Honey, let's hack the kitchen: attacks on critical and not-so-critical cyber physical systems

In november 2021, I presented a version of this talk at a local non-profit event in Bergamo, Italy. For this event - NoHat - I focused on sharing the stories of low sophistication compromises we observed involving software used to control physical processes. However, for MCH I did some modifications in the title and the presentation itself to share not only the cases, but also how to reproduce them for good. The purpose of this talk is to share with the audience how actors without necessarily a lot of skills or resources are using very simple tools to hack cyber physical systems. I will do some experiments to show very quick results the audience can get reproducing these techniques so that they learn how to find these internet-connected cyber physical assets and notify the owners. The outline of the initial presentation was: • Introduction o Story: Hacked kitchen was supposed to be a gas system • Define low sophistication cyber physical compromises • (De)evolution of cyber physical threats o From state-sponsored to financial, and now opportunistic • Describe low sophistication compromises of cyber physical systems o Distribution and claims of exposed systems o Seeming actor motivations o Common actor techniques o Types of evidence (or lack of) • Low Sophistication Threat Actors Access HMIs and Manipulate Control Processes o Oldsmar, Florida modified HMI on water facility o Israel’s advisory on compromises to water facility systems o Solar energy and dam surveillance system o Hotel BAS • Amateur Actors Show Limited OT Expertise o “Train control system” was in fact a human resources tool o Second “train control system” controls toy trains o Website leaks claiming access to SCADA systems • Hacktivist and Researcher Tutorials o Two hacktivist groups share tutorials for finding and compromising cyber physical systems o Researchers have done too – including a couple examples, such as a recent script to identify tank gauges • Does this activity pose an actual risk to cyber physical systems? o Each incident provides threat actors with opportunities to learn more about OT, such as the underlying technology, physical processes, and operations. o Even low-sophistication intrusions into OT environments carry the risk of disruption to physical processes, mainly in the case of industries or organizations with less mature security practices. o The publicity of these incidents normalizes cyber operations against OT and may encourage other threat actors to increasingly target or impact these systems. • On the bright side… o There are safety methods in place that stop immediate computer instructions from modifying actual physical processes  Engineering and human processes  Missing security on the software side Additional Materials: Please find in this link our recent blog on this topic: https://www.fireeye.com/blog/threat-research/2021/05/increasing-low-sophistication-operational-technology-compromises.html