Pipedream: ‘Swiss Army Knife’ for Hacking Industrial Control Systems

As a final year of university we built a system interacting with PLC and those systems are insecure by default. Usually the code is stored plaintext on the device if you can speak their protocol. Some of those devices are connected to the internet for remote management.

We were tasked to build an IIoT (industrial iot) to interact more securely with them and package that in a UI for fleet management and real time data with grafana. You can interact with most of them using modbus (over ethernet for newer models) to read and write memory directy.

On top of that they have a proprietary protocol that I actually started reverse engineering to do remote updates but never finished it. I am not aware of anything open source for it meaning people still need to use the vendor crappy windows only GUI tool to update firmware. i expect this APT implemented part of that protocol too to mess with the device.

Fun fact - the original picture at the top of the article was the Allen-Bradley PLC-5/80, but the toolkit focused on Omron and Schneider and Codesys systems.

https://web.archive.org/web/20220413195449/https://www.wired...

I’ll bet someone at Wired got a phone call from AB’s lawyers

This is going to be our reality for the next few decades as threat actors focus on new ways to wreak havoc or extract ransom from mid- and small-scale critical infrastructures (I.e., regional water plants, that one factory that keeps the whole town running, power grids, refineries, etc)

This digital transformation/ IT-OT Convergence needs to happen, but it’ll be a bumpy ride

Edit - I say mid and small scale users because the big ones will have the funding to properly secure themselves for the most part. Sure, we’ll see them get hit too but the smaller players I worry about most

I’m still shocked at how much of this crap is connected to insecure networks. Last time I dealt with PLCs which were used on an test automation line was over 20 years ago. And they were airgapped and I actually had to fly to the customer site to update and qualify the software. Even the cross site stuff was tunnelled over private phone pairs.

Surely even now that’s cheaper than connecting all the SCADA crap remotely and getting owned.

I'm a big proponent of isolating control system networks. If someone has physical access to your facility then the game is already up.

I also quite like the idea of control systems being entirely on FPGA. Don't let any part of your computer be the thing that can stop the state machine. That includes network connections and operating systems.

Where do I get this toolkit. Asking as someone with at least 100 Schneider PLCs, some dating back to the 90’s.

Edit: it is only for codesys based plc, which for Schneider are small shitty ones not the big ones orchestrating the whole System.

I wonder more about Schweitzer devices that use codesys

Side note. I have exceeded my monthly limit for Wired and before I bothered to work around that I thought I would see what a subscription would cost. $10 for year 1 apparently. I wondered if someone who subscribed can tell me if it is worth it in 2022

Zero trust networks can't come soon enough