Locked Down, Not Locked Out: How I Escaped Yr Secure Operator Workstation

In this operational case study from the DEF CON 33 ICS Village, an industrial penetration tester presents a practical methodology for escaping locked-down operator Human-Machine Interfaces (HMIs) and engineering workstations in critical infrastructure facilities. Opening at 00:00, the speaker details the unique operational and safety constraints that govern security assessments in plant environments.

At 06:00, the presenter addresses common root causes of OT compromise, noting that default vendor credentials and over-permissive local group policies continue to plague industrial control systems. At 12:00, the talk explores human factors, warning that excessively restrictive workstation lockdowns often backfire by incentivizing operators to create insecure workarounds unless security teams build collaborative, blame-free relationships.

At 18:00, the speaker examines jump server and kiosk breakout techniques, demonstrating how unquoted service paths, unpatched helper utilities, and common file dialogs (such as triggering File Explorer through Help menus or print dialogs) enable testers to bypass kiosk restrictions. Concluding at 24:00, the session provides actionable hardening guidance for industrial defenders to isolate operator consoles without disrupting critical physical processes. (AI summary — Gemini Flash)