Hacking Critical Infrastructure Like You’re Not a N00b
•
0 likes•670 views
This presentation is targeted towards an audience that already understands how to compromise the embedded systems that run a process and now is looking at manipulating the physics of the process itself. In as much as time allows, it will cover all the things necessary to accomplish more than exercising the automatic shutdown logic of a process. (Source: RSA USA 2016-San Francisco)
Recommended
Recommended
More Related Content
Viewers also liked
Viewers also liked (12)
Similar to Hacking Critical Infrastructure Like You’re Not a N00b
Similar to Hacking Critical Infrastructure Like You’re Not a N00b (20)
More from Priyanka Aash
More from Priyanka Aash (20)
Recently uploaded
Recently uploaded (20)
Hacking Critical Infrastructure Like You’re Not a N00b
- 1. #RSAC Jason Larsen Hacking Critical Infrastructure Like You’re Not a N00b HT-F03 CyberSecurity Researcher IOActive
- 2. #RSAC I just got a shell on the control system, now what?
- 5. #RSAC Hazard Mitigations Nearly every hazard will have some mitigation Just because there is a mitigation, doesn’t mean that mitigation is effective There is always a strong pressure to declare a problem solved
- 7. #RSAC Let’s Make Some Moonshine
- 8. #RSAC Let’s Make Some Moonshine
- 9. #RSAC Let’s Make Some Moonshine Moonshine tastes awful! Burn it instead!
- 10. #RSAC Easy Button Attacks • At S4 Reid Wightman described one such attack….. • Variable frequency drives have skip frequencies to stop the VFD from operating at a resonant frequency • The engineer has already calculated the exact VFD frequency that is a problem • Easy button attacks are great if they happen to line up with what you want to achieve What if there is no easy button?
- 11. #RSAC Possible Weaponization Strategies Flaming pool of death Flaming inferno of death Steam Collapse
- 12. #RSAC Flaming Pool of Death
- 13. #RSAC Flaming Inferno of Death
- 15. #RSAC Point Database • The attacker will need to extract the point database • This is a toy process so it only has 22 points
- 16. #RSAC Timing And State Diagrams (TSD)
- 17. #RSAC Processes aren’t vulnerable all the time
- 18. #RSAC
- 19. #RSAC
- 20. #RSAC Learning phase Extracted “runs” Believable noise Spoofed sensor signal
- 23. #RSAC Vacuum Breaker - Move Along Steam Transfer Temperature/Pressure Builds
- 24. #RSAC Just letting go is like ringing a bell
- 25. #RSAC
- 26. #RSAC Mapping TSD to Devices Alarm Pathways and Sanity Checks as well as Data Flows
- 27. #RSAC Distributed Checks Sending messages between devices is messy The process doesn’t stop to wait on your message This causes lots and lots of edge cases Autonomous agents in each control “zone” works better Each agent will need it’s own independent TSD logic Mapping Devices to Implants
- 28. #RSAC Creating and Validating TSD
- 29. #RSAC Creating and Validating TSD
- 32. #RSAC Best-Fit Monotonic Line Approximation
- 33. #RSAC Relaxing a graph matches points based on artifacts just like a human would Force Relaxing
- 34. #RSAC For every pair of time series, we can calculate Scale – 5.25 Offset - 52.64 Slope – 2.28 Delay – 9 seconds Fitness – 88.06% In general, the greater the disturbance in the loop, the better the correlation matrix will work Model Outputs
- 35. #RSAC Let’s overlay the correlation matrix on top of our existing TSD diagram
- 36. #RSAC Uncertainty Tables An exploit chain can always be built, but how confident are you it will work?
- 38. Feedback with Topology How do you know when something has gone horribly wrong on the far side? There is no “Pipe Roundness” sensor
- 39. #RSAC Topology Invariance Topologies are generally static in a process operating in the same mode Individual characteristics of a topology may be conserved
- 41. #RSAC Flow A Flow B Flow C (Integration under the flow curve yields volume) Level A Level B Level C (Level A * Volume A) = (Level B * Volume B) + (Level C * Volume C) (Flow A) = (Flow B) + (Flow C) (Level A * Volume A) = (Flow B) + (Flow C) Topology Characteristic Invariance Mostly true, but stuff happens
- 43. #RSAC Feedback Till Topology Changes Success can often be registered as a topology change Often some values that are conserved are no longer conserved during the damage phase
- 44. #RSAC Why don’t we see more “Cyber Weapons”? Given the amount of work, there is also a high degree of uncertainty that the weapon will actually work You’re not always at war with someone so you need a kindler- gentler way of testing Economic disruption can be used to validate future cyber weapons against real targets Expect to see an increase in economic disruptions in high-value targets
- 45. #RSAC Ukraine Attack This is more of an easy-button attack with some force multipliers • Attackers only had to turn off the power • No great knowledge of the process required • Typical DoS against the call center