Dead Man’s PLC: Ransoming the Physical World via Operational Technology

### Overview In this presentation, Ric Derbyshire (Senior Security Researcher at Orange Cyberdefense) and Charl van der Walt (Head of Security Research at Orange Cyberdefense) discuss the current state of operational technology (OT) security and propose a future threat model called "Dead Man's PLC." While industry concern regarding physical disruption and loss of life in OT is growing, the speakers analyze a 35-year historical dataset of reported OT cyber incidents. They show that despite a massive post-2020 surge in attacks impacting OT, the overwhelming majority stem from IT ransomware and double extortion using IT tools high in the Purdue model, merely causing secondary knock-on effects in OT.

Applying Cohen and Felson's criminology framework (Routine Activity Theory), the speakers explain that cybercrime requires a motivated offender, a suitable victim, and the absence of a capable guardian. While OT environments lack technical guardians and victims are plentiful, cybercriminals historically lacked motivation due to high return on investment (ROI) in IT extortion and the lack of a viable extortion model in OT. Traditional encryption and data theft do not scale or work well in OT, prompting the researchers to design a viable cyber extortion model targeting physical operations directly.

### Key Topics - **OT Extortion Criteria**: To successfully extort an industrial facility, an attack must meet six specific criteria: scalability (operating without needing bespoke root exploits for diverse firmware), stability (keeping operations intact during extortion), optimized consequences/credible threat (threatening meaningful physical disruption), tampering detection (noting if devices are modified or removed), preventing recovery (ensuring defenders cannot simply reflash or replace devices), and disarming upon payment (reversing changes cleanly to maintain criminal credibility). - **The Dead Man's PLC Model**: Rather than attacking device vulnerabilities directly, the attack targets the internal software engineering supply chain via the engineering workstation (EWS), which prior studies (e.g., SANS and Nozomi) show is a common attack vector (34.7% of incidents impacting OT stemmed from the EWS). - **Conveyor.exe Demonstrations**: Using Siemens TIA Portal, Snap7, and Factory I/O, the researchers demonstrate proof-of-concept scenarios showing how the attack behaves during normal operations, triggers disruption when tampered with, enforces a countdown timer, and cleanly disarms when a ransom is paid.

### Technical Details The attack begins after an attacker gains access to the engineering workstation, enabling full process comprehension and access to live PLC project files. The attacker introduces logic directly into the PLC code blocks: 1. **Covert Monitoring Network and Heartbeats**: A mutual heartbeat is configured among all infected PLCs (and EWS via Snap7), creating a network of "malicious accountability." Each node monitors its peers. 2. **Tampering Detection and Alert Propagation**: If a PLC is unplugged, reconfigured, or ceases responding, or if a defender plugs in a rogue programming device (detected by monitoring baseline connection counts), an alert state is triggered. This alert swarms across the infected PLCs like a "herd" or "colony." 3. **Payload Execution via Dead Man Switch**: When an alert propagates or when an on-device countdown timer expires, the legitimate operational logic is disabled, and malicious logic is activated, resulting in physical disruption (demonstrated via halted robotics and overflowing conveyors in Factory I/O). 4. **Anti-Recovery Protections**: The attackers lock PLCs using native password functionalities, exploiting the common industrial habit of omitting password management to prevent legitimate engineers from reprogramming devices. 5. **Clean Disarm**: If the ransom is paid, a single variable or key flips the active state, halting the heartbeats and timers, disabling the malicious code, and returning the plant to normal operation.

### Takeaways The speakers stress that Dead Man's PLC is a conceptual model illustrating how living-off-the-land attacks against the OT engineering supply chain could evolve, rather than existing wild malware. Currently, organizations should focus on securing IT environments to prevent lateral movement to engineering workstations.

Key defense and mitigation recommendations include: - **Basic Cyber Hygiene and VVIVA Framework**: Reduce attack surface and internet visibility (e.g., removing devices from Shodan), decrease vulnerability through patching and authentication, increase inertia (such as using honeypots), and restrict access time on EWS. - **Engineering Workstation Protection**: Treat Windows-based EWS with standard endpoint defenses and require hardware-based USB license keys as a form of second-factor authentication for configuration software. - **Network and Architectural Controls**: Implement network segregation, monitor for anomalous PLC communication traffic, and establish strong demilitarized zones (DMZs) between IT and OT. - **Vendor and Long-Term Strategy**: Engage PLC manufacturers to build security-by-design into industrial hardware and software architectures rather than relying strictly on bolt-on defenses.