Leveraging the SRTP protocol for over-the-network memory acquisition of a GE Fanuc Series 90-30

Details

Serval ID
serval:BIB_6900F7441D34
Type
Article: article from journal or magazin.
Collection
Publications
Title
Leveraging the SRTP protocol for over-the-network memory acquisition of a GE Fanuc Series 90-30
Journal
Digital Investigation
Author(s)
Denton George, Karpisek Filip, Breitinger Frank, Baggili Ibrahim
ISSN
1742-2876
Publication state
Published
Issued date
08/2017
Volume
22
Pages
S26-S38
Language
english
Abstract
Abstract Programmable Logic Controllers (PLCs) are common components implemented across many industries such as manufacturing, water management, travel, aerospace and hospitals to name a few. Given their broad deployment in critical systems, they became and still are a common target for cyber attacks; the most prominent one being Stuxnet. Often {PLCs} (especially older ones) are only protected by an outer line of defense (e.g., a firewall) but once an attacker gains access to the system or the network, there might not be any other defense layers. In this scenario, a forensic investigator should not rely on the existing software as it might have been compromised. Therefore, we reverse engineered the GE-SRTP network protocol using a {GE} Fanuc Series 90-30 {PLC} and provide two major contributions: We first describe the Service Request Transport protocol (GE-SRTP) which was invented by General Electric (GE) and is used by many of their Ethernet connected controllers. Note, to the best of our knowledge, prior to this work, no publicly available documentation on the protocol was available affording users’ security by obscurity. Second, based on our understanding of the protocol, we implemented a software application that allows direct network-based communication with the {PLC} (no intermediate server is needed). While the tool’s forensic mode is harmless and only allows for reading registers, we discovered that one can manipulate/write to the registers in its default configuration, e.g., turn off the PLC, or manipulate the items/processes it controls.
Keywords
PLC
Web of science
Open Access
Yes
Create date
06/05/2021 11:01
Last modification date
06/05/2021 11:37
Usage data