Blowing Up Datacenters: A Deep-Dive into the Feasibility of Remotely Exploding UPS Batteries

No ratings

Presented at DeepSec 2024 by

Wolfgang Ettlinger

Unlike a lot of Hollywood productions, Mr. Robot depicts the technical aspects of compromising systems reasonably realistic. One of the hacks depicted sparked a lively discussion at Certitude: If an attacker fully compromises a battery backup system firmware, does the hardware prevent an attacker from blowing up the batteries? Naturally, we needed to find out. In this talk we dive into the hardware and firmware analysis of an uninterruptible power supply system (UPS) to figure out whether this scenario has any merit. We explore all the steps we took from having a literal black box device to trying to actually blowing up the device. We explore the challenges we faced decoding a firmware using an exotic instruction set, the way we were able to identify the charging regulation mechanisms and how we were ultimately able to modify the firmware to overcharge the battery. We give a short overview of the theory behind blowing up UPS batteries, particularly how and under which circumstances lead acid batteries may produce explosive gas as well as how a UPS may produce a spark to ignite such gas. Lastly, we explain our experimental setup as well as the safety precautions we took to try to blow up our UPS. We discuss the results of our experiment and the real-life risks of these kinds of attacks.