Alexandru Ariciu
ICS / SCADA Penetration Tester / Vulnerability Researcher
Robin Massink
ICS / SCADA Security Consultant
Black Box Debugging of Embedded Industrial Control Systems
Black-Box Debugging of Embedded Industrial Control Systems
Industrial Control Systems (ICS) are increasingly vital for critical infrastructures (CIs) and societies. Whether a sensor, controllers or transmitters all the systems are running embedded systems and therefore could be vulnerable to cyber security threats.
Protecting these systems requires deep understanding of the various attack vectors and interfaces. This is become even harder in absence of a full debugging environment.
This research will demonstrate new methods / techniques that we have developed to debug embedded systems and potentially modify/infect code through various interfaces (whatever is available on the target) without bricking the system and render it unusable.
In this presentation, we will demonstrate this process end to end and perform a live demo on a target ICS/SCADA device including:
Debuging, ICS, SCADA, Firmware
2 Hours workshop
Alexandru Ariciu
Robin Massink
Robin Massink is a cyber security consultant at Applied Risk who has 7 years of experience in respect to ICS and cyber security. He has been a Embedded systems engineer and SCADA communication protocol expert, and has applied his technical knowledge in the field of industrial automation for improving the cyber resiliency of critical infrastructure in the energy sector. As a cyber security specialist he performed ICS penetration testing and vulnerability analysis, reverse engineering and exploit development of SCADA components. He has authored several papers regarding smart grid security, has been involved in standardization commissions such as IEC 62351 and delivered presentations and trainings on the implementation of smart grid SCADA protocols and cyber security thereof.
Mr. Ariciu is a Penetration Tester and Vulnerability Researcher for Applied Risk, with more than 5 years experience in the field of Ethical Hacking and Penetration Testing. His core skills are offensive scenarios such as Penetration Testing, Reverse Engineering and Hardware Hacking. Source code analysis, software negative testing and Post-Exploitation techniques are also his strengths. He has developed a number of security tools that are used within the security community as part of open source projects. Passionate on how things work and how they can be made to function in unintended ways, he has a keen eye for details and is committed to deliver the best quality deliverables in each project he is taking part.
