There will be <8100D> : “Attack Surface of Oil Rigs and ICS”

No ratings

Presented at The GrrCON Cyber Security Summit and Hacker Conference 2024 by

Weston Hecker

Over the past year I have been investigating some software I came across on a honeypot that a co-researcher and I run as a disposable mail service on TOR. We have come across a lot of custom tailored malware using this avenue including several versions of Ransomeware. In early may we came across a sample that is targeting (WITS) information Wellsite Information Transfer Specification and (MWD)Measure while drilling systems associated with land based drilling platforms. This lead me to do research on what the attack surface of a drilling rig would. This talk will go into detail about how drilling systems communicate and some of the attacks that could be performed on a drilling rig. This includes throwing off toolface information and burning out motors in BITs, Disabling H2S and sour gas detection systems, changing survey data to cause the drilling crew to drill out of zone causing sidetrack and time drilling operations that can cost millions of dollars to a drilling rig. And finally modifying chromatograph information and mud weight causing a blow out and potentially burning a rig to the ground. Infection methods include excel files used by directional drillers and MWD staff and 3rd parties. Also have pentested several offshore and onshore oilrigs and ICS systems.