NGC17 - NECSTLab visiting Sysdig

1. System Security Research @ NECSTLab
+
An experimental security analysis
of an Industrial Robot Controller
Marcello Pogliani
NECSTLab @ Sysdig, CA, June 2017

2. NECSTLab Research in System Security
● Novel attacks on bleeding-edge technology
● Malicious software (malware) analysis
● Computer forensics
● Mobile (mostly Android) security
● Web security
● Bank fraud analysis and detection
● Anomaly-based intrusion detection

3. Sample Projects
● A. Continella et al., ShieldFS: a self-healing,
ransomware-aware filesystem - ACSAC 2016 &
BlackHat 2017
● M. Polino et al., Jackdaw: Towards automatic
reverse engineering of large datasets of binaries -
DIMVA 2015
Malware analysis

4. ShieldFS: Key Takeaways
The way ransomware interacts with the filesystem is
significantly different than benign applications
DETECTION. We can detect ransomware behaviors by
monitoring the file system activity
PROTECTION. Mere detection is insufficient
● Stopping a suspicious process may be too late
● We need to protect users’ data, reverting the effects
of ransomware attacks.

5. ● Automated Behavior Generalization
○ System to Assist Malware Analysis
○ Automatically Extracting High-Level Behavior
○ Remove a Time Consuming Manual step in
Static-Dynamic Analysis
○ Automatic Algorithm to Associate Semantic Tags
● Anti-Analysis Issues
○ Built a Generic Unpacker DBI based
○ Dynamic Protection Framework
Jackdaw: Key Takeaways

6. Sample Projects
● M. Carminati et al., BankSealer: an online banking
fraud analysis and decision support system - IFIP
2014
(banking) fraud detection

8. Sample Projects
● C. Zheng et al., On-chip system call tracing: A
feasibility study and open prototype - CNS 2016
● N. Andronio et al., HelDroid: Dissecting and
detecting mobile ransomware - RAID 2015 and
BlackHat EU 2016
● L. Falsina et al., Grab'n Run: Secure and Practical
Dynamic Code Loading for Android Applications -
ACSAC 2015
mobile security

9. ● D. Quarta et al., An Experimental Security Analysis
of an Industrial Robot Controller - S&P 2017 &
BlackHat 2017
Sample Projects
cyber-physical systems security
We’ll now focus on this project!

10. An experimental security analysis
of an Industrial Robot Controller
Davide Quarta, Marcello Pogliani, Mario Polino,
Federico Maggi, Andrea Maria Zanchettin, Stefano Zanero
Appeared at the 38th IEEE Symp. on Security and Privacy

11. Takeouts

12. Motivation: Industry 4.0 Trends
Interconnected
Flexibly
programmable
Remotely
exposed

13. What is an industrial robot?

15. Industrial Robots?

16. Industrial Robots?

17. Industrial Robots?

19. Co-Bots: No Cage Required!

20. Motivation: Lack of Awareness
➢
➢
➢
➢
* some users did not answer all the questions

21. How do we define a robot-specific attack?

22. Requirements: Laws of Robotics
➢
■
■
➢
■
■
➢
■

23. Requirements: Laws of Robotics
➢
■
■
➢
■
■
➢
■

24. Requirements: Laws of Robotics
➢
■
■
➢
■
■
➢
■

25. Requirements: Laws of Robotics
➢
■
■
➢
■
■
➢
■
Robot-specific Attack:
Digital-borne violation of any
of these requirements

26. 5 Robot-specific Attacks

27. Attack 1: Control Loop Alteration
!

28. Attack 2: Tampering with Calibration Parameters

29. Attack 3: Tampering with the Production Logic

30. Attack 4 & 5: (Perceived) Robot State Alteration

31. Custom Physical Protections, if any (despite regulations)

32. From Attacks to Threat Scenarios

33. Case Study

35. ARM, Windows CE .NET 3.5
VxWorks 5.x RTOS
(PPC, x86)
FPGAs and
discrete logic

39. Attack surface
USB port
LAN
WAN
Radio

40. Industrial Routers

41. Vulnerabilities

42. Timeline

43. Full Controller Exploitation

44. Attack POCs
DEMO

45. POC 1: accuracy violation (video)

46. Attack POCs

47. POC 2: Safety Violation
Teach Pendant
Malicious DLL

48. POC 2: Safety Violation
Teach Pendant
Malicious DLL

49. Attack POCs

50. POC 3: Integrity Violation
➢
➢

51. Looking forward

53. Collaborative Robots
❖
❖
❖
❖

54. Conclusions: Future Challenges
➢
➢
➢
➢

55. Conclusions
➢
➢
➢
➢

56. Questions?
Marcello Pogliani
@mapogli
marcello.pogliani@polimi.it
http://robosec.org
Slide credits: Davide Quarta
Thanks to: Davide Quarta, Mario Polino, Federico Maggi, Andrea M. Zanchettin, Stefano Zanero