Exfiltrating Reconnaissance Data from Air-Gapped ICS/SCADA Networks
summary
Demonstrates a working exfiltration channel that encodes reconnaissance data from ladder logic on a PLC into low-frequency EM emissions, captured with an SDR. Uses a Siemens S7-1200 PLC running injected organizational blocks, a memcopy loop to modulate emissions, and an SDRplay R2 plus simple TV antenna to receive. Achieves about 1 bit/sec reliably to roughly 1 meter in tests, proves persistence across reboots and shows detection/mitigation paths via network monitoring.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 1:27What are OT networks
- 3:20Getting to OT networks
- 7:08Attack vectors
- 11:07Introduction to PLCs
- 13:57PLC Blocks
- 15:12Leather Logic
- 17:25Frequency
- 20:55Letter Logic
- 22:52Receiving
- 26:28Receiving Data
- 31:07Detection
- 32:21Questions
- 35:38Power surges
- 36:05PLC modes
- 36:42CPU utilization
- 37:02PLC CPU utilization
- 38:13PLC noise
- 39:07disturbances on other instructions
- 39:44testing other instructions
- 40:24whats producing the AM directing
- 41:05reading data from 1m
- 41:44better antenna
- 42:08better result
- 42:56outdated software
- 43:49passive monitoring
- 44:46reverse engineering
related talks
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
44mRogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
44mICSCorsair: How I Will PWN Your ERP Through 4-20 mA Current Loop
50mDead Man’s PLC: Ransoming the Physical World via Operational Technology
39mA Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven
58mIndustrial Control Systems : Pentesting PLCs 101 (Part 1/2)
21mOops, It Halted Again: Exploiting PLC Memory for Fun and Profit in Industrial Control...
55mPLC-Blaster: A worm Living Solely In The PLC