Crossing the Line: Advanced Techniques to Breach the OT DMZ

In this technical offensive briefing from the DEF CON 33 ICS Village, an OT penetration tester demonstrates advanced methods for crossing the boundary between corporate enterprise networks and industrial demilitarized zones (OT DMZs). Opening at 00:00, the speaker explains that compromising enterprise Domain Admin is rarely sufficient to impact physical processes due to strict perimeter firewalls and network segmentation.

At 04:01, the talk outlines the pivot workflow: testers locate dual-homed engineering workstations or operator accounts authorized to establish Remote Desktop Protocol (RDP) sessions into the OT DMZ. At 08:00, the presenter demonstrates stealthy interaction using Hidden Desktop (HVNC) technologies, showing how operators can manipulate remote engineering consoles on isolated virtual desktops without alerting active operators on the physical screen.

Moving to detection analysis at 12:01, the speaker evaluates how defenders can identify anomalous inter-zone activity, comparing standard RDP sessions with hooked API calls. Concluding at 16:02, the presenter emphasizes that effective OT red teaming relies on living-off-the-land techniques rather than noisy C2 frameworks, urging blue teams to deploy strict application allowlisting and granular behavioral telemetry at OT perimeter firewalls. (AI summary — Gemini Flash)