1 00:00:00,570 --> 00:00:02,070 - We all are in for a treat today. 2 00:00:02,070 --> 00:00:05,520 He's about to go give his talk on Evil PLCs Attacks 3 00:00:05,520 --> 00:00:07,318 and I'll let you take it away. 4 00:00:07,318 --> 00:00:08,151 - Thank you. (crowd applauding) 5 00:00:08,151 --> 00:00:09,939 Thank you, thank you very much. 6 00:00:09,939 --> 00:00:12,856 (crowd applauding) 7 00:00:13,779 --> 00:00:15,720 So, let's just make sure everything works. 8 00:00:15,720 --> 00:00:16,553 Looks like it. 9 00:00:20,220 --> 00:00:21,603 Okay, we're ready to go. 10 00:00:23,010 --> 00:00:23,843 So, hi everyone. 11 00:00:23,843 --> 00:00:26,400 Today, I'm going to talk about our cool research, 12 00:00:26,400 --> 00:00:27,630 Evil PLC Attack 13 00:00:27,630 --> 00:00:29,370 and I'm going to show you 14 00:00:29,370 --> 00:00:32,400 how we were able to weaponize PLCs, 15 00:00:32,400 --> 00:00:34,350 Programmable Logic Controllers. 16 00:00:34,350 --> 00:00:36,120 So let's start. 17 00:00:36,120 --> 00:00:37,481 I'm Sharon Brizinov, 18 00:00:37,481 --> 00:00:40,890 I work as a Vulnerability Research at Claroty. 19 00:00:40,890 --> 00:00:44,490 We're doing a lot of ICS and SCADA security research. 20 00:00:44,490 --> 00:00:48,870 I'm a CTF player, I've played in a couple of CTFs, 21 00:00:48,870 --> 00:00:50,403 including Pwn2Own, 22 00:00:51,450 --> 00:00:53,820 Miami '22 and '20. 23 00:00:53,820 --> 00:00:56,760 I also own a DEFCON Black Badge, whoo, 24 00:00:56,760 --> 00:00:59,790 for winning the ICS CTF, 25 00:00:59,790 --> 00:01:03,390 and I mostly enjoying breaking PLCs. 26 00:01:03,390 --> 00:01:06,300 And I'm not sure if you can see in the small picture, 27 00:01:06,300 --> 00:01:08,133 this is our cool lab in Tel Aviv. 28 00:01:09,264 --> 00:01:12,090 Special thanks to my colleagues 29 00:01:12,090 --> 00:01:14,100 who worked on this research with me, 30 00:01:14,100 --> 00:01:17,370 Michelle Urinam and Amir. Thank you very much. 31 00:01:17,370 --> 00:01:18,203 Okay. 32 00:01:18,203 --> 00:01:19,769 So, the agenda for today 33 00:01:19,769 --> 00:01:21,510 is to give you a little bit background and motivation 34 00:01:21,510 --> 00:01:24,147 for this research, why we started it, 35 00:01:24,147 --> 00:01:26,187 and we're gonna talk about PLC upload 36 00:01:26,187 --> 00:01:27,570 and download procedures. 37 00:01:27,570 --> 00:01:31,015 This is how we're transferring logic to the PLC 38 00:01:31,015 --> 00:01:35,160 so it could execute it and control the physical process. 39 00:01:35,160 --> 00:01:38,400 And finally, I'm gonna introduce the evil PLC attack. 40 00:01:38,400 --> 00:01:41,460 This is a concept we have developed to weaponize PLCs, 41 00:01:41,460 --> 00:01:45,480 so we could propagate and attack engineers and technicians. 42 00:01:45,480 --> 00:01:47,490 So let's start with the story time. 43 00:01:47,490 --> 00:01:48,990 So as I told you already, 44 00:01:48,990 --> 00:01:50,400 we have a super cool lab 45 00:01:50,400 --> 00:01:53,310 with a lot of ICS equipment in Tel Aviv. 46 00:01:53,310 --> 00:01:57,090 And around two years ago, we were like, yeah, 47 00:01:57,090 --> 00:01:58,263 we have a cool lab. 48 00:01:59,460 --> 00:02:03,450 Why won't we expose a couple of PLCs online 49 00:02:03,450 --> 00:02:05,730 so people could scan us 50 00:02:05,730 --> 00:02:08,430 and we will monitor the interaction 51 00:02:08,430 --> 00:02:10,293 because why not? 52 00:02:11,400 --> 00:02:15,780 So indeed, we chose a couple of PLCs from our lab, 53 00:02:15,780 --> 00:02:18,330 for example, what used to be GE, 54 00:02:18,330 --> 00:02:21,300 now it's Emerson RX3I. 55 00:02:21,300 --> 00:02:22,770 These are all controllers, 56 00:02:22,770 --> 00:02:24,660 industrial controllers, 57 00:02:24,660 --> 00:02:27,622 and we just plugged them 58 00:02:27,622 --> 00:02:32,622 to our external router and we exposed them online. 59 00:02:33,270 --> 00:02:36,810 We obviously monitored this entire experiment. 60 00:02:36,810 --> 00:02:40,470 We had sniffers and we had auditing and logs 61 00:02:40,470 --> 00:02:43,983 and we waited a couple of weeks to see what happens. 62 00:02:45,810 --> 00:02:50,073 I bet you can guess that we've been hacked, 63 00:02:51,453 --> 00:02:52,710 but our honey pots, 64 00:02:52,710 --> 00:02:56,160 the real honey pots were hacked OT style. 65 00:02:56,160 --> 00:02:59,040 Now, what does it mean to hack OT style? 66 00:02:59,040 --> 00:03:03,030 So it means a bunch of script kit is used Shodan 67 00:03:03,030 --> 00:03:04,140 to scan the internet 68 00:03:04,140 --> 00:03:05,790 and then they just use 69 00:03:05,790 --> 00:03:08,760 the commercial engineering workstation. 70 00:03:08,760 --> 00:03:12,330 This is the software that the vendors are distributing 71 00:03:12,330 --> 00:03:17,330 alongside with the hardware to program and monitor the PLCs. 72 00:03:18,060 --> 00:03:21,600 So basically it's kind of a diagnostic tool 73 00:03:21,600 --> 00:03:24,120 and IDE to program the PLC. 74 00:03:24,120 --> 00:03:27,930 So all these sophisticated attackers did was to use this 75 00:03:27,930 --> 00:03:29,940 software plugged in the IP 76 00:03:29,940 --> 00:03:32,640 they got probably on Shodan or Census. 77 00:03:32,640 --> 00:03:37,470 And what they did is they changed our logic 78 00:03:37,470 --> 00:03:39,060 using the engineering workstation. 79 00:03:39,060 --> 00:03:41,010 Now, how did they do that? 80 00:03:41,010 --> 00:03:42,930 They used two main functionalities. 81 00:03:42,930 --> 00:03:44,700 So the first functionality they used 82 00:03:44,700 --> 00:03:46,740 is called upload procedure. 83 00:03:46,740 --> 00:03:48,240 In upload procedure. 84 00:03:48,240 --> 00:03:49,860 you're asking the PLC, 85 00:03:49,860 --> 00:03:53,107 the engineering workstation software asks the PLC 86 00:03:53,107 --> 00:03:56,040 "Hey, what's currently running on the PLC?" 87 00:03:56,040 --> 00:03:59,130 So it transfer, it asks to transfer 88 00:03:59,130 --> 00:04:01,920 the logic from the PLC to the application, 89 00:04:01,920 --> 00:04:03,810 which is usually Windows based. 90 00:04:03,810 --> 00:04:07,110 So we could see in our engineering workstation 91 00:04:07,110 --> 00:04:09,300 what is currently running on the PLC. 92 00:04:09,300 --> 00:04:11,370 It's kind of a diagnostic tool. 93 00:04:11,370 --> 00:04:14,070 Now they did upload, they got the logic 94 00:04:14,070 --> 00:04:16,080 we plugged in into the PLC 95 00:04:16,080 --> 00:04:18,810 and they modified a couple of parameters. 96 00:04:18,810 --> 00:04:21,300 So they kind of messed up with our program. 97 00:04:21,300 --> 00:04:24,090 And then they did a download, 98 00:04:24,090 --> 00:04:27,990 download procedure is the opposite procedure of upload. 99 00:04:27,990 --> 00:04:31,775 It transfers the logic, the program to the PLC. 100 00:04:31,775 --> 00:04:35,733 So now the PLC basically has new software it needs to run. 101 00:04:36,724 --> 00:04:38,820 And obviously, boom. 102 00:04:38,820 --> 00:04:42,390 Now at least this is what the attacker thought was happening 103 00:04:42,390 --> 00:04:43,980 because in reality, 104 00:04:43,980 --> 00:04:48,210 our PLC just turned the red system fault alert. 105 00:04:48,210 --> 00:04:50,613 And that's it because it did nothing. 106 00:04:51,540 --> 00:04:54,360 Now we all know that the best motivation 107 00:04:54,360 --> 00:04:57,300 to do some kind of a research, is revenge. 108 00:04:57,300 --> 00:05:00,960 So we were really furious on these attackers 109 00:05:00,960 --> 00:05:02,550 that modified our logic 110 00:05:02,550 --> 00:05:05,730 and probably thought they're exploiting some kind of a 111 00:05:05,730 --> 00:05:07,260 nuclear plant or something, 112 00:05:07,260 --> 00:05:09,540 but we really wanted to get our revenge. 113 00:05:09,540 --> 00:05:14,460 So we came up with a plan and the plan was to again, 114 00:05:14,460 --> 00:05:16,770 use our PLC as a honey pot, 115 00:05:16,770 --> 00:05:18,630 weaponize it in some kind of ways 116 00:05:18,630 --> 00:05:21,540 that at the time we did not know how exactly 117 00:05:21,540 --> 00:05:23,130 and use it as a bait. 118 00:05:23,130 --> 00:05:26,640 Now we wanted to wait for an attacker to use Shodan again, 119 00:05:26,640 --> 00:05:28,470 because they're so sophisticated 120 00:05:28,470 --> 00:05:31,560 to scan our external IP address. 121 00:05:31,560 --> 00:05:35,700 And then as we knew their methodology is to do upload. 122 00:05:35,700 --> 00:05:39,180 So when they're doing upload procedure, 123 00:05:39,180 --> 00:05:43,680 we would somehow used our weaponized PLC to attack them 124 00:05:43,680 --> 00:05:45,900 and execute code on the attackers. 125 00:05:45,900 --> 00:05:47,580 So this was our plan. 126 00:05:47,580 --> 00:05:51,060 Now, in order for me to explain the concept, 127 00:05:51,060 --> 00:05:53,580 we need to go through some terminologies. 128 00:05:53,580 --> 00:05:55,680 So let's start with what is a PLC 129 00:05:55,680 --> 00:05:58,110 and what is a download and upload procedures. 130 00:05:58,110 --> 00:06:00,862 Now, a PLC is a programmable logic controller. 131 00:06:00,862 --> 00:06:05,670 It's a small device computer used to control and automate 132 00:06:05,670 --> 00:06:07,470 the physical process. 133 00:06:07,470 --> 00:06:11,100 Basically it means it controls field devices. 134 00:06:11,100 --> 00:06:14,010 It can be sensors, temperature sensors, for example, 135 00:06:14,010 --> 00:06:17,010 or activators, such as lift or motors. 136 00:06:17,010 --> 00:06:19,470 Now, in order to the PLC to do something 137 00:06:19,470 --> 00:06:21,120 we need to program it. 138 00:06:21,120 --> 00:06:24,750 And the way to program it is to use a software called 139 00:06:24,750 --> 00:06:26,190 engineering workstation. 140 00:06:26,190 --> 00:06:27,202 So we're developing our software 141 00:06:27,202 --> 00:06:30,000 in the engineering workstation software, 142 00:06:30,000 --> 00:06:31,917 and then we're transferring this to the PLC. 143 00:06:31,917 --> 00:06:34,620 And now the PLC has the program 144 00:06:34,620 --> 00:06:36,510 to control the field devices. 145 00:06:36,510 --> 00:06:38,340 Now, let's see a cool example. 146 00:06:38,340 --> 00:06:41,220 This is for example, the GE mark six platform. 147 00:06:41,220 --> 00:06:44,100 What you can see here is the IDE, 148 00:06:44,100 --> 00:06:45,570 the engineering workstation, 149 00:06:45,570 --> 00:06:46,950 and you can see here some kind 150 00:06:46,950 --> 00:06:50,220 of a specific PLC programming language. 151 00:06:50,220 --> 00:06:53,373 This is a graphical one with boxes, 152 00:06:54,240 --> 00:06:56,755 and we're using this to transfer the logic 153 00:06:56,755 --> 00:06:58,200 to the controller. 154 00:06:58,200 --> 00:07:00,810 In this case, this is the mark six platform. 155 00:07:00,810 --> 00:07:05,206 And once the PLC or the controller has the software, 156 00:07:05,206 --> 00:07:07,890 the logic that we transferred to it, 157 00:07:07,890 --> 00:07:10,230 it can control a physical process. 158 00:07:10,230 --> 00:07:12,720 In this case, this platform is mainly used 159 00:07:12,720 --> 00:07:14,790 to control physical processes 160 00:07:14,790 --> 00:07:17,400 in the green energy field, for example, 161 00:07:17,400 --> 00:07:20,400 to control wind turbines farms. 162 00:07:20,400 --> 00:07:22,590 Now, from a high level perspective, 163 00:07:22,590 --> 00:07:26,430 we first need to develop or to program the logic. 164 00:07:26,430 --> 00:07:30,450 And we usually usually use PLC programming languages, 165 00:07:30,450 --> 00:07:33,150 for example, ladder diagram, 166 00:07:33,150 --> 00:07:36,300 or block diagram logic. 167 00:07:36,300 --> 00:07:39,900 These are usually graphical programming languages. 168 00:07:39,900 --> 00:07:42,870 So it's kind of a boxes or functions 169 00:07:42,870 --> 00:07:45,480 that we're writing our logic with. 170 00:07:45,480 --> 00:07:46,920 And basically what we're doing 171 00:07:46,920 --> 00:07:50,400 is kind of a flow to do some work. 172 00:07:50,400 --> 00:07:52,920 So we're asking the PLC or the controller 173 00:07:52,920 --> 00:07:55,440 to check value from one of the sensors. 174 00:07:55,440 --> 00:07:57,360 And if the value is greater than X, 175 00:07:57,360 --> 00:08:00,450 then maybe start the fan to cool the room. 176 00:08:00,450 --> 00:08:04,110 Now, this graphical representation of our logic 177 00:08:04,110 --> 00:08:07,020 is in GE is also 178 00:08:07,020 --> 00:08:09,510 represented as XML behind the scenes. 179 00:08:09,510 --> 00:08:13,530 So you can see here the different themes for the functions 180 00:08:13,530 --> 00:08:16,410 and the function itself, and some other parameters. 181 00:08:16,410 --> 00:08:19,920 Now this entire representation of our logic 182 00:08:19,920 --> 00:08:23,700 needs to go through some kind of a compilation process. 183 00:08:23,700 --> 00:08:26,550 So basically we need to transfer what we want, 184 00:08:26,550 --> 00:08:27,960 what we have in our mind, 185 00:08:27,960 --> 00:08:29,910 through the graphical representation, 186 00:08:29,910 --> 00:08:32,580 to some kind of a byte code representation, 187 00:08:32,580 --> 00:08:35,160 so we could transfer it to the PLC. 188 00:08:35,160 --> 00:08:37,260 Now in the GE example, 189 00:08:37,260 --> 00:08:41,880 and again, this is one example of many ICS vendors. 190 00:08:41,880 --> 00:08:42,930 In the GE example, 191 00:08:42,930 --> 00:08:46,140 they're using something they called P code. 192 00:08:46,140 --> 00:08:50,250 This is an intermediate byte code that eventually will be 193 00:08:50,250 --> 00:08:52,200 transferred to the controller. 194 00:08:52,200 --> 00:08:53,220 And you can see here, 195 00:08:53,220 --> 00:08:58,220 for example, this specific byte represents the ADD function. 196 00:08:58,950 --> 00:09:01,533 And obviously we can break it down and parse it, 197 00:09:02,716 --> 00:09:04,920 but this is just a general example. 198 00:09:04,920 --> 00:09:08,660 The next phase would be to transfer this logic to the PLC, 199 00:09:08,660 --> 00:09:09,510 or the controller. 200 00:09:09,510 --> 00:09:11,100 For example, in the GE, 201 00:09:11,100 --> 00:09:13,894 they're using a proprietary product code 202 00:09:13,894 --> 00:09:14,727 to transfer this logic. 203 00:09:14,727 --> 00:09:19,440 So they have SDI protocol that is being used to transfer the 204 00:09:19,440 --> 00:09:22,684 logic that we're writing programming in the engineering 205 00:09:22,684 --> 00:09:23,700 workstation, 206 00:09:23,700 --> 00:09:26,940 compiling it to the P code intermediate byte code, 207 00:09:26,940 --> 00:09:28,500 and then using this protocol 208 00:09:28,500 --> 00:09:31,530 to transfer everything to the controller. 209 00:09:31,530 --> 00:09:35,730 And lastly, the PLC needs to execute it. 210 00:09:35,730 --> 00:09:39,390 And what it does, it receives the byte code, 211 00:09:39,390 --> 00:09:41,370 decodes each byte, 212 00:09:41,370 --> 00:09:44,850 and then executes using native machine code. 213 00:09:44,850 --> 00:09:46,710 And this is how we control. 214 00:09:46,710 --> 00:09:48,060 This is how the controller 215 00:09:48,060 --> 00:09:51,150 is controlling the physical process. 216 00:09:51,150 --> 00:09:54,000 Now the two most important aspects of it 217 00:09:54,000 --> 00:09:55,440 is upload and download, 218 00:09:55,440 --> 00:09:56,910 as I've already mentioned. 219 00:09:56,910 --> 00:10:01,470 The download is used to transfer logic to the controller. 220 00:10:01,470 --> 00:10:05,100 This is from the engineering workstation to the controller 221 00:10:05,100 --> 00:10:08,730 while upload is usually used to do the opposite 222 00:10:08,730 --> 00:10:10,947 to get the logic from the controller 223 00:10:10,947 --> 00:10:12,510 to the engineering workstation 224 00:10:12,510 --> 00:10:15,960 so we could debug it and see in real time what's going on. 225 00:10:15,960 --> 00:10:18,240 So for example, we can do upload, 226 00:10:18,240 --> 00:10:21,840 get all the logic currently running on the controller, 227 00:10:21,840 --> 00:10:26,220 modify it, and then use download to set back the new logic. 228 00:10:26,220 --> 00:10:30,390 So, as I said, most of the time we're using byte code, 229 00:10:30,390 --> 00:10:31,500 that being transferred 230 00:10:31,500 --> 00:10:34,320 from the engineering workstation to the PLC. 231 00:10:34,320 --> 00:10:35,850 However, we discovered 232 00:10:35,850 --> 00:10:37,950 that in download and upload procedures, 233 00:10:37,950 --> 00:10:39,840 not only byte code is transferred, 234 00:10:39,840 --> 00:10:41,760 is being transferred to the controller. 235 00:10:41,760 --> 00:10:45,540 We have the byte code itself, which is the actual logic, 236 00:10:45,540 --> 00:10:49,170 but we also have the source code transferred to the PLC. 237 00:10:49,170 --> 00:10:50,550 We have simple table 238 00:10:50,550 --> 00:10:52,770 with all the information about the variables. 239 00:10:52,770 --> 00:10:55,470 We have input and output configurations, 240 00:10:55,470 --> 00:10:57,840 device, configurations, network configurations, 241 00:10:57,840 --> 00:10:59,610 variable definitions, and more, 242 00:10:59,610 --> 00:11:03,947 and this is all being done so we could transfer the program 243 00:11:03,947 --> 00:11:07,710 to the PLC, but also so we could debug it. 244 00:11:07,710 --> 00:11:10,710 So we're kind of transferring a lot of data objects and 245 00:11:10,710 --> 00:11:11,812 metadata that is related to debugging information 246 00:11:11,812 --> 00:11:16,812 and configuration and metadata. 247 00:11:17,370 --> 00:11:20,227 Now we also have upload 248 00:11:20,227 --> 00:11:23,610 which retrieves back all these data objects 249 00:11:23,610 --> 00:11:26,310 from the PLC to the engineering workstation. 250 00:11:26,310 --> 00:11:29,212 And we discovered that the PLC 251 00:11:29,212 --> 00:11:32,909 only cares about the byte code and the configuration, 252 00:11:32,909 --> 00:11:36,350 even though it receives the source code and the metadata, 253 00:11:36,350 --> 00:11:37,860 it does not parse it. 254 00:11:37,860 --> 00:11:41,880 And it just sits being stored on the PLC. 255 00:11:41,880 --> 00:11:43,257 While in upload procedure, 256 00:11:43,257 --> 00:11:45,270 the engineering workstation 257 00:11:45,270 --> 00:11:46,890 has nothing to do with the byte code 258 00:11:46,890 --> 00:11:49,260 because it does not have a decompiler in it, 259 00:11:49,260 --> 00:11:53,040 but it only cares about the source code and the debug data. 260 00:11:53,040 --> 00:11:55,080 So we were very curious, 261 00:11:55,080 --> 00:11:57,090 how can we take advantage of this? 262 00:11:57,090 --> 00:12:00,870 How can we store some information or data object 263 00:12:00,870 --> 00:12:03,480 on the PLC that will not affect the PLC, 264 00:12:03,480 --> 00:12:06,690 but when retrieved by engineering workstation software, 265 00:12:06,690 --> 00:12:08,370 something will happen. 266 00:12:08,370 --> 00:12:12,210 So I guess you're all in the same mind with me. 267 00:12:12,210 --> 00:12:14,370 So we're going to the evil PLC attack. 268 00:12:14,370 --> 00:12:16,170 Now in the evil PLC attack, 269 00:12:16,170 --> 00:12:19,800 our goal was to weaponize the PLC so we could 270 00:12:19,800 --> 00:12:21,600 attack the engineering workstation. 271 00:12:21,600 --> 00:12:22,433 And to do that, 272 00:12:22,433 --> 00:12:26,670 we decided to store malicious data objects on the controller 273 00:12:26,670 --> 00:12:28,770 and to weaponize it. 274 00:12:28,770 --> 00:12:32,220 So the PLC will be weaponized because it has some malicious 275 00:12:32,220 --> 00:12:35,430 data object that does not affect the PLC 276 00:12:35,430 --> 00:12:38,070 because it doesn't parse the source code, for example, 277 00:12:38,070 --> 00:12:40,200 or other debug information. 278 00:12:40,200 --> 00:12:42,330 While the engineering workstation, 279 00:12:42,330 --> 00:12:45,300 when someone will do upload, for example, 280 00:12:45,300 --> 00:12:48,574 or a script kit, from earlier will do upload, 281 00:12:48,574 --> 00:12:52,140 they will retrieve all the information stored on the PLC, 282 00:12:52,140 --> 00:12:53,148 and hopefully we will be able to find 283 00:12:53,148 --> 00:12:56,670 a parsing vulnerability 284 00:12:56,670 --> 00:12:58,207 or some kind of a flaw 285 00:12:59,324 --> 00:13:00,990 in the parsing of these data objects 286 00:13:00,990 --> 00:13:02,810 that will get us good execution on the 287 00:13:02,810 --> 00:13:05,100 engineering workstation. 288 00:13:05,100 --> 00:13:08,176 Now we decided in our research to research 289 00:13:08,176 --> 00:13:12,189 seven industry leading ICS vendors, 290 00:13:12,189 --> 00:13:17,189 and to see if we can implement our concept on each platform. 291 00:13:17,400 --> 00:13:20,790 Now when we're researching ICS vendors, 292 00:13:20,790 --> 00:13:25,110 the first thing we need to do is to obtain the hardware. 293 00:13:25,110 --> 00:13:29,010 And it's very difficult to obtain hardware ICS. 294 00:13:29,010 --> 00:13:30,993 All you need to do is to go on eBay. 295 00:13:31,860 --> 00:13:35,400 So basically you can buy almost any PLC, turns out. 296 00:13:35,400 --> 00:13:37,277 Yeah, we were not aware of it, 297 00:13:37,277 --> 00:13:40,680 but it turns out like we can buy any hardware you want 298 00:13:40,680 --> 00:13:41,580 on eBay. 299 00:13:41,580 --> 00:13:43,053 You just need money for this. 300 00:13:44,340 --> 00:13:45,315 And this is how we got our hands 301 00:13:45,315 --> 00:13:48,270 on all the equipment we needed. 302 00:13:48,270 --> 00:13:52,890 So we first had setups of seven different product lines, 303 00:13:52,890 --> 00:13:56,400 seven platforms connected in our lab. 304 00:13:56,400 --> 00:14:00,030 And we also configured the engineering workstation to 305 00:14:00,030 --> 00:14:02,250 communicate with these devices. 306 00:14:02,250 --> 00:14:05,400 The next step in our research was to understand 307 00:14:05,400 --> 00:14:07,560 the upload and download mechanisms. 308 00:14:07,560 --> 00:14:10,159 So what we did is we reverse engineered 309 00:14:10,159 --> 00:14:14,370 the engineering workstation, but also the PLC firmware. 310 00:14:14,370 --> 00:14:15,306 We also analyzed the communication 311 00:14:15,306 --> 00:14:19,110 between the software and the PLC. 312 00:14:19,110 --> 00:14:20,430 And we did all of this 313 00:14:20,430 --> 00:14:23,220 to understand what is stored on the PLC 314 00:14:23,220 --> 00:14:26,173 and also retrieved by engineering workstation. 315 00:14:26,173 --> 00:14:29,550 And how can we take advantage of it 316 00:14:29,550 --> 00:14:32,310 and how can we know what is being parsed 317 00:14:32,310 --> 00:14:34,170 on the engineering workstation? 318 00:14:34,170 --> 00:14:37,770 And eventually we wanted to find vulnerabilities in the 319 00:14:37,770 --> 00:14:41,610 parsing flow that will lead us to an exploit. 320 00:14:41,610 --> 00:14:43,920 So what we wanted to do is store data, 321 00:14:43,920 --> 00:14:45,960 malicious data object on the PLC, 322 00:14:45,960 --> 00:14:48,860 find a vulnerability in the parsing flow 323 00:14:48,860 --> 00:14:50,970 of the engineering workstation, 324 00:14:50,970 --> 00:14:53,190 and then hook everything together. 325 00:14:53,190 --> 00:14:55,080 Now, this is exactly what we did. 326 00:14:55,080 --> 00:14:58,800 And we were able to find seven zero days, 327 00:14:58,800 --> 00:15:00,390 a bit more than seven zero days, 328 00:15:00,390 --> 00:15:02,460 but seven chains of vulnerabilities 329 00:15:02,460 --> 00:15:04,800 in all the affected platforms. 330 00:15:04,800 --> 00:15:06,390 And to do that, 331 00:15:06,390 --> 00:15:09,060 we had to research all the different platforms, 332 00:15:09,060 --> 00:15:10,620 including the engineer workstation. 333 00:15:10,620 --> 00:15:13,170 We had to reverse all the different parsing flows. 334 00:15:13,170 --> 00:15:15,960 We had to understand how they implemented the upload and 335 00:15:15,960 --> 00:15:19,140 download mechanisms in each platform. 336 00:15:19,140 --> 00:15:22,650 And we also needed to implement our own client 337 00:15:22,650 --> 00:15:24,810 of these proprietor protocols. 338 00:15:24,810 --> 00:15:27,870 So we had to look at a lot of assembly code, 339 00:15:27,870 --> 00:15:30,179 but eventually it worked out well for us 340 00:15:30,179 --> 00:15:33,990 because we were able to find all of these bugs 341 00:15:33,990 --> 00:15:35,820 and hook it up into chains. 342 00:15:35,820 --> 00:15:40,170 So I want to give you an example of one of the platforms 343 00:15:40,170 --> 00:15:44,400 that we researched to do some magic. 344 00:15:44,400 --> 00:15:49,110 So the example I'm gonna give today is about GE mark six. 345 00:15:49,110 --> 00:15:51,990 So this is the platform that is mainly used 346 00:15:51,990 --> 00:15:53,600 in the green energy field, 347 00:15:53,600 --> 00:15:57,570 for example, to control wind turbines. 348 00:15:57,570 --> 00:16:00,000 And this platform runs, 349 00:16:00,000 --> 00:16:01,710 the architecture of the controller is 350 00:16:01,710 --> 00:16:03,750 Power PC, Big Indian. 351 00:16:03,750 --> 00:16:07,920 It runs real time operating system, RTOS of QNX, 352 00:16:07,920 --> 00:16:12,360 which was very helpful for us because it has a microkernel 353 00:16:12,360 --> 00:16:13,470 of Unix. 354 00:16:13,470 --> 00:16:17,610 And the engineering workstation is called ToolBoxST 355 00:16:17,610 --> 00:16:20,730 It's a.net application written in C Sharp, 356 00:16:20,730 --> 00:16:21,563 so again, 357 00:16:21,563 --> 00:16:25,380 it was quite easy to reverse engineer using reflection 358 00:16:25,380 --> 00:16:27,904 and the protocol between the PLC 359 00:16:27,904 --> 00:16:29,430 and the engineering workstation 360 00:16:29,430 --> 00:16:34,430 is called SDI, runs over TCP, port 5311. 361 00:16:34,767 --> 00:16:36,120 And you, I'm not sure if you can see, 362 00:16:36,120 --> 00:16:38,700 but you have all the components on the screen. 363 00:16:38,700 --> 00:16:41,280 You have the engineering workstation and the toolbox next to 364 00:16:41,280 --> 00:16:42,180 it, you have the controller 365 00:16:42,180 --> 00:16:44,730 and down below you have example 366 00:16:44,730 --> 00:16:47,790 of one of the packets from Rshark. 367 00:16:47,790 --> 00:16:50,010 Now, the first thing that we wanted to do 368 00:16:50,010 --> 00:16:51,720 is we wanted to understand 369 00:16:51,720 --> 00:16:53,910 what is being stored on the controller. 370 00:16:53,910 --> 00:16:56,490 Again, we were looking for a data object 371 00:16:56,490 --> 00:16:58,290 that the controller stores, 372 00:16:58,290 --> 00:17:00,180 but does not use or pars 373 00:17:00,180 --> 00:17:03,750 because we wanted the PLC to be left unaffected. 374 00:17:03,750 --> 00:17:07,680 We found that the binary code or the P code is stored as 375 00:17:07,680 --> 00:17:10,890 dot P code, which was very convenient for us. 376 00:17:10,890 --> 00:17:15,300 And the source code is stored inside an archive file 377 00:17:15,300 --> 00:17:16,680 called device.zip 378 00:17:16,680 --> 00:17:21,210 and inside we had all the XMLs we have seen previously. 379 00:17:21,210 --> 00:17:23,180 Now the PLC or the controller 380 00:17:23,180 --> 00:17:26,400 does not care at all about the source code. 381 00:17:26,400 --> 00:17:27,330 It just sits there. 382 00:17:27,330 --> 00:17:31,260 So whenever the engineering workstation will request it, 383 00:17:31,260 --> 00:17:33,270 the controller will be able to transfer it 384 00:17:33,270 --> 00:17:34,710 to the engineering workstation. 385 00:17:34,710 --> 00:17:37,740 So now we knew what is being stored on the controller, 386 00:17:37,740 --> 00:17:39,660 but we also needed to understand 387 00:17:39,660 --> 00:17:41,370 what are the parsing flaws 388 00:17:41,370 --> 00:17:42,870 in the engineering workstation. 389 00:17:42,870 --> 00:17:46,350 So we were looking for the upload procedure, 390 00:17:46,350 --> 00:17:50,160 and this is the main function in the ToolBoxST program 391 00:17:50,160 --> 00:17:51,900 for the upload procedure. 392 00:17:51,900 --> 00:17:53,550 And in the upload procedure, 393 00:17:53,550 --> 00:17:56,910 we discovered that it reads a lot of files. 394 00:17:56,910 --> 00:18:01,910 And one of the file it reads is this device.zip archive. 395 00:18:02,070 --> 00:18:06,020 Now we found out that the engineering workstation 396 00:18:06,020 --> 00:18:08,130 fully trusts the controller. 397 00:18:08,130 --> 00:18:11,340 And so when the file is retrieved, 398 00:18:11,340 --> 00:18:13,050 it is being extracted 399 00:18:13,050 --> 00:18:15,480 without any limitation or sanitization. 400 00:18:15,480 --> 00:18:19,290 And so we were able to find our first vulnerability, 401 00:18:19,290 --> 00:18:20,250 zip slip. 402 00:18:20,250 --> 00:18:22,232 Now zip slip gives us the ability 403 00:18:22,232 --> 00:18:25,770 to override any file we want on the system. 404 00:18:25,770 --> 00:18:26,790 And we needed to think, 405 00:18:26,790 --> 00:18:29,070 how can we weaponize the controller 406 00:18:29,070 --> 00:18:31,590 by writing any file on the system? 407 00:18:31,590 --> 00:18:36,150 So what we decided to do is to search for DLLs 408 00:18:36,150 --> 00:18:37,380 that are being loaded 409 00:18:37,380 --> 00:18:39,870 after the upload procedure is completed. 410 00:18:39,870 --> 00:18:43,320 And our goal was to drop a DLL 411 00:18:43,320 --> 00:18:45,930 that will get loaded by the engineering workstation, 412 00:18:45,930 --> 00:18:49,140 after the upload procedure completes. 413 00:18:49,140 --> 00:18:51,480 And we did find such a target. 414 00:18:51,480 --> 00:18:55,770 It turns out that BlockwareEditor.dll is a good target 415 00:18:55,770 --> 00:18:56,639 because this DLL is loaded 416 00:18:56,639 --> 00:19:00,150 immediately after the upload procedure. 417 00:19:00,150 --> 00:19:02,970 And so what we did is we took the original DLL. 418 00:19:02,970 --> 00:19:05,496 We injected our own CIL code 419 00:19:05,496 --> 00:19:07,440 into one of the functions 420 00:19:07,440 --> 00:19:10,380 that we knew is getting called by the API. 421 00:19:10,380 --> 00:19:15,380 And we weaponized and archived this device.zip archive. 422 00:19:16,140 --> 00:19:19,440 And we wanted to transfer this new weaponized zip 423 00:19:19,440 --> 00:19:21,180 into the controller. 424 00:19:21,180 --> 00:19:22,013 And to do that, 425 00:19:22,013 --> 00:19:24,960 we had to implement the SDI protocol 426 00:19:24,960 --> 00:19:26,520 and the SDI protocol, 427 00:19:26,520 --> 00:19:27,630 is the proprietary protocol. 428 00:19:27,630 --> 00:19:30,360 So we had to do a lot of reverse engineering in order to 429 00:19:30,360 --> 00:19:33,540 break the protocols that I can understand exactly all the 430 00:19:33,540 --> 00:19:37,920 authentication processes and all the procedures of download 431 00:19:37,920 --> 00:19:40,110 and upload and implement it to ourself. 432 00:19:40,110 --> 00:19:42,780 And the main functions we needed to implement 433 00:19:42,780 --> 00:19:47,780 are 0x18, 0x19 and also 0X0d. 434 00:19:47,910 --> 00:19:48,903 This is to let the controller know 435 00:19:48,903 --> 00:19:53,040 that we want to start malicious download procedure 436 00:19:53,040 --> 00:19:53,873 in our case, 437 00:19:53,873 --> 00:19:57,220 and also override the weaponized archive 438 00:19:57,220 --> 00:19:59,130 on the controller. 439 00:19:59,130 --> 00:20:01,170 And we actually implemented everything. 440 00:20:01,170 --> 00:20:02,913 So I have a cool demo to show you. 441 00:20:04,074 --> 00:20:06,570 Let's hope it works. Yeah. 442 00:20:06,570 --> 00:20:07,403 Okay. The video works. 443 00:20:07,403 --> 00:20:08,850 So what you see here right now 444 00:20:08,850 --> 00:20:13,380 is us weaponizing the archive on the controller. 445 00:20:13,380 --> 00:20:15,180 So this is the attacker's side. 446 00:20:15,180 --> 00:20:17,670 And now from the engineering side, 447 00:20:17,670 --> 00:20:19,200 they're doing, they have a new platform. 448 00:20:19,200 --> 00:20:21,008 They want to do upload 449 00:20:21,008 --> 00:20:22,170 to see what's going on on the controller. 450 00:20:22,170 --> 00:20:25,650 So they will go on the toolbox as the platform, 451 00:20:25,650 --> 00:20:29,523 plug in the IP of the controller and do upload. 452 00:20:30,540 --> 00:20:34,740 So right now all of different files are being yeah. 453 00:20:34,740 --> 00:20:37,290 And now we have a cool run somewhere on the system. 454 00:20:38,380 --> 00:20:41,130 (crowd clapping) 455 00:20:45,510 --> 00:20:46,440 Thank you very much. Yeah. 456 00:20:46,440 --> 00:20:49,080 So one platform is not enough. 457 00:20:49,080 --> 00:20:52,197 And I already told you we've researched seven platforms 458 00:20:52,197 --> 00:20:56,970 and we implemented seven different chains with many bugs, 459 00:20:56,970 --> 00:20:59,260 which are all disclosed and fixed and they're mitigated. 460 00:20:59,260 --> 00:21:01,119 Yeah. Yeah. Yeah. 461 00:21:01,119 --> 00:21:04,830 And I want to show you some cool video we've prepared 462 00:21:04,830 --> 00:21:06,720 with all the different videos we shared 463 00:21:06,720 --> 00:21:07,680 with the vendors. 464 00:21:07,680 --> 00:21:09,093 So let's see. 465 00:21:11,428 --> 00:21:13,050 (crowd laughing) 466 00:21:13,050 --> 00:21:13,883 Yeah. 467 00:21:13,883 --> 00:21:16,487 So right now I've seen synced all the videos, 468 00:21:16,487 --> 00:21:18,690 the same point. 469 00:21:18,690 --> 00:21:20,138 So right now what we're doing 470 00:21:20,138 --> 00:21:22,800 is we're doing the malicious downloads. 471 00:21:22,800 --> 00:21:25,312 So we're weaponizing all the platforms 472 00:21:25,312 --> 00:21:29,658 and once all the platforms are weaponized, 473 00:21:29,658 --> 00:21:34,658 we will wait for our fake run somewhere to jump on all the 474 00:21:35,287 --> 00:21:38,580 on different engineering workstations. 475 00:21:38,580 --> 00:21:42,240 These are the original videos we shared with the vendors. 476 00:21:42,240 --> 00:21:43,950 So that's why you see, 477 00:21:43,950 --> 00:21:46,650 so it started with a calc on some of them, 478 00:21:46,650 --> 00:21:48,420 and then it transferred to Ms. Paint. 479 00:21:48,420 --> 00:21:50,130 And finally to the fake ransomware, 480 00:21:50,130 --> 00:21:52,261 we thought would be cool to show. 481 00:21:52,261 --> 00:21:53,850 Eventually, yeah, 482 00:21:53,850 --> 00:21:56,567 eventually we did end up with a full working PLCs 483 00:21:56,567 --> 00:22:00,531 with our fake ransomware on all the platforms. 484 00:22:00,531 --> 00:22:02,214 And it was a great research 485 00:22:02,214 --> 00:22:06,240 and it helped us to understand some new concepts 486 00:22:06,240 --> 00:22:10,020 in attacking ICS equipment and PLCs. 487 00:22:10,020 --> 00:22:12,489 And thank you very much. 488 00:22:12,489 --> 00:22:14,739 (applause)