Hack like a movie star: Step-by-step guide to crafting SCADA payloads for physical attacks with catastrophic consequences

No ratings

Presented at ZeroNights 2015 by

Marina Krotofil

Nearly all talks on SCADA vulnerabilities are concluded with the sweeping scenarios of physical attacks with the thrilling catastrophic consequences. Mirrored in Hollywood movies and copious mass media publications, the art of cybergeddon hacks is now known to everybody: you hack into whatever can be considered as “SCADA” and the next moment “all gas flows there” and the world goes nuts. And because nobody knows what the hell that SCADA anyway, “fake it until you (hopefully) make it” works nicely for SCADA talks, shamelessly making monkey of the audience. This talk will give the attendees a crash-course on what to do once one hacks into SCADA. An evil alien targeting a remote process of a respectable complexity is not immediately gifted with a complete knowledge about the process and follows a series of stages before getting to the final attack. How is the process controlled? Which commands does it understand? How do exploitable features look like? All that knowledge is indispensable. And even though it is always possible to inject any input one wants that will not necessarily amount to being able to control processes at will. Process physics and control logic interlocks might annoyingly get in the way of the villain. On the example of forcing traffic light kit into horribly catastrophic states the attendees will gain practical knowledge of SCADA hacking. The talk will take the audience through all the stages of a cyber-physical attack covering the tasks to be completed at each stage and non-trivial detours an attacker may have to take to practically achieve her goal. Hopefully by the end of the presentation the audience will feel empowered to confront the charlatans and enlightened to design own cool and authentic SCADA attacks with the desired physical consequences.