Like Lightning From the Cloud: Finding RCEs in an Embedded TLS Library and Toasting a Popular Cloud-connected UPS
No ratings
Presented at BlackHat Asia 2022 by
Modern Cloud-connected devices are based upon a single TLS connection to the Cloud, through which they can be controlled. Interaction with the local network is limited to a bare minimum -- limiting the devices' attack surface. This puts a heavy burden on the security of the TLS implementation itself, since any bug found in it can give an attacker from the Internet the ability to abuse the Cloud-connected devices, and potentially breach any network where such devices are installed.With this notion in mind, we decided to research a widely popular Cloud-connected UPS device, and have discovered critical vulnerabilities in its TLS implementation that can lead to remote-code-execution, in a pre-authentication stage. Exploiting these vulnerabilities could allow attackers to remotely take over the power lifeline of impacted organizations directly from the Internet.The talk will cover how we managed to bypass hardware mitigations and break the encryption of the UPS firmware, leading us to the discovery of two bugs in the device's TLS implementation. One of these bugs can allow an attacker to masquerade as the trusted UPS Cloud service, while a second bug is a heap corruption in the TLS reassembly routine. Both bugs can lead to remote-code-execution. Controlling a UPS device allowed us to study the inner workings of the AC\DC subsystem it manages, and demonstrate the destructive potential of our findings. We will demo how this attack can damage the UPS device itself and its downstream devices.Analysis of the discovered vulnerabilities uncovered that they stem from improper use of a 3rd party TLS library, used by a variety of industrial controllers, networking equipment and other Cloud-connected devices. We will conclude our talk by sharing analysis of vulnerable applications that were found to be affected, and outline takeaways on the security of embedded TLS implementations.