Abusing CNC Technologies
summary
A security audit of major CNC controller vendors (Okuma, FANUC and others) uses simulators and real machines, Metasploit and vendor SDKs (Think API), and extracts firmware via an exposed jumper to gain root. Demonstrations include dump G‑code source, install persistent backdoor via controller app, and a catalog of about 17 attack primitives. Practical exploits show change tool compensation by 0.25 mm (and up to 10 mm) to alter or destroy parts, remotely disable emergency stop, and exfiltrate programs; findings go through months‑long responsible disclosure.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:42CNC Machines
- 1:30Industrial Revolution
- 2:17A Complex Supply Chain
- 6:42Research Approach
- 8:31Example: Ethernet Q Commands
- 11:20Identified Problems
- 12:46Program Code Leak via MTConnect
- 14:19Enabled Jumper allowed Firmware Extraction
- 16:12Lack of Resource Access Control on Haas
- 24:47A change of tool geometry...
- 26:29causes micro-defects
- 27:51Damaging a tool / part
- 29:08Leaking Program Code
- 29:59Hijacking a Parametric Program
- 31:08Program Rewriting
- 31:48Damaging a part
- 33:33Theft of Manufacturing Information
- 34:15Triggering Software Alarms
- 36:02Responsible Disclosure
- 37:12Countermeasures
related talks
46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OT
38mHacking Demos, Dirty Secrets, Dangerous Lies, Asset Intelligence
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
01h 02mDIY Command & Control For Fun And *No* Profit
40mHacking Mitsubishi PLC Without Access To Firmware
46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS Hacking