Down: Exploiting Vulnerabilities in the OT Cloud
Claroty researchers disclose critical vulnerabilities in CODESYS Automation Server and WAGO PLCs, executing top-down attacks from OT cloud to physical plants.
Summary
The Rapid Rise of Cloud-Connected Industrial Automation
Automation vendors increasingly deploy cloud-based management platforms (such as CODESYS Automation Server) to monitor, configure, and update field PLCs over the internet.
Auditing Cloud-to-PLC Architecture
Sharon Brizinov and Uri Katz analyze the communication protocols and authentication handshakes connecting cloud management servers to local industrial controllers.
Top-Down and Bottom-Up Exploitation Chains
The researchers uncover critical zero-days in CODESYS Automation Server and WAGO PLCs, demonstrating how compromising the cloud grants remote code execution on connected field PLCs.
Securing Industrial Cloud Management Platforms
The authors share their coordinated disclosure findings and provide security baselines for cloud-managed operational technology.
Related talks
Black Hat Europe 2024·38 min
Noam Moshe · Tomer Goldschmidt
Analysts investigate attack surfaces and defenses concerning The Insecure IoT Cloud Strikes Again: RCE on all Ruijie Cloud-Connected Devices.
Main Stage·42 min
Sheila A. Berta
Sheila A. Berta exposes critical security oversights across enterprise Big Data stacks (Hadoop, Spark, Flink), executing remote code execution on distributed analytics clusters.
Main Stage·45 min
ayoul3
ayoul3 details attacking Apache Spark big data clusters, demonstrating how misconfigurations and unauthenticated APIs yield root shells across thousands of nodes.