#HITB2023AMS D1T1 - Nakatomi Space: Lateral Movement As L1 Post-Exploitation In OT

### Overview In this talk, Jos Wetzels from Forescout explores lateral movement across Level 1 (L1) embedded devices in operational technology (OT) networks. Traditional OT security focuses on perimeters at higher Purdue Model tiers (e.g., Level 3.5 and 2.5 DMZs) or on upstream attacks targeting SCADA/HMI systems. However, control devices at Level 1—such as PLCs, RTUs, and fieldbus couplers—frequently sit on unacknowledged, multi-homed "network crawl spaces" consisting of nested fieldbuses, serial links, RF connections, and point-to-point lines. Drawing an analogy to the "Nakatomi space" concept (traversing latent, overlooked architectural paths), Wetzels demonstrates how an attacker can move laterally downwards through nested L1 control devices to cross hardened security boundaries and manipulate critical physical processes.

### Key Topics - **The OT "Network Crawl Space":** Deep L1 architectures host nested networks (Profibus, CANopen, industrial wireless) and black-box third-party packaged units (HVAC, chemical injection, turbines) integrated via couplers that lack monitoring, visibility, and detection capabilities. - **Motivation for Deep Lateral Movement:** Attackers navigate deep into OT to bypass hardened perimeters (e.g., crossing from Basic Process Control Systems [BPCS] to Safety Instrumented Systems [SIS]), manipulate SIS bypass functions, or achieve granular control over field devices that are not exposed via SCADA interfaces. - **Level 1 Lateral Movement Techniques:** Attackers exploit OT protocol routing and encapsulation (Modbus, EtherCAT, CIP), in-band code downloads, memory manipulation, and protocol stack vulnerabilities in embedded real-time operating systems (RTOS).

### Technical Details To demonstrate an end-to-end multi-hop attack chain, the speaker modeled a real-world movable bascule bridge architecture managed across three tiers of embedded hardware: 1. **Initial Compromise of Fieldbus Gateway:** The attacker targets a WAGO 750-852 Modbus coupler running Nucleus RTOS. Exploiting a Nucleus 13 vulnerability (a stack buffer overflow in the FTP server's USER command handling), the attacker overrides linked list pointers during an FTP disconnect to achieve a write-4 primitive. By hooking the unused `span_process_packet` function and sending LLC frames, the attacker achieves code execution in ARM supervisor mode, installs an RTOS task, and proxies Modbus function code 0x5A. 2. **Engineering Protocol Exploitation on the Object PLC:** Behind the coupler sits a Schneider Electric Modicon M340 PLC running VxWorks 6.4. The attacker sniffs and replays legitimate nonces or forges authenticated requests in the proprietary UMAS protocol (Modbus function 0x5A) because the authentication signature relies only on nonces and public hardware IDs without a secret. Rather than downloading new control logic—which forces a disruptive restart and alarms—the attacker abuses the undocumented UMAS CSA request (service code 0x50). By writing payload shellcode into a data block and executing a permitted block-copy to an executable block, the attacker hot-patches running memory live, escapes the scan cycle watchdog, spawns an RTOS task, and erases memory changes for anti-forensics. 3. **Fieldbus & Safety PLC Pivot:** From the M340 PLC, the attacker uses CANopen APIs/SDOs to override motor safety limits and initiates an attack across a non-routable, point-to-point Ethernet link into an Allen-Bradley GuardLogix safety PLC (1756-EN2D module running VxWorks 6.9 on an Ice 2 chip). Exploiting an Urgent 11 vulnerability (Interpeak IPnet stack buffer overflow in IP record route options), the attacker constructs a ROP chain to bypass executable space protection (NX), secures a write-4 primitive, deploys an implant, and talks directly to the backplane device driver to manipulate SIS bypasses and trigger false emergency stops.

### Takeaways & Defenses - **Redefining Perimeters:** Any L1 device bridging separate networks or media is a perimeter device and must be secured and evaluated for multi-order connectivity risks. - **Detection Strategies:** Defenders should alert on abnormal protocol usage, such as UMAS traffic routed to non-Modicon devices or UMAS CSA traffic (service code 0x50), monitor for watchdog resets and IP header error statistics, and inspect project memory blocks for carved ARM shellcode when anti-forensics are incomplete. Network flows carrying UMAS should be strictly restricted to engineering workstations.