‘Evil PLC’ could turn PLCs into attack vectors

guest · Aug 14, 2022

August 13, 2022

Usually, when you think about someone hacking a programmable logic controller, the PLC is the final target of the attack. Adversaries use other systems to get to what will ultimately let them create some kind of industrial havoc.

But a DefCon presentation from Claroty Team 82 poses a question: what if someone used a PLC as a vector rather than the destination?
Click to expand...

“Evil PLC” is what the researchers believe is a novel attack scenerio: infecting whichever engineer communicates with a PLC with malicious code. As a proof of viability, Claroty published a set of 11 new vendor-specific vulnerabilities that would allow for the attack. Those vulnerabilities are found in Ovarro TBOX, B&R (ABB) X20 System, Schneider Electric Modicon M340 and M580, GE MarkVIe, Rockwell Micro Control Systems, Emerson PACSystems and Xinje XDPPro platforms. All but the Emerson were issued CVEs.
Click to expand...

There are two attack scenarios that Claroty says Evil PLC would be appropriate for. The first would be if the PLC was the only vector into a secure facility. The attacker could wait for an engineer to connect to the PLC and infect the engineer workstation.

Another scenario would be to take advantage of the number of PLCs serviced by outside engineers. One engineer connecting to one PLC could spread malicious code across several enterprises.

“Usually PLCs are the crown jewel. When we're talking about classic attack vectors in ICS domains we're always seeing the PLC as the endpoint, the end goal; but if we're playing with those ideas and shifting our thoughts a bit, we can we can get to new ways of how to defend and attack both networks,” Brizinov said.
Click to expand...

Claroty Team 82: Evil PLC Attack: Using a Controller as Predator Rather than Prey

Executive Summary

Team82 has developed a novel attack that weaponizes programmable logic controllers (PLCs) in order to exploit engineering workstations and further invade OT and enterprise networks. We’re calling this the Evil PLC Attack. Download the full report here (free PDF).

The attack targets engineers working every day on industrial networks, configuring and troubleshooting PLCs to ensure the safety and reliability of processes across critical industries such as utilities, electricity, water and wastewater, heavy industry, manufacturing, and automotive, among others.

Click to expand...

The Evil PLC Attack research resulted in working proof-of-concept exploits against seven market-leading automation companies, including Rockwell Automation, Schneider Electric, GE, B&R, XINJE, OVARRO, and Emerson.

This paper will describe, in depth, not only how engineers diagnose PLC issues, write, and transfer bytecode to PLCs for execution, but also how Team82 conceptualized, developed, and implemented numerous novel techniques to successfully use a PLC to achieve code execution on the engineer’s machine.

The full report includes a list of affected vendors and products, as well as links to their respective advisories and remediations (or mitigations).

Click to expand...

Log in or Sign up

‘Evil PLC’ could turn PLCs into attack vectors

guest Guest

Log in or Sign up

‘Evil PLC’ could turn PLCs into attack vectors

guest Guest

Useful Searches