hello and welcome to our talk top down
and bottom up exploiting vulnerabilities
in the ot cloud era
um before we begin let's uh talk a
little bit about
who we are so um
my name is sharon brazinov i'm a
vulnerability team res
vulnerability research team lead at
clarity uh and with me is uri katz
our senior security researcher at
clarity
and we're part of a team that
researching and trying to find
vulnerabilities
in ot equipment so you can see in our
background
in the in the picture in front of you
our cool
lab this is our playground where we're
trying to find and exploit
vulnerabilities uh we're working with
different vendors
to find vulnerabilities disclose the
vulnerabilities to the vendors
and basically we are working with them
to fix any security issues that we're
finding
and eventually we're publishing our
research
on the vulnerabilities that we're
finding so you can see
the table in front of you of some of the
vulnerability that we found
in many of the ics vendors
we're also participating in different
competitions
uh we've participated in pawn to own in
2020
uh we've participated in defcon ics
ctf where we won the first place and
we're doing
conducting uh lots of research and
competitions
in those areas so with
that we would like to discuss uh today a
little bit about
scada infrastructure in the cloud so we
would like to just
describe what it means of ics
security uh in the cloud what it means
to have
infrastructure uh in the cloud and how
can
devices ics devices and ot equipment
can communicate with uh cloud
infrastructure
outside the perimeter and outside the lt
network
so let's start uh with
what is a typical scada infrastructure
so we have the purdue model as you're
all aware of we have a
couple of layers that in each layer we
have different devices with different
capabilities
and roles in the lowest level in level
zero we have a field devices field
devices or actuators
and sensors they are communicating
they're sensing and uh
doing actual and physical work
in our world above that we have
plcs so we have the brains plc's and
rtus
and above that we have hmis and
engineering stations
that are controlling and interacting
with the plcs
so for example if i would like to
download code
to the plc i would use a generic station
to program
uh the the logic and transfer it to the
plc
in which the plc will digest the logic
will execute the logic and control the
field devices the sensors and the
actuators
so if we're taking this image or the
purdue model to be very concise we can
see here just engineering station and
hmi
communicating and interacting with plc's
and the plc's are connected to valves
in this example and the plc's are
actually
doing something physical sorry the
valves are doing something physical in
our world
where the plcs are controlling those
valves and the humans the engineers
still paradorus
are controlling the plc's through the
engineering station
and the hmi the engineering station is
meant
for programming and configuration
mostly while the hmi is mostly for data
acquisition
and for the engineers to understand
what's going on within the process
so if we're if we're taking this further
today there is a huge trend to move
everything to the cloud it started with
it infrastructure
servers are no longer physical boxes
they're kind of a server somewhere in
the cloud
and it's starting to get into the ics
and ot networks too
and we're seeing more and more devices
starting to be controlled
and managed by cloud-based
infrastructure
and we're also seeing this through
cloud-based infra
cloud-based scada infrastructure as well
so
why do people want to move to the cloud
there are a couple of reasons
first of all telemetry so
all the devices are transmitting
telemetry
always to the cloud so it's very easy to
control and understand what's going on
in all of the devices there are nice
dashboards and
trends and graphs so it's easier to
understand what's going
on in terms of telemetry and logs the
management of logic
can be done through the cloud so usually
there is a console management that you
can
go into and manage all of the devices
that are being
controlled by the the cloud
infrastructure which means
we can download logic through the cloud
to all of the devices at once so it's
very easy setup
we can have lots of diagnostics and
troubleshooting because
everything is connected to the cloud you
don't need to be inside then the network
you can be
somewhere in the internet just go online
to the website
the console management that is exposed
to the internet
and diagnose and do some troubleshooting
get all the logs and manage the
uh the fingers manage the logic of the
devices
and control the devices remotely without
the need to be physically inside the
network
and obvious obviously it's a centralized
view of processes
and redundancy so when we're talking
about cloud-based
infrastructure we're we're usually
talking about lots of instances in
different regions so we have lots of
redundancy
and we can control and manage all of the
devices that are directly connected
to the cloud so if we're taking this a
bit
further and we're reevaluating the new
produce model so basically it's all
broken we don't have
these layers anymore because all the
plc's
and when we're talking about ics
infrastructure that is connected to the
cloud
all the plc's all the hmis all the the
generic stations
are basically controlled and managed
through the cloud
so there is no longer need for the
purdue module because
everything is connected and managed
through the
cloud all the plc's are connected to the
cloud from one side
and the cloud or the management console
which is basically a website
in the cloud uh of which engineers
operators administrators can log in to
the internet
uh in to the webpage in the internet
somewhere
uh in the cloud we're seeing and control
and manage these devices
so if we reevaluating the
the little screenshot that we've seen
before so the engineering the hminder
plc
now we don't need to be in the same
network
because the plc's are connected directly
outside
to the parameter connected directly to
the cloud
which is a server somewhat somewhere in
one of the
cloud providers such as aws azure
or google computer compute gcp
so we're having the functionality of the
hmi
and engineering provided through the
console management
in the cloud where engineers can just go
online to one of the websites
and manage the devices that are
controlled by the
management console and the scada
infrastructure through the cloud
so everything is much easier for
engineers
and asset owners because now they can
control
all the equipment through the cloud
which means
through the internet and they don't have
to be physically
present inside the network
so what kind of roles do we have with
this kind of new infrastructures
so we have the same old roles
such as programmers that are writing the
logic
we have management which are uh kind of
uh the
people are managing the the ot managers
that are managing the operations and
managing the process
so they're doing kind of uh view reports
with kind of hmi functionality
or device commissioning when they're
buying new devices and we're also having
the administration
uh level which is responsible for
creating new accounts and they're
responsible for security so
all of these different walls are
communicating
uh to the cloud-based management console
so
they're communicating with the
management console somewhere in the
cloud
basically and usually it's a website
where they can
go online log in and then
depending the functionality they can
program they can upload
a program or logic to be transferred to
the end
device to the edge device or they can
view reports it's kind of a hmi screen
you would say or do some kind of
administration
processes such as creating new accounts
for uh engineers or ot managers
or fix uh
permissions and policy for other users
so
all of these work roles or different
personas
in uh in the this infrastructure are
communicating
with one entity which is the cloud-based
management console
and everything from there is flowing to
the plc's or to the end devices
which can be other devices than plc's
and control and manage these end devices
through the management console so this
is
the new era where everything is
connected directly to the internet
and there is no no longer need for vpn
accesses
or other kind of uh phys being
physically
present inside the ot network this is
the modern era now let's
we want to give you an example because
all we said up until now is kind of
abstract there are plcs and devices
connected
to a cloud-based management console and
we have
engineers communicating with this
console to control the end devices but
let's give a a real example and we have
codices
so cordyce's is
european company it's a it's a great
vendor we're working closely with
and they're developing uh their
development system which
enables programming and configurations
of plcs
so you can you can use their platform to
create
logic and download this logic to the
plcs
the plcs are usually running the codesys
runtime
which analyzes and dissect the the logic
that you the engineers are writing using
the codesys development system
and the plc using the codesys runtime
can execute the logic to control field
devices
such as actuators and sensors there is
a variety of plcs and vendors that are
using codices
as part of their uh runtime
engine so we have wagon we have abb
ac500 we have plc next
and and many more and codices can even
run on raspberry pi
and and other platforms as well so
here is an example of codices ide
as you can see it's kind of a basic idea
where you have the target
the plc target and you have
the ide interface where you can write
the logic
it can be a lighter diagram where it can
be structured text
or other ics related programming
languages
and you can compile the logic and
transfer it to the codesys runtime which
it sits on one of the supported plcs and
platforms
so this is a cartesian's
ide and codices development system
now codesys took this one step further
and created their own automation server
so instead of managing plc's
uh back to back kind of uh with
uh with the necess necessity to be in
the same network
they've created the corresponds
automation server which allows
codices supported devices to be
connected to a centralized
uh cloud-based management console
where asset owners can manage plc's
remotely so basically
they can just like we discard discussed
previously they can manage
and control all of the supported plc's
remotely
through the cloud for every instance
every every device that is
uh linked and associated with the cloud
and codices are providing lots
of features above this cloud platform so
basically
they're offering hmi capabilities with
their
with their uh web visual platform so
basically you can create screens
uh that that you can see
through the the a kind of a nice gui of
what's going on in the process because
the plc
is sending telemetry and data all the
time to the cloud
so you can visualize all the process
you're using their web visio features
and you can also use their kind of
engineering
working station capabilities to
create logic using using their ide
transfer it to the cloud based platform
which is the automation server and
download the logic and configuration to
all the connected plcs
again everything through the internet so
basically when you're setting up your
account in cody's
automation server you will receive your
own aws based instance
you can see here an example of such an
instance
and this is a personal instance for each
account
that you can just go online to this
instance and control
all the associated linked devices
so let's see an example real quick here
is an example to
devices that are being controlled
through this
platform so basically what you're seeing
here is a website somewhere in the
internet
using one of the instances that codec is
created for the account and you have
all your linked devices to control so
you can
go in into one of the devices and do
a download logic you can change
configuration you can change
settings on these devices and everything
will be
transferred and downloaded to the plc
because
the plc is directly connected to the
cloud
platform now codices
took this even one step further and
created the codices
store so basically it's like the apple
store
or the google play store where you can
download applications
but just for your code in your process
so basically you can download examples
of
already created applications or you can
download libraries or you can download
clients that will be run on the plc
and you can use the store to accelerate
the development cycle and use code
that other people wrote without invading
inventing the wheel
so if someone else wrote the code to
process some kind of a mathematical
algorithm
so you can just download the the library
that he created
and maybe pay for this if they're
selling this
with by money or not or you can download
for free
if uh the developers are offering this
for free but the basic idea is the same
you can just
as a developer you can offer your own
code or libraries or
programs that others can download and
use in their projects
uh so this is an example of aws iot core
client that is being offered for
free as you can see here and other
developers and asset owners can
download and use this library for free
to integrate
their plc with aws iot platform
and the final feature that we want to
discuss uh
regarding codices is the web visual so
it's a visualization
kind of a hmi in the internet browser
via
html5 so you can create all these kind
of different
screens to interact with
so basically the plc's that are linked
to the cloud are sending telemetry and
data all the time
about trends about tags about
any anything that was configured in the
logic and
you can create screens that will take
all of the
aggregated data to present
in a very nicely presented view and gui
just like a normal hmi just in the cloud
just in a screen
that is based on html5 and it's very
easy to control and create
nice screens that anyone can access
with the proper acls
so we have engineering working station
and we have hmi and we even have the
codices
store to create download applications
and we have every all these services in
one platform that is connected
through the cloud through the internet
and all the connected plcs can be
managed
controlled and present information
everything directly through the internet
so this is a great example
uh to what we discussed earlier now we
would like to discuss
wago so wago is a german company
european
company they have uh two main product
plc products uh which
are the 750 and 750 exterior and the pfc
series pfc 100 and pfc 200
we mainly focused on pfc 100 and 200
and this is this is an example for a plc
that is linux based and it
it is running the codices runtime so it
has
a great integration with codices and
all the great features that i mentioned
earlier can be used with logo
so basically wago runs the codices
runtime
and the codices runtime can communicate
with other currencies related platforms
and systems
so this means that we can control our
wago
pfc 100 200 using codices automation
server
and basically manage all of our wago
plc's
through the cloud so the wagon pfc 100
200 is a is a basic
plc it runs it has lots of functionality
that uh most of uh plc's
uh contain this day support of all
standard field bus
protocols and ethernet standards such as
profibus modbus profinet etc
and it has lots of interfaces such as rs
485 and rs-232
and as i've mentioned it is running
the codices runtime which means it has
great integration with all of the
codices platforms
and even the programming can be done
through codices and we will show you a
couple of examples
very soon so let's take a look at how
the attack surface
is changed after moving to the cloud
and to do that we first need to
understand what attackers are trying to
achieve
and it's pretty easy in the ics world
attackers are
either trying to gain money or to cause
damage
and attackers reaching an ot network
have a few options
they can start by shutting down
equipment randomly
stopping plc's and this is sometimes
effective
and really noisy more complex attackers
will try to modify parameters
and that requires a bit more knowledge
about the operation itself and knowing
what to change
another thing we can we see is the
attackers wiping data or encrypting data
and this is mostly
for money we see that in the latest
transformer attacks
so how a traditional ics attack looks
like
is uh first attackers need to bypass
many protections and firewall to even
reach
the alternate wall and even if they
reach a computer inside the network
they have some challenges most of the
equipment
is backed up or has redundant equipment
to take its place so if an attacker
stops one plc
the redundant redundant one will start
working
and there are also many safety checks
along the way
so attackers really need to have a good
coverage of
over the rt network in a in order to
really cause damage
in cloud attacks the thing that
separates attackers from the
ot network is usually just username and
password
and when attackers gain access to a
cloud
they have a full view of the operation
and can
instantly modify parameters and
change values in plcs
in our research we developed two main
methodologies for cloud attacks
the top down in the bottom up the top
down starts with attacking an
engineering station
then going up to the cloud and attacking
all of the managed
plc's the bottom up attack starts with
the plc
then we climb our way up the cloud to
take
control over the entire operation
so let's start with the bottom up attack
we use the
wago device to demonstrate this attack
and drug devices have a a configuration
port open on port 6626
and this is used for the initial
configuration like setting the hostname
or subnet for the device
this port remains open after the initial
configuration which gives us
a big attack surface
so we found two vulnerabilities in the i
objective process
a shared memory overflow and the stack
buffer overflow
let's start with the shared memory
overflow
the io check d has a write register
command which writes to a certain
memory location and this is limited by
the count parameter
we found out that that the count
parameter is checked for
every table that you can write for
except for table 99
which is also stored in the shared
memory region
so we were actually able to use the
white register command to write
more than the size of table 99 and
overflow it into another memory region
the memory region is in the shared
memory so
by itself this is not that useful
the second vulnerability we found
is in the response for the read variable
command
the read variable command assumes that
the maximum size is 1400 bytes
and this is the maximum count
this is the maximum count size
but if we are able to write more
than 1400 bytes we are able to
[Music]
read more than that so the read register
command for table 99
can return more than 1400 bytes and copy
that
to the stack buffer of the response
and in that way we can write our payload
using the write register command and
while reading it with a read
register command overflow the buffer
with our payload
so this is the the output of the script
that runs
the full remote code execution
so after we got our remote code
execution we started looking for ways
to get up to the cloud and we discovered
the codesys web visual option
this option lets you write javascript
and html pages
on the plc and present them remotely
this option is also open to from the
cloud
which means that any operator viewing it
will have a cloud cooking
so if you have control over the plc
itself
and we can change the javascript for
example
we can change it to get the cookie from
the person viewing it
and create a user for the cloud where we
control the username and the password
so this gives us a new user in our
control
in the cloud so let's
chain it all together we start with a
read and write register buffer overflow
and that gains us remote code execution
on the ribbon plc
then we change the javascript to
create a new user in the cloud and we
use
that cloud to take over the entire
operation
so starting from plc
and going up to the cloud and
using that to manage and
control the entire operation
the second method we developed is the
top down attack
the top-down approach starts with
targeting an engineering station
and we decided to look at the codesys
packages packages are just
normal zip files which contains
dependencies
and sometimes even dlls we discovered
that
those packages are not signed and we can
change
them to contain our malicious code
so we actually made a package that when
an engineer installs that
would get his cloud connect credentials
from the engineering station and send it
back to us
so once we have access to the cloud we
can change running modes of the plc's
stop them or even change process values
but the holy grail of attacks is to
actually run
native code on the plcs this is
not yet published so we can't speak
about details here but
we actually managed to run
native code on the wago plc's from the
cloud
so once we have the cloud credentials we
were able to
execute code on all of the plc's in the
operation
so a quick recap on the top down attack
we create a malicious package uploaded
to the code system
operators installed this package and
the cloud credentials of the operators
are sent back to us
then we can do whatever we want with the
uh
with the operation we can stop plcs we
can run code we can do
anything we want with the operation so
starting from an engineer
moving to the cloud and then to all of
the
devices in the operation
that's it for today thank you everyone
who attended our talk in defcon 29 scs
village we apprehend
we hope you enjoyed our uh talk about
attacking a cloud-based infrastructure
in ics and if you have any questions now
it's the time
thank you very much