DTM Components: Shadow Keys to the ICS Kingdom
summary
Research analyzes FDT/DTM components for field devices and finds concrete failures: fuzzing with a custom hard parser, DTM fuzzer and Fast Frame uncovers 29 vulnerable components out of 114 DTM components tested, impacting roughly 500 devices and including confirmed remote code execution exploited to run calc over the current loop. Hardware tools such as ICS Corsair and a heart emulator pair with software proxies to inject malformed HART/XML, proving exploits work end-to-end.
AI-written summary · about
chapters (22)
- 0:00ICS and DTM introduction
- 1:08Agenda and FDT DTM overview
- 3:16Why FDT DTM in ICS
- 8:58FDT DTM weaknesses
- 9:19DTM vulnerabilities research
- 10:23HART protocol focus
- 13:15HART attack models
- 16:14HART hardware tools
- 17:37Live HART attack demo
- 22:45XML injection in DTM
- 24:10Industrial links attack model
- 25:16Vulnerability stats
- 27:09Fuzzing methods and tools
- 31:26Detailed vulnerability findings
- 33:55Strange vulnerabilities
- 37:52Cryptographic functions misuse
- 38:58RCE via HART demo
- 40:23FDT DTM security mechanisms
- 40:44FDT v2 security improvements
- 42:55FDT Group response
- 44:20Conclusions and future work
- 46:51Q&A
related talks
25mWhat's the DFIRence for ICS?
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
32mUnlocking Insights: The Role of TI in Modern DFIR Operations
50mD2T2 - Exposing Hidden Exploitable Behaviors Using EDF
49mAnalysis of DTLS Implementations ... State Fuzzing
29mFuzzing and Breaking Security Functions of SIMATIC PLCs
16mLost in Translation: Enabling Confused Deputy Attacks on EDA Software...
21mIndustrial IoT security issues and countermeasures