ICSCorsair: How I Will PWN Your ERP Through 4-20 mA Current Loop
summary
A custom open‑hardware attack board, ICSCorsair board, connects to 4–20 mA HART loops to jam the line, impersonate masters, change a transmitter’s long tag and inject XML/JavaScript payloads that travel up FDT/DTM stacks into PAS/MES/ERP. The demo uses Metasploit modules, Ruby sniffers and netcat and achieves shell execution against SAP about 9/10 times by jamming for 15–20s then sending a forged packet; real transmitters enforce a 32‑byte tag limit while some PAS accept up to 200 bytes.
AI-written summary · about
chapters (18)
- 0:00Start
- 2:36DEMO Infrastructure
- 9:52Field devices
- 12:14Example of FSK transmission
- 12:32HART FSK network scheme
- 14:55First try: HRTShield
- 15:58First prototype
- 16:20Prototype v.0.02
- 18:19HART modem inside MCU
- 18:34Choosing MCU: PSOC 3
- 19:02Operation modes
- 19:36Text commands (mode 1)
- 19:52Binary commands (mode 0)
- 21:40Mobile application
- 22:18Plant Asset Management
- 25:30Escaping? Boundary checking?
- 29:56Metasploit module
- 32:50Attack scheme
related talks
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS Hacking
47mExfiltrating Reconnaissance Data from Air-Gapped ICS/SCADA Networks
36mChained to Hit: Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise Software
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OT
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
32mFaking a Factory: Creating and Operating a Realistic Honeypot