Radio-frequency (RF) remote controllers are widely used in multiple industrial applications like manufacturing, construction and transportation. Cranes, drillers and diggers, among others, are commonly equipped with RF controllers, which have become the weakest link in safety-critical IIoT applications. Our security assessment revealed a lack of important security features at different levels, with vendors using obscure proprietary protocols instead of standards. As a consequence, this technology appeared to be vulnerable to attacks like replay, command injection, e-stop abuse, malicious repairing and reprogramming. Together with ZDI, we ran into a 6-months responsible disclosure process and then released 10 security advisories. In this presentation, we share the findings of our research and make use of demos to discuss the problems in detail. We conclude providing recommendations for all parties involved in the life-cycle of these devices, from vendors to users and system integrators.

1. Hey operator, where’s
your crane?
Attacking Industrial Remote Controllers
Marco Balduzzi, Federico Maggi, Jonathan Andersson
Joint work with Philippe Lin, Akira Urano, Stephen Hilt and Rainer Vosseler

2. Industrial Remote Controllers

8. 8 Copyright © 2019 Trend Micro Incorporated. All rights reserved.

9. Preliminary on-site testing

11. TW SAGA
TW Juuko
IT Autec
IT ELCA
TW Telecrane
JP Circuit Design
DEHetronic International
World-wide testing

12. SDR

13. Record & Reply
REPLYRECORD

14. What happened?

16. TX RX
MESSAGE 1 “UP”“UP”

17. TX RX
MESSAGE 1
MESSAGE 2
“UP” “UP”

18. TX RX
MESSAGE 1
MESSAGE 2
. . . . . .
MESSAGE 100
“UP” “UP”
MESSAGE 3

19. ALL messages are
the same!

20. 1: Record & Replay
Difficulty CostVendors
ALL $$$$
ATTACKS
DEMO

21. Arbitrary Command
Execution

22. 101010101010101010101010 1001001100001011 101000111011110 00001101 10100010 11110101…

23. SID CODE …
CHECKSUM OF
“UP”
UP
REVERSE
ENGINEERING

24. SID CODE …
CHECKSUM OF
“E-STOP”
COMMAND REPLACEMENT
For example: UP -> E-STOP
UP
E-STOP
E-Stop Button

25. SID CODE …
CHECKSUM OF
“E-STOP”
UP
E-STOP
DOS OF PRODUCTION!

26. DEMO

27. Example of Analysis

30. Reverse Engineering
00
01
10
11
RF Analysis

31. Reverse Engineering is Challenging
• Capture signal… then what?

32. Reverse Engineering is Challenging
Logic Analyzer

33. Semantic of the controller

34. Decoding the data of logic analyzer
• Created tool to convert waveforms to SPI
operations (R/W register X)
• Tedious to read SPI ops and determine
many radio states
– Boot, Idle
– Press ‘UP’, Release ‘UP’
– Press ‘DOWN’…

35. Decoding the data of logic analyzer

36. SPI Ops to Radio Registers
• Copy/Paste radio register set from
datasheet into python
• Now we can easily see what is being
accessed, set, programmed.
• But when you have 100’s of register
operations…

37. SPI Ops to Radio Registers

38. Persist Radio Register State
• Emulate internal radio registers
– Default register states are in datasheet
• Allow dumping of current radio state
• Allow pausing at key triggers (TX/RX)
• Now we know exact signal parameters at
TX/RX

39. Persist Radio Register State

40. Exercising complex protocols

41. Exercising complex protocols

42. Developing complex attacks
• Can instrument emulator at any point in
the stack to determine state
• Replay LA data to generate RF and
interact with physical devices
• Never touched a physical device…

43. Developing complex attacks

44. Juuko RX Radio

45. Payload Reverse Engineering

46. Payload Reverse Engineering
Preamble Sync Words Trailer??? ??? ????
Custom application protocol
(with security through obscurity baked in, usually)

47. 47 Copyright © 2019 Trend Micro Incorporated. All rights reserved.
Payload Reverse Engineering
Sequential ID
Preamble Sync Words TrailerSEQ.ID

48. 48 Copyright © 2019 Trend Micro Incorporated. All rights reserved.
Payload Reverse Engineering
Fixed Sequential ID

49. 49 Copyright © 2019 Trend Micro Incorporated. All rights reserved.
Payload Reverse Engineering
Interesting 4 bytes

50. 50 Copyright © 2019 Trend Micro Incorporated. All rights reserved.
Play Around With the Pairing Code

51. 51 Copyright © 2019 Trend Micro Incorporated. All rights reserved.
Payload Reverse Engineering
Pairing code: 20 10 77 C8

52. 52 Copyright © 2019 Trend Micro Incorporated. All rights reserved.
Payload Reverse Engineering
Zeroed code: 00 00 00 00

53. 53 Copyright © 2019 Trend Micro Incorporated. All rights reserved.
Payload Reverse Engineering
Pairing code: 20 10 77 C8
Preamble Sync Words TrailerSEQ.ID Pairing Code

54. 54 Copyright © 2019 Trend Micro Incorporated. All rights reserved.
Payload Reverse Engineering
Preamble Sync Words TrailerSEQ.ID Pairing CodePairing Code
S
U
M
S
U
M

55. 1: Record & Replay
2: Command Injection
ALL $$$$
ALL $$$$
DIFFICULTY COSTVENDORSATTACKS

56. 1: Record & Replay
2: Command Injection
3: E-Stop Abuse
4: Malicious Re-pairing
ALL $$$$
ALL $$$$
ALL
PART
$$$$
$$$$
OFF
E-STOP
E-STOP
E-STOP
DIFFICULTY COSTVENDORSATTACKS

57. Malicious Re-Programming

58. FCC schematics of the SAGA radio controller.
https://fccid.io/NCTSAGA1-L8/Schematics/schematics-4-273419
?!

60. MSP430F1101A BSL
• 1KB Bootloader
• Password is 16 * 2 bytes 🡺 IVT
• BSL ver 1.3

62. $ MSPFet.EXE +r "psw.txt“ –BLS=COM5
Check firmware integrity
in the flash

63. Malicious Firmware
• Clear-text password
transmission
• Unprotected firmware
• Forgeable integrity check
• Backdoors

64. 64 Copyright © 2019 Trend Micro Incorporated. All rights reserved.
1: Record & Replay
2: Command Injection
3: E-Stop Abuse
4: Malicious Re-pairing
$$$$
$$$$
$$$$
$$$$
OFF
E-STOP
E-STOP
E-STOP
5: Malicious
Re-programming $$$$
DIFFICOLTY COSTVENDORSATTACKS
ALL
ALL
ALL
PART
PART

65. Remote, Stealthy and
Persistent Attacks

66. Lower Barrier
$299$480 $99 $40

67. TARGET
REMOTE
ATTACKER
LOCAL BRIDGE
$40

68. DEMO

69. Responsible Disclosure Discussion
Vendor CVE-ID Status
Circuit Design ZDI-CAN-6185 (replay attack) Closed (No fix)
SAGA CVE-2018-17903 (replay attack / command forgery)
CVE-2018-20783 (malicious pairing)
CVE-2018-17923 (malicious firmware upgrade)
Patch Released
Patch Released
Patch Released
Telecrane CVE-2018-17935 (replay attack) Patch Released
Juuko ZDI-18-1336 (replay attack)
ZDI-18-1362 (command forgery)
0day (No response)
0day (No response)
ELCA CVE-2018-18851 (replay attack) Closed (EOL)
Autec ZDI-CAN-6183 (replay attack) Closed (No fix)
Hetronic CVE-2018-19023 (replay attack) Patch Released

70. Conclusions
• Patterns of Vulnerabilities
– No rolling-code
– Weak or no encryption at all
– Lack of software / firmware protection
• Need for security programs / awareness
in the field of IIoT

71. Vendors Users
• Use open technologies
and standards (e.g.,
Bluetooth)
• Adopt rolling codes and
encryption
• Protect the firmware
• User maintenance!
• Promote vendors
adopting open
technologies
• Maintenance
– Updates
– Period change of
secrets

72. Paper
• White-paper on Trend Micro Research
https://tinyurl.com/indradio
• Academic paper published at DIMVA ’19
http://www.madlab.it/papers/rfquack-dimva19.pdf

73. Thanks! Questions?
Marco Balduzzi, Federico Maggi, Jonathan Andersson
Joint work with Philippe Lin, Akira Urano, Stephen Hilt and Rainer Vosseler