"Attacking industrial remote controllers for fun and profit"
summary
Security assessment finds seven vendors of industrial RF remote controllers vulnerable to easy attacks: record-replay works across devices using $40 SDRs, full command injection and remote pairing takeover are possible after reversing payload formats, and bootloader tooling leaks cleartext programming passwords so malicious firmware with forged CRCs can be installed. Research builds an automated bridge, the RFQuack device, and uses USRP/bladeRF plus logic analyzers to reverse physical and application layers. Responsible disclosure with ZDI runs six months and produces ten advisories.
AI-written summary · about
chapters (15)
- 0:00Start
- 0:50Industrial Remote Controllers
- 3:44Tested vendors -- All global distribute
- 13:01On a Real Installation
- 16:40COMMAND REPLACEMENT
- 17:30Demo
- 21:50Reverse Engineering is Challenging
- 23:47Abstracting low-level operations
- 24:31Custom, new GnuRadio block
- 25:30Payload Reverse Engineering
- 28:29Play Around With the Pairing Code
- 34:55Malicious Firmware
- 36:17RFQuack
- 40:43Responsible Disclosure Discussion
- 41:29Conclusions
related talks
55mAttacking Industrial Remote Controllers
59mWireless security testing with attack
27mWIFI-Important Remote Attack Surface: Threat is Expanding
30mDemystifying IoT/OT Hacks With SDR
51mRadio Hacking: Cars, Hardware, and more!
45mOutside the box: pwning IoT devices through their applications
31mConquer the Enterprise from Inside
37mBringing Software Defined Radio to the Penetration Testing Community