Never Trust Your Inputs: Causing 'Catastrophic Physical Consequences' From The Sensor...
summary
Shows how an attacker makes one analog line mean 7 V to a controller and 1 V to logging by abusing ADC timing, phase and amplitude. Demos use Arduino + signal generator, oscilloscope and a real Siemens S7 PLC to: oversample a SAR ADC with a 125 kHz clock so sample‑holds occur ~1.9 kHz, force a delta‑sigma ADC to output a low‑frequency sinus when fed a 31 kHz tone (reported ~120,000× difference), inject negative voltages that corrupt other channels and even burn hardware. Includes countermeasures: matched LPFs, voltage dividers, higher‑bandwidth ADCs and randomized ADC read timing.
AI-written summary · about
chapters (12)
- 0:00Introduction to ICS attacks
- 2:29Analog signal vulnerabilities
- 5:41Demo: Fooling a PLC
- 8:10Understanding ADC mechanics
- 11:06Attacking SAR ADCs
- 18:10Exploiting Delta Sigma ADCs
- 25:18Software timing attacks
- 32:05Data sheet analysis
- 35:01Amplitude attacks
- 42:25Attack implementation
- 45:11Mitigation strategies
- 51:23Conclusion and Q&A
related talks
45mAnalogy Cyber Security—From 0101 to Mixed Signals
44mICSCorsair: How I Will PWN Your ERP Through 4-20 mA Current Loop
47mMiniaturization
44mRogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
16mCAUTION: HIGH VOLTAGE, LOW SECURITY – A Familiar Tale of...
47mExfiltrating Reconnaissance Data from Air-Gapped ICS/SCADA Networks
50mDead Man’s PLC: Ransoming the Physical World via Operational Technology