GreHack 2020: A full chained exploit from IT network to PLC’s unconstrained code execution
Channel: GreHack
Date: 2020-11-22

Speakers: Nicolas Delhaye and Flavian Dola

Nowadays, much of industrial companies own an Industrial Control System (ICS) environment regardless of their activity area. That mainly concerns critical sectors dealing with Operational Technology (OT) network such as in energy, automotive, water and so on. This presentation is intended to demonstrate the risk involved by the integration of such systems according to two major points. The first is that ICS implies a large attack surface due to the presence of many applications and embedded systems. The second is that an ICS is faced with many software design issues because security has not been historically considered. We would like to sensitize the public by emphasizing the points mentioned above through a real scenario based on our vulnerability research, resulting in several CVEs on a popular manufacturer. More precisely, we have succeeded in building a chained exploit which allowed us to take control of a PLC from an IT access by targeting the engineering station. 

https://grehack.fr/2020/program