start	end	text
0	5820	So, hi everybody. Good afternoon and welcome to this talk in the ICS village here at DEF CON,
5820	11700	or there in DEF CON. This talk is the journey of ICS project files from visibility to forensics
11700	16100	and exploitation. And I will explain what this means and what we'll talk about in a minute. But
16100	21620	first, who I am. My name is Nadav. I'm the head of the research team at Clarity. And just a bit
21620	28460	of background, Clarity is an ICS cybersecurity company. What we do is protect ICS networks.
28460	34400	This protection is usually based on a deep understanding of the protocols and the assets
34400	39780	that exist in such a network. And the job of the research team at Clarity is to do just that,
39780	44400	is to investigate different ICS devices, different ICS protocols, to understand
44400	49880	what a proper behavior is, what something that's a bit different that might be dangerous would look
49880	57020	like. And based on this understanding, to improve the protection of the networks that we protect.
57020	63260	I think that's the main agenda of the Clarity research team. But not only do we understand
63260	68680	how the protocols work, we also usually use this understanding of OT networks and OT environments
68680	74900	and leverage it to vulnerability research. So the team basically also plays with the PLCs,
74900	80500	plays with the OT software to try and find vulnerabilities. And as you can see here
80500	87000	in the picture in the slide, that's our lab. That's what we call our playground. And basically,
87020	93460	what we do is we come in the morning and we start playing with PLCs. Or basically, now in COVID-19
93460	98240	times, we stay at home in the morning and start playing with PLCs. We've actually had to install
98240	105560	internet-based switches so that we can power cycle some of the PLCs from away if we did anything that
106280	111120	caused them to fall for some reason. And obviously, when we find these vulnerabilities,
111120	116140	we will report to vendors. We will have the vendors issue patches and advisories to,
116140	121360	obviously, to our customers and to the public at all. So that's basically my job. My job is
121360	129480	to play with PLCs and try to find interesting points security-wise in these PLCs. And here,
129480	135600	let's talk about what we're going to say today. So basically, the agenda is ICS project files,
135600	140180	the good of them, what are these project files, what do I mean when I say an ICS project file,
140180	145500	and what information it may contain and how it may be used for the good. The bad side is
146140	150380	once we've done that and we've understood how these project files work, how they look,
150380	156280	we will also try to understand why they may be vulnerable. They may pose some risk to the
156280	162240	engineer's computer. And lastly, the ugly would be, I would try to convince you that not only
162240	166480	these vulnerabilities exist, but they're not only theoretical vulnerabilities, they may be used
166480	173660	by an attacker to infect an engineer. So basically, the flow of this presentation would be
173660	178980	exactly the flow that my team and I did when we came to investigate project files. We started off
179580	183760	from understanding how these project files work and what information can be found in them,
183760	190160	so that we can better improve our capability to assist our customers in listing the assets in
190160	196640	the network and identifying any potential soft spots in the network. So we started by that. And
196640	200620	then when we looked into these project files, as we will do in a few minutes, we started understanding
200620	207380	that they may be a bit risky in how they work. And so we start looking into these vulnerabilities,
207380	213860	and then we'll go through these vulnerabilities that we found. So let's get to it. And I think
213860	219560	we best start with what is an ICS project file. Because when I say ICS project file, it doesn't
219560	225960	necessarily mean anything. So I think it's best to define this file. And let's start with what
225960	231160	is an ICS engineering software. So basically, here are a few just a few screenshots of very
231160	237020	common engineering software that we might encounter. And basically, when I say ICS project file,
237020	243560	what I mean is how this engineering software saves its information. So for example, if you work on
244180	249900	configuring a PLC using the B&R Automation Studio we see here, then the engineer would want at some
249900	255660	point to save all the work they've done, so that later on they can use it or they can reopen it,
255660	260780	they can edit it or anything like that. An ICS project file would be a file, a directory,
260780	265920	anything, an entity in which all this information is saved. So when I say ICS project file, it doesn't
265920	273080	necessarily mean just one specific file. It means the logical entity in which the ICS software saves
273080	279000	all its information. And when that is the definition, you can start thinking and translating
279000	284400	it into the information that we expect to find in these project files. Because I want to convince
284400	288780	you that these project files are interesting. Don't forget, we came into this challenge trying to
288780	294560	improve our capability to understand networks by looking at these project files. So let's think
294560	300340	what information we expect to find in these project files. And obviously, we'll start from the
300340	308780	topmost layer. And I think it makes sense that a project file that describes a plant or a
308780	313660	manufacturing site or anything like that would have to contain the network layout. So from the
313660	318700	topmost layer, we will see the network layout. As you can see here, some screenshots from the
318700	324400	Step 7 engineering station by Siemens or from Rockwell's engineering software. You can see that
324400	330320	it holds a list of assets in the network. So for example, here we have a profit bus
330320	335860	with a few S7-400 stations. And we can use this file to identify that we have
336520	342380	four stations along this bus and understand what they are and where they are. Next, let's dive
342380	347400	into these stations because this project file has to contain information about the specific assets
347400	353120	within the network. And so looking at the specific asset, you can see just a few more
353120	359460	screenshots here describing how we may identify all the different slots on the device.
359460	364920	So as you can see here, again, a snapshot from Siemens's software showing the exact slots and
364920	369380	the model and the order number and the firmware for every slot, which is very interesting information.
369380	375320	We can see that it also has, for example, here from BNR, you can also see the serial information,
375320	381100	the serial number, or the network addresses. So the information about the hardware of
381100	386360	every device in the network is very interesting and exists in these project files.
386900	392840	But we can also dive even deeper because these engineering software obviously are used to
392840	398440	engineer. And so programming the logic on these devices happens through these softwares and we
398440	403500	would expect it to be saved within these project files. And indeed, diving into one specific device,
403500	409220	looking into the guts of what is saved in this project file would be the actual logic.
409220	412920	So again, a few screenshots here, but you can see that these project files will contain the block
412920	419040	diagram, the ladder diagram, whatever type of logic we configured, we expect these project
419040	425760	files to contain it. So that's going from the topmost layer of the network
425760	432500	to the internals of a specific PLC, the actual logic that every PLC is running.
432560	438160	And so I think hopefully that shows you that these project files are useful. They are able to provide
438160	444220	us with a full inventory of assets, their details, their models, their firmwares, whatever, and of course
444220	450760	also their logic, which is great for us and great for the engineer to use as backup,
450760	457260	which is nice. They're also very easy to collect. The advantage with looking into project files,
457260	463060	and here again, think of me as a person wanting to improve the visibility into the network,
463060	468480	one alternative for me could be, for example, to just capture traffic from the network and try to
468480	472660	map the network from this traffic. But capturing traffic requires a lot of work. It requires
472660	477860	configuring expand ports, it requires waiting for interesting traffic to come, whereas looking into
477860	481740	project files, all it means is that I have to access the file on the engineer's computer or on
481740	486180	the backup server, because an engineer would probably use some kind of backup server that will
486180	490380	hold all these project files in one place, so I don't have to look far. And I have these files
490380	495860	at the palm of my hands without having to work too hard. And once I do have these files, all I
495860	500700	have to do is just write some kind of script that knows how the file is built,
500700	506580	and we'll get to it in a few minutes. And once I've done that, I can, within seconds, determine exactly
506580	513220	all those details that I could, that I showed you just a second ago, starting from the network
513220	518400	and going down to the actual logic. So that's very great, and that allows us to collect a lot of
518400	524520	information within a second. But the next question should be, why do I care about this information? So
524520	529620	why did we, why do we mind about the network or about the model information?
530230	537720	And my claim is that the first step in securing an OT network would be this type of visibility,
537720	542760	not only in securing, also in promising the continuous operation of such a network. But
542760	548440	obviously, my perspective and Defcon's perspective is the security side. So let's start with network.
548440	553380	Obviously, mapping the network is critical to understanding that any new devices connected
553380	558200	to the network could be a malicious actor who connected to the network. And obviously,
558200	562960	on the other side, identifying that a device is missing from the network, could be something
562960	568020	happened to a device. And so we need to have this full picture before we start diving into the
568020	574860	network to identify any changes that might have happened. Next, it also helps us to identify the
574860	579660	roles of assets within the network, because if I have this project file, I can identify that every
579660	585420	PLC has a specific responsibility. And so this PLC is part, is in charge of this part of the
585420	592820	process line. And this PLC is in charge of that part. And so when anything we don't expect happens,
592820	599560	I will be able to quickly identify what is the root cause of that. And also, it will help me
599560	605740	manage these PLCs and assign people in charge for them, for example, and more. Next, we will have
605740	610900	the detailed inventory. Because as you could see before, we also have the model, we also have the
610900	616300	firmware version, and that's great for an engineer or for a security person to assess their security
616300	622260	posture. Because when you know how many devices you have of each model, and what firmware they're
622260	628000	using, you're able to identify very quickly how vulnerable you are to a new vulnerability that
628000	632760	might have been published, how deep is your backlog in terms of firmware upgrades you need
632760	640380	to perform on your devices, because you don't want to be too old or too vulnerable. So having this
640940	647100	detailed inventory allows you to know where you're standing and keep yourself up to date with
647100	654540	any new releases by vendors, for example. And lastly, when something does happen, it might be
655160	660200	a security event, it might be an operational event. But when something does happen,
660200	665800	if you do have a snapshot of where the plant was or where the site was yesterday, it's a lot easier
665800	671460	to identify what has changed and what might be the root cause of the issue today. And also it's a
671460	676720	lot easier to start everything up again tomorrow, because you know exactly where you are. You can
676720	682560	use the configuration files, the ICS project files, to reconstruct everything very quickly.
682560	688500	So you can also identify the cause of the issue and start again, which is great in terms of incident
688500	695920	response in the OT industry where downtime is critical. So hopefully, I convinced you that
696580	701220	that this information is critical, that ICS project files hold interesting information and
701220	706060	that this information is important. One side note that is not the main issue that we speak about
706060	712080	in this presentation, it has been spoken of in previous presentations, but one side note is
712080	716740	seeing how these project files contain such valuable information also means that they may
716740	721700	be used by malicious actors themselves. Because a malicious actor trying to plan an attack on
721700	728340	an OT facility may use this information in the project files to plan their attack better, to
728340	735720	identify vulnerable devices, to map tags on specific devices that affecting them would affect the
735720	741480	the operation of the plant. And so these project files are very interesting from a security
741480	747940	perspective, both from an operational perspective, both to the OT engineer, but also to the
748600	755220	hacker doing the recon at this stage. So that's just a side note that these project files need
755220	760960	to be saved. I know that a lot of people like saving their ICS project files on a Dropbox
760960	767060	folders, etc. That's something to think of and making sure that these shared directories are
767060	776360	secure. So ICS project files at this point, and hopefully if I convinced you that the
776360	781440	thought process that we had convinced you, ICS project files are great. It's a super easy way
781440	786180	to get tons of information that we want, which is very nice from Clarity's perspective or
786180	791500	from my perspective, because the things I had to do to get all the model information of
791500	795480	all the devices in the network before were a lot more complex. And now all I have to do is
795480	800800	understand how a project file is built, and have the engineer provide me with the project file,
800800	805820	and I'm able to produce all the information. So that sounds super easy and super great.
805820	811960	But is it really? So I think this question builds up to what an ICS project file really looks like.
811960	818200	We only discussed what ICS project files are in theory. But let's talk about what an ICS
818200	823360	project file really looks like. What does it mean when I say ICS project file?
824300	831160	Sorry, so the most basic use case would be just a text file. You may go to the
831160	836080	software, you may click export on the software, and what you get is just an Excel file that
836080	841880	my grandma can open with her office that we just recently installed for her, and understand
841880	846980	everything in the network. So you can see that the IP addresses of the devices, the models of
846980	852500	the devices, the versions, which is very nice, very easy, very useful, and that's great stuff. It's not
852500	856900	very good for me as a researcher because then my boss will fire me if all files look like that,
856900	862940	but it's great for my grandma and for the common engineer trying to understand the network format.
863540	870440	And obviously, we have many formats, different formats of ICS textual project file. So another
870440	875880	example for a project file by one of Rockwell's softwares, and as you can see here, an XML,
875880	881420	which is also nice and very script friendly. If you want to write a script that will pass this
881420	885980	information, you can see very easily that you can see the name of the bus, you can see the type of
885980	892520	the network, you can see the host name of the devices. So for ICS project files being textual,
893080	898800	it's really great, and we have everything we need for that. But that's not always the case. Sometimes,
898800	903840	and for example, here, this is an ACB file. It's a file generated by the AliceLogix 5000,
903840	909340	the Rockwell software. You can see that while it starts as a textual file, and you might think that
909340	916640	your day is a good day, within a few lines, this becomes something that is clearly not English.
916640	921420	And indeed, this file is most of the information within it, and all of the interesting information
921420	926380	is saved in some kind of binary format. And so in this case, my grandma would probably call me and
926380	931220	ask for help. And this help will not be easy. You have to try and understand what this project file
931220	937540	looks like. You have maybe to reverse engineer the program, maybe to black box and understand,
937540	941680	to do some black box research and understand how this project file is built. And indeed,
941680	946320	that's what we have to do when we encounter such files. And you see that the Rockwell ACB file
946320	954460	is not the only case. This is an example for a Siemens device, a file outputted by the Dixie5
954460	960720	software, and another example by another Rockwell software, an older version of the AliceLogix.
960720	966280	So binary formats are very common as well. And in terms of research and understanding how they
966280	972260	are built, you have to work a lot harder for that. Still, not only do we have binary formats
972260	976300	or textual formats, we also have the cases where a project file is not really a file.
976300	981720	It might be a directory. This is, for example, the project file that is generated by the Siemens
983000	987040	Step7 software. And as you can see, it's just a directory containing a lot of subdirectories,
987040	991020	containing a lot of other subdirectories, containing a lot of binary files. And so the
991020	995320	project file here, the challenge of understanding where the information is, is not only understanding
995320	999880	what the binary format is, it's also understanding where the file is. And in this case, we just see
1000020	1005560	a few tens of project files. But as you can see here in this one of Mitsubishi's
1005560	1011120	softwares, you can see that we got a directory that's about 7,000 files. So you have a lot of
1011120	1017220	sifting through the files to do before you can start working for reals. And obviously,
1017220	1021200	sometimes these archives may not be just a zip archive or just a plain directory,
1021200	1026040	it may be a cub file. And I don't know how many of you are familiar with cub archives,
1026040	1031460	they're a very old format. And what is today has been replaced by zip. And just finding a
1031460	1038980	Python library to un-cub a cub archive is a challenge of itself, even though this format is
1039500	1044160	publicly available and everything. Just finding a script to un-cub the file was a challenge of
1044160	1050100	itself. But obviously, when it comes to directories, most of the files we need are zipped. And
1050100	1055360	obviously, a zip is just an archive that contains a directory. And what the software does is take
1055360	1061000	the whole directory containing all the information of the project and zip it into a single file.
1061000	1065620	And as we'll see in a minute, this file may be saved with a different file extension. So it
1065620	1071800	won't be .zip, it may be .something else. But if you just open it and check, you will see that
1071800	1076680	actually, in fact, that's a zip file containing a lot of other types of files. And we'll go into
1076680	1084620	that in just a second when we show an example. So just to recap, project files provide great
1084620	1090440	information, and they come in many, many, many shapes and sizes. And so we have to work sometimes
1090440	1097080	very hard to collect this information. So let's just see just one example, another screenshot of
1097080	1104900	the file. This file was generated by Crimson, software by RedLion, to program HMIs. And as
1104900	1111200	you can see, this file, while it's binary and not very readable for the common user, but you can
1111200	1115240	see just by looking at it that it does hold some interesting information. For example, if you look
1115240	1120200	here, you can see the model G306. And obviously, when we know that this file was used to configure
1120200	1125880	G306, then we can identify that this field shows the model. We still have to work into understanding
1126720	1131840	what... how do I get to this model? What means... how do I extract the model from this file?
1131840	1136800	But we see that it has a model. We can also see that there are some numbers here, not sure what
1136800	1142860	they mean. We have the string major, which might be a part of the major firmware version or
1142860	1147860	anything like that. And so the research team would have to do a lot of digging and some reverse
1147860	1154480	engineering into understanding what this Crimson file looks like. And the objective is
1154480	1158860	to turn this file into something that's human readable. So for example, here, as you can see,
1158860	1164640	what we were able to extract from this file is indeed the module and also the IP address. And
1164640	1169180	obviously, I can't see, at least with a glance, I can't see the IP address here, but it took some
1169180	1173040	work and some reverse engineering of the software to understand where this IP address is located
1173040	1178960	within the file. And we could also identify that this is indeed an HMI and identify the exact
1178960	1184100	version of the Redline Crimson software that was used to generate this file. In this case,
1184100	1190520	these files are compressed. So it's one compression method that is pretty specific
1190960	1195240	that was used to save all this information. Once they were uncompressed, we could start and
1195240	1204580	identify exactly the interesting fields within this file. So that's one example. Let's think of
1204580	1210720	another example for a project file. And let's have a look at the way the Siemens Step 7
1210720	1215460	saves its files. And as I mentioned before, basically, it's a directory. And so when you
1215460	1221060	export from the Siemens Step 7, you get a directory, which usually you will zip. And what
1221060	1225980	we get from our customers would be just a zipped file. And this zip extracts into this directory
1225980	1231120	containing many files, as you could see before. And looking into these files, what we identified
1231120	1235780	when we tried to find the interesting information is that one of the subdirectories within the SDB
1235780	1240700	subdirectory is the interesting subdirectory. But that contained a lot of files with the names
1240700	1247380	very informative names, 000a1.pg. So obviously, no file here is called,
1247380	1252360	I am the interesting file or model and firmware file or anything like that, but rather
1253400	1258380	these internal names. And so looking into these files, we identified that one of these files
1258380	1263360	contained the interesting information. And just by opening it, you can see, again, some interesting
1263360	1268500	strings hidden within this binary file. So you can see the order number again, you can see the model
1268500	1276740	here. And so now we've discovered what the file was, what interesting file, what is the interesting
1276740	1282180	file within this directory, we would still have to do a lot of reverse engineering to understand
1282180	1288920	how to extract this information from that. And that basically is the job that we do. We commit
1288920	1293620	to being able to understand the project file to extract all this information that we deem
1293620	1299420	interesting in this project file. And when we get a new project file, a new format, a new
1299420	1304960	requirement from a customer, what we will do is we will try to understand how this software works,
1304960	1313260	same as we will do for a protocol, same as we will do for any type of such request. So just let's do
1313380	1318500	a quick overview of what we see in these project files that we look into. And I think the most
1318500	1325420	common thing that is found in all or in a great percentage of project files in the world, no matter
1325420	1330020	the vendor, no matter the software, is a zip archive. Because usually these projects will
1330020	1335420	contain a lot of different files. For example, one file will contain the hardware configuration,
1335420	1341400	one file will contain the logic, one file will contain the list of assets, etc. And the project
1341400	1349640	file is simply a zip directory containing all these files. Looking into this project file,
1349640	1355400	and once we've unzipped this project file, we see a lot of files. And what we'll usually see,
1355400	1361060	and what is very common in these files, is first OLE files. OLE is a format used by older
1361060	1365700	Office documents, so it's a format by Microsoft. And it's a very convenient format for developers
1365700	1370240	to hold a lot of binary information in different streams. So it's very convenient, and we see it
1370240	1377300	in use a lot in ICS software. Next, we will see a lot of database files. And this makes sense
1377300	1380840	when you come to think of it, because these project files need to contain a lot of information
1380840	1385640	per every device. For example, you will need to contain the firmware, the model, the IP address,
1385640	1390960	etc., etc. And so it makes sense to save it in a database format. And so we see SQL databases,
1390960	1396200	MSSQL databases, a lot of database formats. One of these formats, just as a side note,
1396200	1402120	is the Access database, another format by Microsoft that was used by Access. And that's,
1402120	1408420	again, a very old format. And actually, so again, finding a Python library to access
1408420	1413540	such a database, we couldn't do it. We simply couldn't find a Python-native library
1413540	1420300	that could access the Access database. And so just a few weeks ago, we published our
1420300	1427060	open-source Python library to interpret Access databases, which is nice. Now you can do it just
1427060	1433100	by inputting in Python. Next, we will also see a lot of proprietary binary format. As I mentioned
1433100	1438100	before, no one forces the vendor to work with a specific database or anything like that. So the
1438100	1443700	vendor might decide that they want to save the information in their own proprietary format.
1444160	1448740	And they will design this format. They will write the code to access this format and to
1448740	1453440	parse this format, the information in there, and to obviously to save the information into this
1453440	1458440	file. And so we see a lot of proprietary binary formats. Lastly, as I mentioned before,
1458440	1462520	if you're really lucky from an engineer's perspective, if you're really lucky,
1462520	1466880	you will get a text file you can open and just review the text file and understand everything.
1466880	1470420	Obviously, from the researcher's perspective, it's less fun, because all you have to do is
1470420	1476120	open the text file. But in my perspective, still, this is a very convenient and a very good way
1476120	1484160	to save the information. So all that means that if we take a look back at what we discussed
1484160	1488880	so far about what project files do, what information they contain, how they are built,
1488880	1494260	then we can think of a few traits that are occurring. First is we see a lot of binary
1494260	1498980	formats that are developed internally. And as I mentioned just a second ago,
1498980	1503340	this is because the vendors will develop their own code and they will do that by themselves.
1504100	1509240	Next, we will see that if the format is proprietary or if it's public or if it's a
1509240	1514220	database or anything like that, still, a complex parsing is required in order to extract the
1514220	1518280	information from this file or to save the information to this file. Because we're talking
1519020	1523720	about a very big amount of information in various types. You sometimes want to save the IP address,
1523720	1528160	you sometimes want to save the compiled logic. So various types. And obviously,
1528160	1535320	it will require some complex parsing work. Lastly, it will hold some proprietary information.
1535320	1539480	Every vendor will save their own information. Every vendor will design the file as they wish to
1540000	1545020	save the information that they were looking for. So we will see a lot of proprietary information
1545020	1550140	in proprietary formats that will be complex. And thinking of all these three traits,
1550140	1554720	it sounds quite familiar, or at least to a researcher working in the ICS domain,
1554720	1559440	sounds quite familiar. It sounds quite familiar because these traits are very common in ICS
1559440	1567740	protocols as well. And so when we had reviewed enough ICS project files to extract the information
1567740	1572680	from them, and at some point we had a nice collection of ICS project files formats that
1572680	1578040	we support and understand, we started to think ICS protocols. And the next thought, as a security
1578040	1582400	researcher, when you think of ICS protocols, the next thought is oil. And the reason for that is
1582400	1588040	that vulnerabilities in ICS protocols exist, and exist a lot. And they are published weekly,
1588040	1592860	and these devices are very vulnerable. And the reason for that is that this code was usually
1592860	1598260	developed with no security in mind. And so when you're thinking of something that is comparable
1598260	1604720	to ICS protocols, your next thought would be, let's check how secure this may be. And indeed,
1604720	1611240	just a quick Google of ICS project file vulnerabilities showed us that not very.
1611240	1615700	The answer is not very. And so just a quick Google, and you can see a lot of vulnerabilities
1615700	1623800	that have been published in recent years. And just a quick lookup in the ICS self-website,
1623800	1630120	for example, for Advisor is published recently. You can see here one type of vulnerability that's
1630120	1635840	an SQL injection. Another is a use-after-free. Another is a stack buffer overflow. And so
1635840	1640360	vulnerabilities are constantly published on these devices. And all these vulnerabilities, as you can
1640360	1649340	see, are relevant to the ICS project files. And so these formats, these files, are vulnerable.
1649360	1654300	Not only they are vulnerable, they're also growing in terms of awareness to the vulnerabilities.
1654300	1658480	So just a quick example for that, we can have a look at the vulnerability that was published in
1658480	1665620	2016, just four years ago. And this vulnerability, and I put here the CV, is crashing the engineering
1665620	1669860	software with a malicious project. This means that if the engineer would double-click on a
1669860	1675160	malicious project, the engineering software would crash. And that vulnerability got, at the time,
1675240	1680880	a CVSS score of 4.2, which is a low CVSS score. And not only that, the Advisor contains this,
1680880	1685140	some kind of disclaimer sentence saying these vulnerabilities are not exploitable remotely
1686000	1690980	and cannot be exploited without user interaction. So that's some kind of disclaimer saying,
1690980	1695140	yes, this is a vulnerability, but no, it's not very, very interesting, or at least not
1695140	1699020	at this time. And the reason I'm saying at this time is because we can look at the same
1699020	1703700	vulnerability or similar vulnerability published in 2019. Again, a vulnerability that means that
1703700	1709280	when you open a project file, when you double-click a project file, the engineering station,
1709280	1715340	the engineering software would crash. And so the meaning of the vulnerability is the same.
1715340	1721220	But this time, and we're three years ahead, it got a CVSS score of 7.8, which is a high CVSS score.
1721220	1726180	And no disclaimer in this case at all. So there is some kind of growing understanding that these
1726180	1731780	vulnerabilities, while they are not as sexy as protocol vulnerabilities, they are not as accessible
1731780	1737300	as network vulnerabilities, they are interesting and they are dangerous. Another example for the
1737300	1742260	growing security focus is the Pwn2Own competition that was held in Miami this year. So Pwn2Own
1742260	1749380	is an organization of competitions that invite hackers to compete on finding specific
1749380	1757000	vulnerabilities in specific devices. For example, find a remote code execution in a Tesla car.
1757000	1761860	If you do, you get a lot of money for that. And so the first Pwn2Own competition that was targeted
1762600	1768720	on ICS products was held just in the beginning of this year, and it had five categories,
1768720	1776380	and one of which was finding vulnerabilities in ICS project files. And so even an organization
1776380	1782480	like that, which is very oriented towards security and very up-to-date in terms of understanding the
1782480	1789280	security world, sets one of the categories in the competition as vulnerabilities in ICS project files.
1789280	1793840	And not only that, the winner in this category would win $20,000. So the motivation is
1794360	1803750	not only interest, but also gaining a lot of money. And by the way, there was a winner in
1803750	1811530	this category. Someone collected this prize, and this category also held a product by Schneider as well,
1811530	1817830	which we also collected the prize for. So I think at this point, what we can say
1818470	1821950	is that project files are great for asset management. They are very interesting. The
1821950	1828170	information they hold are very interesting and valuable to an engineer and to the security
1828710	1834470	of this network. They're also great for researchers' employment. And what do I mean by that?
1834470	1840490	My job is based on the fact that these project files are complex. If anyone could just open a
1840490	1846570	project file and extract the data from it, my day would be a lot less interesting. And so they're
1846570	1853170	great for me. But also, they might be great for an attacker, not only for recon purposes, for mapping
1853170	1857890	the network, as we mentioned before, but also because they are vulnerable. And what I would
1857890	1863090	want to show you is that they're vulnerable, not just in theory. So we saw that there were
1863090	1869690	vulnerabilities published. But let's do a quick overview of these parts that we saw before,
1869690	1875150	that comprise a common ICS project file. And as you can remember, we discussed the zip file,
1875150	1879550	we discussed OLE files, etc. And let's take it step by step. And I will show you that
1879550	1885470	just in the recent months, vulnerabilities have been published for every part of this project file.
1886330	1892650	So let's think of it step by step. And we started off with a zip. And what I wanted to show for
1892650	1899370	zip files is the very common zip slip vulnerability. And so what this actually means is there is no
1899370	1904770	sanitation on zip paths. But let's explain what this means in a more technical way. So let's have
1904870	1910310	a look at what the header of the zip file looks like. So take it in for a second, I'll have a drink.
1914060	1920440	Okay, great. So as you can see, as you can see, a zip file holds a lot of different files within
1920440	1924900	it, right? When you double click a zip file, it extracts into multiple files and multiple
1924900	1932480	directories. And the way that the file is saved for real, in its binary data, is that its header
1932480	1937440	contains the list of files to which we need to extract the information. So for example, this file
1938140	1943940	will extract information to a directory called example-slash-uex. And another file will be
1943940	1952900	extracted to example-slash-file1.txt. And another file will be extracted to example-slash-filewithalongname.sql.
1952900	1956260	So when you double click this file, you will get a new directory called example, and within it,
1956260	1963000	you will get three files. And that makes sense. And that's just how the zip file header works.
1963000	1969740	But this also means that if not properly handled, an attacker may use these attributes
1969740	1975380	of a zip file. And how they may use it? They may employ the special characters that allow
1975380	1982420	directory traversal. Because this slash dot dot slash means go up one directory. And so instead
1982420	1988120	of saving the file within the example directory, this will cause the software that extracts this
1988120	1997240	file to save this file somewhere outside of the targeted directory. And so we may write files
1997240	2002300	basically to any location we want on the computer on which this file is extracted. And this is a
2002300	2008680	very common vulnerability. It has been known for years. It has been handled in many products.
2008680	2014600	But what we see in the ICS domain, unfortunately still, is that some products still do not
2014600	2018880	sanitize the paths and do not make sure that there is no use of these characters and allow
2018880	2024200	an attacker to employ this vulnerability and save files basically to any location they want
2024200	2030040	on the target computer. And saving files on any location sometimes would directly mean
2030040	2034080	being able to take control of the computer, because you may override some files. You may
2034080	2038660	save files, for example, like we did here. And you may save files to the startup directory and
2038660	2044700	save in the store.exe. And that's obviously not something we want. So that's just a very, very
2044700	2051340	basic vulnerability in zip files that is still very, very common and may happen if the product
2051340	2058280	does not make sure that the paths within the zip file header are valid. So that's zip files.
2058280	2063240	But let's take a step in and I'll just show a couple of vulnerabilities that were published
2063240	2070600	just in the recent months in these exact things. This path reversal CWE means exactly that,
2070600	2077100	means that someone could use this attribute. And as you can see here, just in the past,
2077100	2082800	during the past year, several vulnerabilities have been published in this exact method.
2082800	2087260	So that's a zip file. Now let's have a look at the OLE files that we mentioned that are very
2087260	2092520	common within zip files. And here I will not go into a lot of details, but as I mentioned before,
2092520	2099100	OLE files are the files used by office products and, sorry, old office products. And old office
2099100	2104800	products, we all know that have been vulnerable for years, right? You would not open an email
2104800	2111060	saying, hey, please download and open this world document I sent you from someone you don't know,
2111060	2115100	because you know that this could be dangerous. And still, a document from the FBI showed that
2115100	2121580	the most common used vulnerabilities still today in 2020 are, I think, five of the 10 most common
2121580	2129540	used vulnerabilities in real life are still vulnerabilities in office files. And so OLE
2129540	2134840	files, vulnerable. It doesn't matter if you wrap it with Office or wrap it with an ICS engineering
2134840	2140220	software. They are vulnerable. That's OLE files. Next, let's discuss databases.
2142140	2146540	And when you think of database and you're a security researcher, the next thing that comes
2146540	2152180	to your mind is SQL injection. That's, again, a very, very common vulnerability in the handling
2152180	2160440	of SQL queries when working with databases. And it's very common in the world, and specifically
2160440	2166500	in ICS software. It still exists. It may exist if the software uses a database to save its
2166500	2173460	information. So let's take just one example for a vulnerability that was discovered as part of
2173460	2181220	the Pwn2Own competition by Uri from my team. And what... sorry, by Amir and Sharon from my team.
2181240	2187640	And what they discovered was that one of these products saves this information within a
2187640	2193540	database. And if you save... and this database holds the version in which the information was saved.
2193540	2199200	So if you change the version field to a lower version, then when the software opens this
2199200	2206940	database, it will run some migration scripts on the file. And what we found was
2206940	2214320	that you could use one type of SQL injection in these parts and create a full remote code
2214320	2220000	execution just based on an SQL injection in the database. And what it looks like is, as you can
2220000	2224180	see, the engineer would double-click the project file, the engineering software would open, and within a second
2225940	2231560	we will see a notepad pop up. And in this case, notepad, but in a malicious case, it will not be notepad.
2231560	2237900	It will be some kind of software that might cause damage. So that's databases. Let's go on to binary
2237900	2243000	formats. And obviously, binary formats are risky because they mean that someone had to write a lot
2243000	2249720	of code. Someone had to design a format that would be secure enough. And all this work
2249720	2256860	has been done usually years ago when no one was security-oriented. And so vulnerabilities
2256860	2261980	in binary formats exist and exist a lot, and we see a lot of them published
2262960	2268640	on a monthly basis. And so I won't go into details in this case because simply you
2268640	2272340	can understand that the complexity of a binary format means that many vulnerabilities may be found
2272340	2279120	within that. For example, just one example here, this article by Ed Kovacs from Security Week
2279120	2285180	is reviewing a vulnerability published in the Red Lion HMI files that we saw before. So those
2285180	2290300	compressed files and those Crimson compressed files we saw before, we saw earlier, are vulnerable
2290300	2298280	to some vulnerabilities that were discovered by security researchers and were published before.
2298700	2302900	So that's binary formats. Lastly, we said that if you're really lucky,
2302900	2308020	you would have a text file. And one might think that a text file, how hard can it be?
2308020	2314220	What can be vulnerable within a text file? And still a vulnerability published by Uri from my
2314220	2319720	team just a few months ago in one of Siemens's products showed that the parsing of a textual
2319720	2325740	file within the software may have caused a remote code execution. So again, if you would double
2325740	2333420	click the project file, code would be executed. And that's even though this file was just a
2333420	2339900	textual format, the bug was obviously in the parsing of this file. So what we could see is
2339900	2346080	that taking apart the common ICS project file, you can understand that every part of it may be
2346080	2350020	vulnerable. And basically what I want to convince you is these vulnerabilities may exist, they're
2350020	2355280	not something that is out of the ordinary. So let's take one type of project files, and this
2355280	2361500	would be a project file used by Phoenix Contact software PLCnext. And let's see exactly how this
2361500	2367200	vulnerability works, just so we can get a hang of how this vulnerability works. And so this
2367200	2375800	vulnerability was discovered by Amir from my team, and this vulnerability allows
2375800	2383240	remote code execution when a project is opened in the PLCnext software by Phoenix Contact.
2383520	2388360	Let's understand how it works. So first of all, this is the software. This is just a screenshot
2388360	2392440	of the software. As you can see, it holds some information. It shows all the information about
2392440	2397600	the HMI, the PLC, etc. And this is just how the software looks like. But let's see how the
2397600	2404040	information is saved behind the scenes. And indeed, in this case, the information is saved in a pcwex
2404040	2409980	file. And as I mentioned before, the pcwex file is actually just a zip file with a different
2409980	2415040	extension. And so if you extract it, you can see that there are a few files within this file.
2415040	2421200	And one of the files that was of interest for us is the project.proj file. And why is that?
2423760	2428200	The reason for that is that this file is just an XML, a textual file.
2428480	2434640	But as you can see here, it contains an import line that imports a file from a specified location.
2434640	2441180	And so what you would do is you would... this line here contains basically a pointer to another file.
2441180	2446860	And this file will be loaded when the project starts or will be accessed when the project is
2446860	2453320	loaded. And this file that is pointed to here would be the targets file. And this targets file,
2453320	2457900	again, is a textual file. But as you can see here now, it gets interesting because it contains the
2457900	2463400	names of some DLLs that need to be loaded when the project is built. And so what we discovered was
2463400	2469860	that basically when you open a project file, you... when you open a project file, this whole chain of
2469860	2475700	events happens. And if you want to be... to think of it from a malicious actor's point of view,
2475700	2483000	what you would want to do is to be able to send a malicious pcwex file and get the engineer to
2483000	2489980	open it. And you would change the pointer here to anything you want, basically any other file you
2489980	2495400	want. And let this other targets file contain a pointer to your malicious DLL. And let's see what
2495400	2500100	it looks like in real life. So we start again with the same directory structure, because we only
2500100	2506440	change a bit of lines within the files. And within the project file, we changed it. Instead of using
2506440	2511500	some kind of environment variable, we'll simply point it to a malicious SMB server that is accessible
2511500	2516540	to the victim's machine. So we don't have to drop this file ahead on the victim's machine.
2516540	2520480	All we have to do is make the victim's machine approach us and request for the malicious targets
2520480	2526300	file. And within the targets file, again, what we would do is we would point to a malicious DLL
2526300	2532900	that is used, that is loaded when the project is built. And so what happens basically when the
2532900	2537600	project is open, that the software is automatically building the project. And so they access this
2537600	2544260	project file, this project.proj file, and collect the malicious.targets file from our server.
2544260	2547540	And based on this malicious.targets file, they will collect the DLL
2548300	2554300	again from our server and execute it. And once they've done that, basically, we ran our own DLL
2554300	2561140	on the remote machine with the permissions of the software, and we've taken over the control.
2561140	2566520	And that's the whole vulnerability. And that's pretty cool, in my opinion. And obviously,
2566520	2571600	this vulnerability was disclosed to Phoenix, and we would like to acknowledge their quick
2571600	2576260	remediation of that. It took, I think, less than two months between the time we disclosed this
2576260	2580320	vulnerability to Phoenix and the time they released the fixed version and its advisory,
2580320	2586740	which is very nice and not very common in the ICS domain. So we would like to thank Phoenix
2586740	2594060	for fixing this in such a hurry. Cool. So what did we do so far? We showed that
2594060	2598580	those project files are interesting, and we showed that they are vulnerable. We showed that you can
2598580	2602260	find vulnerabilities in them. And some of these vulnerabilities, you don't even have to work very
2602260	2608580	hard in order to explain. So let's complete the last piece of the puzzle. The last piece of the
2608580	2614880	puzzle would be how I can use these vulnerabilities in order to take over an engineer's computer.
2614980	2619480	Because if you think of a protocol vulnerability, you know that the PLC is there. You know that
2619480	2623880	you are here. All you have to do is communicate with the PLC, and you are done. But in the case
2623880	2627940	of a project file, you know that the engineer is here. You know that you are here, but you want to
2627940	2632360	get the engineer to open a project file of your own. So the attack vector here is something that
2632360	2640700	I need to convince you that exists. So we had a look, and we tried to think what ways could be
2640700	2647000	used to get a victim engineer to open an ICS project file. Because you know that when someone
2647000	2651440	sends you a doc file, as I mentioned before, via email, someone you don't know, you will probably
2651440	2656320	be suspicious about it and not do anything with that. But if you're an OT engineer and they send
2656320	2662840	you a Rockwell ACD file or any other type of ICS engineering file, then you might be curious. This
2662840	2667840	is your world. You're interested. You want to understand what's going on. You will want to open
2667840	2673200	this file. You will be curious. So instead of sending you a doc file, in theory, the malicious
2673200	2679800	actor could send you an ACD file or a project file and get you to open that. It would be more likely
2679800	2685940	that you do. And this type of phishing campaigns happens. In the COVID-19 world, you know that
2685940	2691360	and many papers have been published on that, that the fact that phishing is on
2691360	2696940	the rise and targeted phishing towards ICS industries is on the rise. So as you can see here,
2696940	2701620	this may be used as a phishing campaign that is very targeted and very specific
2703120	2705240	towards OT engineers.
2711530	2717010	Sorry, and not only phishing campaigns or not only phishing campaigns via email, what we thought
2717010	2722710	next was, let's check the forums, the support forums in the ICS domain, because we know these
2722710	2728770	support forums are very, very, in very, very common use. And many people use them to ask questions,
2728770	2736570	to help other people to get some support, both the vendors' own forums and the public forums.
2736570	2740990	So we had a look at these forums and we looked for people who might have posted
2740990	2745630	these project files and had a look at what they have done. And so, for example, this is just
2745630	2750330	one message from a forum that we found. I have an ACD file, but I do not have the software to
2750330	2755110	read the controller tags. Can anyone please help me convert this file into a PDF? And they published
2755110	2759650	with this message, they published an ACD file. And what you could see in the comments section
2759650	2764770	is that many, many people did download this file and did open this file and help this person. And
2764770	2770090	obviously, this was the happy case where someone did need help and many people did help him. But if
2770090	2779650	it was a malicious case, then this question could have caught many ICS engineers and have taken
2779650	2785370	control over the computer if this was a malicious case. So this attack vector of getting an ICS
2785370	2793930	engineer to open a project file, I think, may happen. It's really real, either as part of a
2793930	2799350	request or anything like that. And the reason this is very critical, and more critical than
2799350	2807370	using just a doc file, is that this engineer who sent an ICS project file via email from
2807370	2812030	the internet, they will open it on their computer. And this computer, you know that this computer, by
2812030	2817630	definition, has access to the shop floor, has access to the actual physical devices. Whereas
2817630	2823750	if this was just a Microsoft Word document, this engineer might have opened it on their own
2823750	2829330	computer, which is not connected to anything interesting. But if you provide the engineer with
2829330	2834070	the project file, they would take it to the computer that is connected to the shop floor,
2834070	2839590	because it has the engineering software installed on it. So basically, the hacker, with just one
2839590	2845350	step, got access not only to an engineer's computer, but to the actual critical engineer
2845350	2851990	computer and to the actual critical network. And so, hopefully, what I could convince you with
2851990	2856350	along this talk was that ICS project files, they are very interesting.
2857410	2862830	They allow you great visibility into a network and great understanding of your network. And so,
2862830	2866870	I don't want anyone to go home and delete all your project files, right? Because you have to
2866870	2871410	keep working, and this may provide you of great value if you handle these files right. Obviously,
2871410	2875810	you also have to secure your files to make sure that no malicious actor gains access to those
2875810	2881130	files as well. But they are very important. But on the other side, you have to be aware
2881130	2887590	that these project files can be just as malicious as a doc file. And this means that you don't want
2887590	2892950	to open any ICS project file that is uploaded to a support forum or to anything like that.
2892950	2897510	And actually, these files may be even more dangerous than these doc files, because what
2897510	2901750	we said just a minute ago, that they will provide the attacker with access directly to the critical
2901750	2908510	network. So, these files for an attacker actually are a great way to spread through phishing
2908510	2913190	campaigns that are targeted, that are going directly to the ICS engineer, not just to anywhere
2913190	2919390	around the world. And so, they're very critical in that. And they will get this attacker a foothold
2919390	2926570	in the ICS network. And so, the bottom line here of this talk is just use these ICS project files
2926570	2933310	to gain visibility into your network. And that is great. But be suspicious of any ICS project
2933310	2938150	file that might have been sent to you, and that might pose risks to your network.
2938650	2942910	And that's it. Thank you very much, and have a great conference.