59,320 --> 00:01:08,280
perform entry level pen testing on ICS at Black Hat Europe, BrewCon, DefCon, besides Las Vegas. And I also like other

12
00:01:08,280 --> 00:01:17,040
things like Active Directory security and other stuff I'm not going to talk about today. So I'm not sure that everyone is

13
00:01:17,040 --> 00:01:22,320
familiar with ICS here so I'm just going to try to give a crash course in one minute or something like

14
00:01:22,320 --> 00:01:28,980
that. So ICS means industrial control systems. Those are the systems in charge of let's say managing

15
00:01:28,980 --> 00:01:36,820
all the automation at plants and factories in all kind of sector. If we take a look at this diagram you will see that an ICS is

16
00:01:36,820 --> 00:01:45,840
composed on the far right side of sensors and actuators. The sensors will give you an information. For example a switch will

17
00:01:45,840 --> 00:01:58,960
tell you if it's switched on and off. And one actuators will perform an action. For example if you take the simplest example, it's a light bulb. You see that it emits light or not. Those physical devices, the

18
00:01:58,980 --> 00:02:03,320
primary function of an ICS is that they're managed by PLCs. That's the device we're going to talk about today. That stands for

19
00:02:03,640 --> 00:02:09,520
programmable logic controllers. And mostly it's an embedded computer with electrical inputs and outputs.

20
00:02:09,780 --> 00:02:28,960
That's the main difference between a standard computer on a PLC. Those PLCs are then managed by some classical IT stuff like Windows, servers and workstation running what we will call today a SCADA software. I'm not digging into the detail of SCADA versus DCS and stuff like that. Today we are going to call that SCADA.cell. And we're going to talk about that a lot and we're going to talk about it more. All right, so what we're going to talk about is the

21
00:02:28,960 --> 00:02:36,240
And somehow this is connected to the corporate network to get some information or send some batch orders.

22
00:02:39,260 --> 00:02:41,900
Okay, so there are a lot of ICS protocols.

23
00:02:42,180 --> 00:02:44,540
Today we're going to talk about Modbus.

24
00:02:44,720 --> 00:02:55,020
It's one of the most widely used, I think, invented in 1979 by a company that was at the time called Modicon and later bought by Schneider Electric.

25
00:02:55,020 --> 00:03:01,320
It was designed to work over serial lines, so RS-485 mostly.

26
00:03:01,900 --> 00:03:04,860
There are two versions of the protocol, the binary and the ASCII.

27
00:03:05,000 --> 00:03:10,740
And if you take a look at a frame format, you will see that it's composed of the address of the PLC,

28
00:03:11,540 --> 00:03:16,600
then what is called the PDU, the protocol data unit, with one function code and the data,

29
00:03:16,760 --> 00:03:23,180
and some kind of cyclic or linear redundancy check to make sure that we have data integrity.

30
00:03:24,040 --> 00:03:25,000
So what do we do?

31
00:03:25,000 --> 00:03:30,180
I talk about the frame format just to show you that there is no security built into the protocol.

32
00:03:30,340 --> 00:03:30,940
There is no encryption.

33
00:03:31,120 --> 00:03:32,000
There is no authentication.

34
00:03:32,780 --> 00:03:36,560
So that was not really a problem when we were using that over serial lines.

35
00:03:36,680 --> 00:03:47,900
However, later they tried to use Modbus over TCP, so they just removed the integrity checks because that's handled by the TCP layer.

36
00:03:48,400 --> 00:03:54,420
And Modbus TCP frame format also has the PDU, so the function code and the data,

37
00:03:55,000 --> 00:04:03,920
and as a transaction identifier, that's, let's say, a random number that is used to make sure that the request and the response match.

38
00:04:04,680 --> 00:04:11,960
A protocol identifier, which usually has the value 1, not really useful, the length of the packet, and the unit identifier.

39
00:04:12,320 --> 00:04:18,480
Most of the time, the unit identifier is set to 1 because we already have the IP address to identify which PLC we talk to,

40
00:04:18,540 --> 00:04:20,280
so we do not need to use this field.

41
00:04:21,580 --> 00:04:24,660
Mostly, Modbus is used to perform read and write actions.

42
00:04:25,000 --> 00:04:27,860
So here you have the most common function code.

43
00:04:29,180 --> 00:04:34,860
It's mostly used to read some information, a coil, which is 1 byte, or a register that is 8 byte.

44
00:04:35,220 --> 00:04:42,160
As you can see, when Modbus was transferred to TCP, they did not add any kind of security, so still no security.

45
00:04:42,700 --> 00:04:44,920
So this is a protocol that's used for ICS.

46
00:04:44,960 --> 00:04:46,460
There is no authentication, no encryption.

47
00:04:48,820 --> 00:04:50,680
You can perform other kind of actions.

48
00:04:50,920 --> 00:04:54,600
For example, there are some basic diagnostic functions built in.

49
00:04:55,000 --> 00:05:05,260
The function read device information, that's a screenshot of this kind of request to this PLC, which is a Schneider M340.

50
00:05:05,740 --> 00:05:14,340
As you can see, we can know the fact that it's a Schneider electric PLC, and also get the detailed hardware information, so BMX P34.

51
00:05:15,160 --> 00:05:22,260
So that's interesting, but there are other kind of Modbus function codes that are used, and not part of the standard.

52
00:05:23,340 --> 00:05:24,980
So we will focus on this.

53
00:05:24,980 --> 00:05:30,000
The Schneider PLC, so I do not have knowledge of all the PLCs that are produced by Schneider.

54
00:05:30,100 --> 00:05:34,400
However, I've encountered several kind of products.

55
00:05:34,580 --> 00:05:46,580
The first one and the oldest are the Quantum one, then the Premium, then this one, the M340, and then we have newer models, the TM221 or 241, and the M580.

56
00:05:47,140 --> 00:05:53,780
So those PLCs, they are programmed by engineers using a specific Schneider software, which is called Unity Pro.

57
00:05:55,380 --> 00:06:03,540
And what we're going to see is that Unity Pro is actually relying on some specific Modbus function code to discuss with the PLC and to program it.

58
00:06:04,560 --> 00:06:05,700
So how do we do that?

59
00:06:05,820 --> 00:06:06,460
It's quite simple.

60
00:06:06,640 --> 00:06:12,940
You install a demo PLC, you install Unity Pro, you launch Wireshark, and you take a look at the packet dump.

61
00:06:13,400 --> 00:06:18,600
So as you can see, here's a packet dump when I log in to a PLC and I upload a new program.

62
00:06:18,820 --> 00:06:20,300
It runs on top of Modbus TCP.

63
00:06:21,120 --> 00:06:22,580
The function code is 90.

64
00:06:22,660 --> 00:06:24,820
It's already part of the Wireshark dissector.

65
00:06:24,980 --> 00:06:29,560
So as mentioned, the use of Modbus function code 90 is not something new.

66
00:06:29,680 --> 00:06:30,740
It has been known for years.

67
00:06:30,960 --> 00:06:37,680
And when I first started working on it, I had a chat with, I think it's Alexi Lagout, a Wireshark developer in France,

68
00:06:37,840 --> 00:06:42,180
and he was kind enough to add this to the Wireshark Modbus TCP dissector.

69
00:06:42,320 --> 00:06:50,420
So now if you take a look at Modbus traffic, you will be able to know when there is somebody performing admin actions on a Schneider PLC.

70
00:06:53,960 --> 00:06:54,840
Something else.

71
00:06:54,980 --> 00:06:55,860
That's really important.

72
00:06:56,200 --> 00:06:57,680
I mentioned that in the introduction.

73
00:06:59,080 --> 00:07:00,680
All of this is already known.

74
00:07:00,920 --> 00:07:05,700
The fact that you can upload a road program to a PLC is known since at least 2012.

75
00:07:06,160 --> 00:07:08,040
It was done by reverse ICS.

76
00:07:09,380 --> 00:07:16,680
So what I did was during an assessment, I think it was maybe five years ago, I was facing a Schneider PLC.

77
00:07:16,760 --> 00:07:24,960
So I take a deep look at what Red did, and what I try to do is try to build on that to add additional features.

78
00:07:24,980 --> 00:07:28,580
Or to make the Metasploit modules more reliable.

79
00:07:30,260 --> 00:07:39,040
Okay, so now we see that using Modbus Functional Code 90, we can do everything that can be done with Unity Pro, the programming software.

80
00:07:39,340 --> 00:07:41,480
So what kind of evil things can we do?

81
00:07:42,040 --> 00:07:48,820
First thing, not really offensive, is to gather some information about the PLC and the project, and I'm going to try to demo that.

82
00:07:49,900 --> 00:07:54,560
So here on my setup, just to be clear, I have a Schneider PLC M340.

83
00:07:54,980 --> 00:08:01,520
And this is my laptop that will host both the attacking VM and the legitimate HMI workstation.

84
00:08:35,780 --> 00:08:41,580
Well, actually I did not plan on how I was going to type and have the mic at the same time.

85
00:08:42,560 --> 00:08:43,200
Thanks a lot.

86
00:08:43,480 --> 00:08:47,740
Okay, so the idea is that I'm using a new Metasploit module that I just developed this week.

87
00:08:47,940 --> 00:08:52,020
And I'm going to try to see what kind of information we can gather from the PLC.

88
00:09:01,360 --> 00:09:02,760
And hopefully it will work.

89
00:09:02,980 --> 00:09:10,100
Yes, so as you can see, I'm able to get the same information as using the Modbus Functional Code 43.

90
00:09:10,540 --> 00:09:13,980
So the BMX is the hardware CPU of the PLC.

91
00:09:14,300 --> 00:09:17,280
That's the name of the project that's on the PLC.

92
00:09:17,420 --> 00:09:24,840
And from time to time, I'm also able to get the host name running the name of the workstation running the programming.

93
00:09:24,980 --> 00:09:28,940
The software, the version of the Unity software, and the comments in this project.

94
00:09:29,100 --> 00:09:29,920
I think there are no comments.

95
00:09:30,020 --> 00:09:31,600
That's why we do not have anything here.

96
00:09:33,660 --> 00:09:34,100
Okay.

97
00:09:38,500 --> 00:09:40,560
So that was the first thing.

98
00:09:41,260 --> 00:09:43,460
Next, we can start and stop the PLC.

99
00:09:43,620 --> 00:09:47,340
So that does not mean we are going to shut it on or off.

100
00:09:47,460 --> 00:09:49,360
But actually the PLC will stay on.

101
00:09:49,440 --> 00:09:50,820
We can still perform admin action.

102
00:09:50,940 --> 00:09:52,940
But it will not execute the program.

103
00:09:53,100 --> 00:09:54,560
That's basically what StartSub did.

104
00:09:54,980 --> 00:09:56,200
I'm not going to demo that today.

105
00:09:56,400 --> 00:09:56,700
Why?

106
00:09:56,840 --> 00:09:57,580
It's quite simple.

107
00:09:58,120 --> 00:09:59,520
There is a module in Metasploit.

108
00:09:59,840 --> 00:10:00,540
It works.

109
00:10:00,980 --> 00:10:03,200
It works greatly when you want to stop the PLC.

110
00:10:03,300 --> 00:10:05,440
But it does not work so well when you want to start it again.

111
00:10:05,600 --> 00:10:10,160
You actually have to unplug the electrical plug of the PLC and put it back again.

112
00:10:10,440 --> 00:10:14,660
So in order to, let's say, do not waste too much time today, I'm not going to demo that.

113
00:10:14,800 --> 00:10:17,140
But it works quite well, starting and stopping the PLC.

114
00:10:18,240 --> 00:10:21,260
Another thing that I want to show you is how to download the ladder logic.

115
00:10:21,540 --> 00:10:24,720
What I call ladder logic is actually the program that...

116
00:10:24,980 --> 00:10:26,040
The PLC is executing.

117
00:10:28,280 --> 00:10:31,460
So that is also something that Red had worked on.

118
00:10:31,640 --> 00:10:36,200
But during my assessment a few years back, I discovered that it was not working correctly.

119
00:10:36,400 --> 00:10:36,560
Why?

120
00:10:36,740 --> 00:10:37,560
It's quite simple.

121
00:10:37,760 --> 00:10:40,580
I think he used a demo program.

122
00:10:40,840 --> 00:10:42,380
So really small in size.

123
00:10:42,580 --> 00:10:47,900
So there was a misconfiguration with the size of a counter in the specific Schneider protocol.

124
00:11:10,300 --> 00:11:10,940
And now you can see the

125
00:11:12,080 --> 00:11:17,980
So here you can see that I'm going to attempt to download the program and store it at this location.

126
00:11:18,640 --> 00:11:19,280
Okay.

127
00:11:19,980 --> 00:11:20,620
Great.

128
00:11:24,320 --> 00:11:24,960
Thanks.

129
00:11:24,980 --> 00:11:28,400
Okay, so there are a few Modbus requests that are sent to the PLC.

130
00:11:30,380 --> 00:11:31,720
The Ethernet card is flashing.

131
00:11:32,040 --> 00:11:33,960
And in a few seconds, we should have the program.

132
00:11:34,120 --> 00:11:39,580
It's a very simple program, just managing a traffic light, so it's quite, it's quite

133
00:11:39,580 --> 00:11:39,760
fast.

134
00:11:43,620 --> 00:11:45,220
Okay, so here I have my file.

135
00:11:45,580 --> 00:11:49,060
So now what I'm going to do, I want to make sure that the file that I downloaded is a

136
00:11:49,060 --> 00:11:49,500
real one.

137
00:11:49,500 --> 00:11:53,400
So, I'm going to switch to the other VM, which is a Windows 1.

138
00:11:55,280 --> 00:11:56,960
I'm going to connect to the PLC.

139
00:11:57,840 --> 00:11:58,960
Oh, yeah, it's not working.

140
00:12:00,620 --> 00:12:01,380
Yes, it works.

141
00:12:02,540 --> 00:12:06,560
I'm going to download the project from the PLC to my PC.

142
00:12:16,920 --> 00:12:19,100
Okay, so now I'm going to download the project from the PLC to my PC.

143
00:12:22,740 --> 00:12:28,320
Okay, so now I have on my PC the same program as the one running on the PLC, using the legitimate

144
00:12:28,320 --> 00:12:28,720
software.

145
00:12:29,000 --> 00:12:31,160
I'm going to save that as an archive on my desktop.

146
00:12:37,840 --> 00:12:42,120
Okay, if I take a look at the desktop, I'm going to try to find this file.

147
00:12:42,700 --> 00:12:43,560
Okay, it's here.

148
00:12:44,800 --> 00:12:47,880
I just have to rename it, because it's actually a zip file.

149
00:12:48,680 --> 00:12:49,080
Okay, it's here.

150
00:12:50,480 --> 00:12:54,200
And if you take a look inside the zip file, you see that there's a hidden folder called

151
00:12:54,200 --> 00:12:54,880
bin-appli.

152
00:12:55,500 --> 00:13:01,000
And in this file, we have in this folder, we have the station.apx file, which is actually

153
00:13:01,000 --> 00:13:03,620
the one that has the PLC ladder logic.

154
00:13:03,820 --> 00:13:07,820
So I'm copying this file to a share to the other VM.

155
00:13:08,360 --> 00:13:09,740
Okay, I'm replacing the file.

156
00:13:11,560 --> 00:13:14,640
And if I go back here on my Kali Linux machine.

157
00:13:15,960 --> 00:13:16,400
Okay.

158
00:13:16,860 --> 00:13:17,300
Okay.

159
00:13:18,640 --> 00:13:19,080
Okay.

160
00:13:19,960 --> 00:13:27,300
So I'm actually doing binary diff between the file I just downloaded and the one that

161
00:13:27,300 --> 00:13:28,800
I just copied from the legitimate software.

162
00:13:30,040 --> 00:13:32,400
And as you can see, the files are identical.

163
00:13:32,920 --> 00:13:34,460
So the module works.

164
00:13:34,580 --> 00:13:36,640
It's possible to download the ladder logic.

165
00:13:37,640 --> 00:13:39,560
It should be possible to upload it as well.

166
00:13:39,640 --> 00:13:43,380
However, I have the same kind of issue with the counter and the size of the counter.

167
00:13:43,460 --> 00:13:48,200
So at the moment, the module in Metasploit, or the one that I developed, does not work

168
00:13:48,200 --> 00:13:48,520
correctly.

169
00:13:55,840 --> 00:13:56,360
Okay.

170
00:13:56,760 --> 00:13:59,560
So those were the things that already existed.

171
00:13:59,700 --> 00:14:03,640
But since this is DEF CON, I wanted to have something new.

172
00:14:04,640 --> 00:14:09,440
So one feature that was really interesting to me was what we call forcing the outputs.

173
00:14:10,040 --> 00:14:12,540
I don't know if you have already worked on the PLC.

174
00:14:12,680 --> 00:14:15,240
Forcing the outputs is used during the development phase.

175
00:14:15,600 --> 00:14:17,980
That allows you to bypass the control.

176
00:14:18,560 --> 00:14:19,080
Okay.

177
00:14:19,100 --> 00:14:23,860
The ladder logic of the PLC and directly set the outputs to on or off, or any kind

178
00:14:23,860 --> 00:14:25,360
of arbitrary value.

179
00:14:26,320 --> 00:14:31,320
And that helps you debugging, especially when working with other entities.

180
00:14:32,240 --> 00:14:38,360
So that's interesting why the way PLCs are developed, most of the time, on SCADA HMI,

181
00:14:38,540 --> 00:14:41,460
you do not read the values of the outputs.

182
00:14:41,680 --> 00:14:45,120
You read the values of some intermediary variables.

183
00:14:45,580 --> 00:14:49,080
So for example, if I go back on my web browser.

184
00:14:49,080 --> 00:14:49,760
Windows workstation.

185
00:14:55,360 --> 00:14:57,620
So here I'm going to launch the SCADA software.

186
00:15:06,580 --> 00:15:06,980
Okay.

187
00:15:07,060 --> 00:15:09,700
So basically this controls the PLC.

188
00:15:09,860 --> 00:15:11,820
As you can see, I can switch the lights on and off.

189
00:15:13,240 --> 00:15:17,020
The way it works is that I'm not directly reading the outputs, because that's not a

190
00:15:17,020 --> 00:15:17,280
feature.

191
00:15:17,280 --> 00:15:20,380
That this specific software has.

192
00:15:20,600 --> 00:15:23,920
What I'm doing is actually, if I take a look at the code.

193
00:15:30,500 --> 00:15:31,680
Let me zoom on that.

194
00:15:36,740 --> 00:15:42,680
So as you can see here, I have three variables, red, green, and orange, that will set the

195
00:15:42,680 --> 00:15:44,820
outputs to one or zero.

196
00:15:45,060 --> 00:15:45,920
That's the way it works.

197
00:15:45,920 --> 00:15:51,620
So I have Modbus values that are managing the values of the outputs.

198
00:15:51,880 --> 00:15:57,240
From what I've been able to discuss with people, engineers working in automation, most of the

199
00:15:57,240 --> 00:15:58,740
case that's how it works in ICS.

200
00:15:58,840 --> 00:16:00,860
You never use directly the outputs.

201
00:16:01,080 --> 00:16:06,020
You use some kind of intermediary variables, because in real life, you will use some complex

202
00:16:06,020 --> 00:16:11,140
function blocks and it's not as simple as just one switch.

203
00:16:12,040 --> 00:16:12,520
Okay.

204
00:16:12,580 --> 00:16:13,160
So that's interesting.

205
00:16:13,160 --> 00:16:15,920
Because what happens if I want to directly modify the outputs?

206
00:16:16,940 --> 00:16:19,080
What will happen on the HTML screen?

207
00:16:19,300 --> 00:16:20,060
Probably nothing.

208
00:16:20,320 --> 00:16:21,860
So that's what I'm going to demo here.

209
00:16:23,900 --> 00:16:24,900
Let me see.

210
00:16:25,240 --> 00:16:25,640
Okay.

211
00:16:25,800 --> 00:16:27,040
I'll go back to Kelly.

212
00:16:29,640 --> 00:16:31,820
So here I'm just going to use the other module.

213
00:16:32,060 --> 00:16:37,780
I will launch a specific action that will set every output value to zero, then one.

214
00:16:38,120 --> 00:16:43,080
And that for all the eight outputs that I have.

215
00:16:43,100 --> 00:16:43,140
Okay.

216
00:16:43,160 --> 00:16:45,940
So that's what I'm going to do on this specific PLC.

217
00:16:46,100 --> 00:16:50,680
So the idea is that I should be able to modify the real process without the operator noticing

218
00:16:50,680 --> 00:16:51,920
anything on the screen.

219
00:16:52,060 --> 00:16:53,500
So that's what I'm going to try to do.

220
00:16:56,460 --> 00:16:56,860
Okay.

221
00:16:58,120 --> 00:16:58,520
Okay.

222
00:17:24,980 --> 00:17:26,440
So the module is running.

223
00:17:26,600 --> 00:17:28,500
So at some point, we should see the light.

224
00:17:28,500 --> 00:17:33,220
It should not be part of the HMI screen.

225
00:17:33,860 --> 00:17:35,060
Let's wait a few seconds.

226
00:17:39,120 --> 00:17:39,600
Yes.

227
00:17:39,700 --> 00:17:42,220
So as you can see, I'm switching the first output to one.

228
00:17:43,080 --> 00:17:44,640
But that's not displayed on the screen.

229
00:17:45,220 --> 00:17:47,060
Then I'm going to do the orange one.

230
00:17:47,220 --> 00:17:48,520
Set to one, then zero.

231
00:17:50,240 --> 00:17:52,020
It's going to stay orange on the screen.

232
00:17:53,060 --> 00:17:53,180
Okay.

233
00:17:58,860 --> 00:18:00,120
There's a five-second delay.

234
00:18:00,200 --> 00:18:01,940
That may be a bit much.

235
00:18:02,540 --> 00:18:04,440
And the last one will be the green one.

236
00:18:05,200 --> 00:18:05,600
No.

237
00:18:05,680 --> 00:18:06,280
The orange again.

238
00:18:09,960 --> 00:18:10,440
Okay.

239
00:18:11,440 --> 00:18:16,140
So as you can see, I was able to barely influence the physical process without having any kind

240
00:18:16,140 --> 00:18:18,940
of information displayed back to the operator.

241
00:18:19,480 --> 00:18:19,960
Okay.

242
00:18:26,560 --> 00:18:27,700
So that's interesting.

243
00:18:28,000 --> 00:18:33,100
Other topics I'd like to work on in the future is the ability to out-patch the PLC, because

244
00:18:33,100 --> 00:18:37,120
actually when you program the PLC, you have to stop it, upload the program, and start

245
00:18:37,120 --> 00:18:37,400
it again.

246
00:18:37,560 --> 00:18:40,880
So in the physical process, anyone will notice that.

247
00:18:41,060 --> 00:18:43,900
However, using Unity 4, you can also out-patch.

248
00:18:44,000 --> 00:18:47,820
That means you can perform some small modification of the ladder logic without having to stop

249
00:18:47,820 --> 00:18:48,320
the PLC.

250
00:18:48,380 --> 00:18:49,740
So that's really interesting.

251
00:18:49,740 --> 00:18:52,140
And I'd like to have a Metasplot module that does the same.

252
00:18:53,140 --> 00:18:57,300
For the record, I also have another module in the works that does not force the output

253
00:18:57,300 --> 00:18:58,900
value but the register value.

254
00:18:59,140 --> 00:19:04,180
So you can actually modify any action inside the ladder logic as you wish.

255
00:19:07,060 --> 00:19:07,540
Okay.

256
00:19:07,600 --> 00:19:12,400
So that was true for the premium, the quantum, and the M340 PLCs.

257
00:19:12,660 --> 00:19:13,900
What about the newer ones?

258
00:19:14,000 --> 00:19:19,080
So in 2015, I bought the new release TM221.

259
00:19:19,080 --> 00:19:24,960
So those are entry-level PLCs, and what I've discovered is that even if they are not programmed

260
00:19:24,960 --> 00:19:31,320
by Unity Pro but another software called SoMachineBasic, they actually still use the same function code.

261
00:19:31,440 --> 00:19:36,320
So even the PLCs released two years ago, even if we know that there was no authentication

262
00:19:36,320 --> 00:19:43,340
on admin actions since almost ten years, the new PLCs still have the same problem.

263
00:19:43,780 --> 00:19:47,020
However, the exploits, they do not work out of the box.

264
00:19:47,140 --> 00:19:49,060
You actually have to perform some kind of modification.

265
00:19:49,060 --> 00:19:50,680
Change some offsets.

266
00:19:50,720 --> 00:19:53,760
So it's vulnerable, but you cannot prove it at the moment.

267
00:19:54,320 --> 00:20:00,060
One of my colleagues, Alexandrine, she already had some modification to the Metasploit module.

268
00:20:00,240 --> 00:20:05,340
So you can now start and stop those devices without any kind of authentication directly

269
00:20:05,340 --> 00:20:06,140
from Metasploit.

270
00:20:06,860 --> 00:20:08,740
So that was three years ago.

271
00:20:09,720 --> 00:20:15,740
I recently learned that the new high-end M580 PLC adds IPsec authentication.

272
00:20:16,000 --> 00:20:18,860
So between the engineering station and the PLC.

273
00:20:19,060 --> 00:20:19,840
So that's a good thing.

274
00:20:19,920 --> 00:20:25,740
They actually use IPsec enough for encryption, but only the authentication header part.

275
00:20:25,960 --> 00:20:31,040
So that allows you to make sure that if you want to program the PLC, you have to know

276
00:20:31,040 --> 00:20:32,160
the pre-shared key.

277
00:20:32,320 --> 00:20:33,240
So that's a good thing.

278
00:20:33,540 --> 00:20:34,820
However, that's quite new.

279
00:20:35,220 --> 00:20:42,420
It's the high-end PLC, so the CPU is at least, I think, $4,000, so at the moment I do not

280
00:20:42,420 --> 00:20:43,780
have the money to have that in my lab.

281
00:20:44,000 --> 00:20:45,340
So I cannot vouch for it.

282
00:20:45,460 --> 00:20:48,940
But that's a good idea, and that's the way things should work.

283
00:20:49,700 --> 00:20:51,720
So we can hope that in the future it will work.

284
00:20:52,220 --> 00:20:56,700
However, this is something quite new, and you will probably not see that in plants and

285
00:20:56,700 --> 00:20:59,060
factory for at least five to ten years.

286
00:21:02,500 --> 00:21:02,900
Okay.

287
00:21:02,960 --> 00:21:04,680
So what do we do now?

288
00:21:05,240 --> 00:21:10,800
Is it possible to, let's say, configure the PLC in a way that allows you to defeat those

289
00:21:10,800 --> 00:21:11,360
kind of attacks?

290
00:21:11,540 --> 00:21:13,360
To the extent of my knowledge, no.

291
00:21:14,280 --> 00:21:17,620
Actually, there are very few things you can do on a PLC.

292
00:21:17,620 --> 00:21:22,820
I think that on some Schneider PLCs you can, there is some kind of integrated firewall,

293
00:21:23,100 --> 00:21:29,120
but it works not like a firewall because you can actually send a modbus, it's at the application

294
00:21:29,120 --> 00:21:30,920
layer, let's say, not at the network layer.

295
00:21:31,120 --> 00:21:34,300
But you could use that to prevent unauthorized action.

296
00:21:35,400 --> 00:21:40,440
Using newer PLC will work only if you buy the latest one, so it might also be difficult

297
00:21:40,440 --> 00:21:45,240
to implement in, I would say, in existing or legacy environment.

298
00:21:46,080 --> 00:21:47,560
And, of course, what you can do is...

299
00:21:47,560 --> 00:21:48,880
Perform network security monitoring.

300
00:21:49,200 --> 00:21:51,340
As mentioned, those attacks are not new.

301
00:21:51,500 --> 00:21:54,540
The exploits are new, but the vulnerability is known for a long time.

302
00:21:54,660 --> 00:21:57,160
So there are signatures for this modbus function code.

303
00:21:57,360 --> 00:22:02,040
So if you're using any kind of network security monitoring in your ICS, you will be able

304
00:22:02,040 --> 00:22:03,360
to detect any kind of attack.

305
00:22:03,660 --> 00:22:08,980
I would say that you should log any time an engineering station logs to a PLC to perform

306
00:22:08,980 --> 00:22:09,500
admin action.

307
00:22:09,740 --> 00:22:15,840
And, of course, if you have an unknown workstation doing modbus 90 traffic to a PLC, that should

308
00:22:15,840 --> 00:22:16,500
raise a...

309
00:22:16,500 --> 00:22:17,880
Really, really red alert.

310
00:22:19,780 --> 00:22:20,260
Okay.

311
00:22:20,340 --> 00:22:27,440
So to sum things up, most China PLCs that you will find in assessment are vulnerable

312
00:22:28,120 --> 00:22:31,820
for 10 years to this unauthorized access vulnerability.

313
00:22:32,740 --> 00:22:36,840
Attackers can leverage that to do whatever the hell they want with the PLC, including

314
00:22:36,840 --> 00:22:41,200
forcing directly the outputs, which might allow them to perform some kind of stealthy

315
00:22:41,200 --> 00:22:42,420
attacks on your process.

316
00:22:42,880 --> 00:22:44,020
So what can you do?

317
00:22:44,500 --> 00:22:46,480
I would say, at the moment, you have to deal with...

318
00:22:49,560 --> 00:22:50,000
Okay.

319
00:22:50,740 --> 00:22:54,820
So before I take any question, I'd like to say that everything is at this GitHub address

320
00:22:54,820 --> 00:22:55,400
at the moment.

321
00:22:55,600 --> 00:22:59,640
I really hope to be able to clean up the code and do a pull request to Metasploit.

322
00:22:59,760 --> 00:23:01,720
But they're quite picky about code quality.

323
00:23:01,920 --> 00:23:04,380
And at the moment, it's pretty shitty.

324
00:23:04,540 --> 00:23:10,360
So in a few months, I hope to be able to do a pull request to put that directly into Metasploit.

325
00:23:10,980 --> 00:23:16,120
But you can find that today on GitHub, as well as the slides and a few videos of me,

326
00:23:16,120 --> 00:23:17,520
pen testing PLCs.

327
00:23:18,060 --> 00:23:19,760
So do you have any questions?

328
00:23:26,500 --> 00:23:29,360
Also, I'll be happy to play with other kinds of PLCs.

329
00:23:29,500 --> 00:23:34,440
If you have, for example, Schneider PLCs that I do not have, it would be easier for me

330
00:23:34,440 --> 00:23:35,480
to try to understand the protocol.

331
00:23:35,700 --> 00:23:41,260
So if you have M580 or TM241, I'll be interested in testing that.

332
00:23:41,400 --> 00:23:44,920
Or you can also download the modules, test on your own, and give me some feedback on

333
00:23:44,920 --> 00:23:45,180
GitHub.

334
00:23:45,320 --> 00:23:45,980
I would love that.

335
00:23:49,660 --> 00:23:50,020
Okay.

336
00:23:50,100 --> 00:23:52,720
So if there are no questions, thanks, everyone.

337
00:23:53,100 --> 00:23:57,280
And I'll be around the ICS village a lot, I think, during DEF CON.

338
00:23:57,460 --> 00:24:02,400
And if you're interested into ICS, of course, you just go across the hall.

339
00:24:02,580 --> 00:24:04,700
And you will find a lot of PLCs to play with.