Skip to content

How Are How Are Industry-Control Systems HАСкЕD? Let Me Show You.

Posted in VIDEOS

Hello everyone and welcome back! Thank you for visiting. In today’s video we are hacking a factory that fills water bottles.

Here are my notes:

Most of the questions are just based on you reading the text and clicking once you’ve read them – then we come to actual questions. All are shown in the video but some are here so you can copy-paste or look into:

How many actuators can we observe?
[Include the button to start or stop the plant.(2) + change (general) ]
Start/stop button: registry 16.
Roller engine: registry 3.
Nozzle: registry 2 or 4. We need to spend additional time on that.

Using the script discovery.py, how many registers can we count?
[Look at the code]

After the plant is started and a bottle is loaded, how many registers are continuously changing their values? Lets look into the change:
entry1
[1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]
entry2
[0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]

Which registry is holding its value? Hmm
[ There is 16 numbers – reffer to Most commonly Modbus functions table (1-16) ]
[ Easily try 15 or 16, 16 works – Write Multiple Holding Registers]
[ But they meant to count the results, at the end there is always 1 – 16th one keeps writing]
[ it writes multiple holding registers ]

Which registries are set to 1 while the nozzle is filling a bottle?
[ Just look at the change considering what we know]

Which registries are set to 1 while the roller is moving the bottles?
[ Moving happens before nozzle fills the bottles, therefore we are gonna look at]

seems like its first and third

Which is the color of the water level sensor?
[ Open HTTP and look at VNC]

If you observe the plant at the very beginning, which is the registry associated with the roller?
[ It isnt the last one cause it was used for that other thing, at the beginning we have]
[ only one and three changing, since one is for coils 3 is our best guess ]
[ so roller is registry 3 ]

Based on the previous answer, which is the registry associated with the water level sensor?
[ Logically, only the registry number 1 stays. Turns out coils are for sensor stuff here]

  • So nozzle is either 2 or 4, we wanna find out which
  • Bottle position: 2 or 4 (green sensor)
  • So we need to look into the green sensor

Which is the registry associated with the nozzle?
[ use python scripts to set registry values to 1 – use registries 2 and 4 ]
So conclusion is 4.It ignores the sensors

Shutdown the plant and avoid the plant manager starts it again.
[ python3 attack_shutdown.py IP ]

Start the plant, open the nozzle while bottles are moving.
[ Look at HTTP its hillarious ]
[ python3 attack_move_fill.py IP ]

Start the plant, open the nozzle and stop the rollet.
[x x 0 1 x x…. 1 ]
[ python3 attack_stop_fill.py IP]

Repeat attack in question 1 abusing sensor registries.
[ python3 attack_shutdown2.py IP ]

Repeat attack in question 2 abusing sensor registries.
[ attack_move_fill2.py]

Repeat attack in question 3 abusing sensor registries.
[ attack_stop_fill2.py]

Wanna do it manually? Cat into attack_stop_fill2.py
do it manually using set_registry.py (everything in while loop)

[ THANKS TO EVERYONE FOR WATCHING THAT WOULD BE ALL! ]

I know some questions are missing, they are in the video these are just the quick notes that i wrote while hacking.