Mind the Air-Gap: Exfiltrating ICS Data via AM Radios and Hacked PLC Code

### Overview In this talk, David Atch (introduced as David Ash / Devan David Atch), VP of Research at CyberX, demonstrates how attackers can exfiltrate sensitive data across an air-gap in operational technology (OT) and industrial control system (ICS) environments. While air-gapped industrial networks isolate critical physical processes from the internet, sophisticated attackers often breach these environments (via rogue USBs, compromised contractor engineering laptops, or supply-chain update poisoning such as NotPetya or Dragonfly's Havex malware). Once inside, attackers need reconnaissance data—such as device inventories, network schematics, and ladder logic—to design impactful physical attacks. To extract this information without relying on the physical return of infected hardware, the researchers developed a software-only technique that turns standard programmable logic controllers (PLCs) into radio transmitters.

### Key Topics - **OT Attack Lifecycle and Reconnaissance:** Attacking industrial networks requires precise knowledge of proprietary protocols, safety systems, and process control logic before physical disruption can be executed. - **Inherent PLC Characteristics:** PLCs feature hardware I/O, configuration storage, and control routines written in languages like ladder logic. They lack antivirus solutions or standard forensic APIs, making malicious code modification persistent and difficult to inspect. - **Air-Gap Covert Channels:** Drawing on historical radio emission research such as TEMPEST and the open-source System Bus Radio project, the study explores electromagnetic emissions naturally radiated by electronic controller hardware.

### Technical Details - **Target Hardware and Execution Environment:** The research evaluated Siemens PLCs. The attackers inject custom ladder logic into an Organizational Block (OB). Organizational blocks execute continuously and run alongside existing ladder logic without interrupting active industrial processes. - **Modulating Electromagnetic Signals:** The researchers analyzed the controller's baseline RF emissions between roughly 300 kHz and 400 kHz. While mathematical routines, Ethernet cable manipulation, and network packet sniffing did not yield controllable RF modulation, copying large memory buffers (`memcpy`) consistently induced a detectable frequency shift. - **Transmission Protocol and Demodulation:** By alternating between executing massive memory copies (representing a binary '1') and idling (representing a binary '0'), the PLC code modulates radio frequency emissions. The ladder logic routine initiates transmission with a dedicated synchronization pattern to allow a receiver equipped with a Software-Defined Radio (SDR) and antenna to identify the transmission start, isolate the optimal low-noise frequency via correlation algorithms, and decode the payload. - **Performance:** In bench testing, the team achieved an exfiltration rate of 1 byte per second over distances up to 1 meter, noting that higher-gain antennas and refined filtering algorithms could extend range and throughput.

### Takeaways and Defenses Host-based endpoint protections do not exist for most legacy PLCs, and password or physical keylock protections can often be circumvented once an engineering station is compromised. Defending against these covert channels requires continuous passive network monitoring to detect anomalous behaviors, such as unauthorized ladder logic uploads, unexpected network scanning or ping sweeps initiated by controllers, and the appearance of unrecognized devices on the control network.