From Exploits to Forensics Evidence - Unraveling the Unitronics Attack

From Exploits to Forensics Evidence - Unraveling the Unitronics Attack

Speakers: Noam, Vulnerability Researcher

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=l1A-OmPuOgE

Overview

This talk, presented by Noam, a seasoned vulnerability researcher, delves into the forensic investigation of a high-profile cyberattack targeting Unitronics Programmable Logic Controllers (PLCs). The attack, attributed to the Advanced Persistent Threat (APT) group "Cyber Avengers," gained significant media attention for its impact on critical infrastructure, specifically water facilities in the United States and Israel. Noam, typically engaged in proactively discovering and disclosing vulnerabilities in OT/IoT devices, shifts focus to retrospective analysis, detailing the methodology used to unravel the attack's mechanisms and extract forensic evidence from these embedded systems.

The significance of this talk lies in its exploration of a real-world incident that caused widespread public panic, highlighting the severe consequences of insecure Industrial Control Systems (ICS). By dissecting the attack on Unitronics Vision series PLCs, the presentation not only exposes the glaring security deficiencies in legacy operational technology but also provides a crucial blueprint for forensic analysis in environments where traditional tools and documentation are absent. It underscores the critical need for robust security in critical infrastructure and offers insights into how defenders can approach incident response when facing attacks on deeply embedded, proprietary systems.

Background

▶ Watch: Speaker introduction and talk overview (0:00)

The Unitronics attack, which unfolded during a weekend early in the year, saw numerous reports of PLCs displaying a "You've been hacked" message, attributed to the APT "Cyber Avengers." These devices, primarily Unitronics Vision series PLCs, are widely deployed in water facilities globally. The motivation behind this attack was explicitly stated as spreading fear and panic, capitalizing on public concern about the safety of drinking water in both the United States and Israel. This psychological warfare aspect garnered extensive media coverage, exacerbating the sense of vulnerability among the population.

This was not the first time the Unitronics Vision lineup was targeted. Approximately a year and a half prior, in 2022, the same series of PLCs were attacked in Israel, specifically impacting ePost, a parcel services provider. While the APT was not formally identified at that time, the striking similarities in attack assets—including pictures, messages, and fonts—strongly suggest that "Cyber Avengers" was also behind the earlier incident. This prior knowledge likely informed their more widespread attack on water facilities, demonstrating a persistent targeting strategy against Israeli-made equipment and related interests.

The Unitronics Vision series, an integrated PLC (Programmable Logic Controller) and HMI (Human-Machine Interface) device, is an exceptionally old product line, dating back to the early 2000s. This vintage is a critical factor in understanding its security posture: it possesses almost no inherent security mechanisms. Specifically, the devices lack encryption, authentication, or any robust protective measures. This absence of foundational security meant the attack complexity was remarkably low. To communicate with and control these embedded systems, a proprietary protocol known as PCOM is used. Crucially, PCOM lacks public documentation or RFCs, necessitating extensive protocol analysis and reverse engineering of device binaries to comprehend its functionality, a significant hurdle for both attackers and forensic investigators alike.

Key Findings

▶ Watch: Attack motivation: spreading fear and panic (1:30)

The central finding of this investigation is the alarming simplicity and low complexity of the attack against the Unitronics Vision PLCs. The "Cyber Avengers" APT did not exploit complex zero-day vulnerabilities or sophisticated attack chains. Instead, they leveraged the fundamental insecurity of these legacy devices. The primary attack vector was simply connecting to publicly exposed PLCs and downloading a new logic, effectively reprogramming the device and altering the HMI screen to display their defacement message.

A critical revelation regarding authentication further underscores the vulnerability. While CISA's advisory recommended changing a default password (e.g., 1111) and adding a PCOM password, Noam's research uncovered a more severe reality: prior to certain updates, the PCOM protocol on the Unitronics Vision series had no password whatsoever. This meant that anyone with the engineering workstation software and the public IP address of a vulnerable device could gain full control, download new logic, and manipulate its operations without any authentication challenge. This complete lack of a security barrier transformed widely exposed devices into open targets.

The investigation also highlighted the critical challenge of forensic analysis on embedded, proprietary systems. Without standard operating systems, remote desktop access (RDP), or documented protocols, investigators were forced to engage in deep reverse engineering of the PCOM protocol and the device's binaries. This process was essential not only for understanding how the attack was executed but also for determining if the defacement was the sole objective or if more malicious operational changes were introduced behind the scenes. The shared assets (pictures, messages, fonts) between the 2022 ePost attack and the 2023 water facility attack provided strong evidence linking the "Cyber Avengers" to both incidents, demonstrating their consistent targeting of these specific, vulnerable devices.

Technical Deep Dive

▶ Watch: Simplicity of the PLC defacement attack (2:00)

The Unitronics Vision devices are integrated Programmable Logic Controllers (PLCs) and Human-Machine Interfaces (HMIs). A PLC is the "brain" of an industrial control system, a specialized computer that controls physical processes (e.g., water flow, chemical mixing) based on programmed logic. The HMI is the visual interface, a screen that allows operators to monitor events, view logs, and interact with the system. In this attack, the HMI was defaced, but the underlying concern was the integrity of the PLC's operational logic.

The core of the attack and the subsequent forensic challenge revolved around the PCOM protocol. This is a proprietary communication protocol developed and implemented solely by Unitronics for its devices. Unlike open standards with published specifications (like Modbus or OPC UA), PCOM has no known documentation or RFCs. This lack of transparency means that any interaction with the device—whether for legitimate programming or malicious control, or even forensic data extraction—requires a deep understanding of PCOM's structure and commands.

Noam's team had to undertake significant protocol analysis and reverse engineering of the device binaries to decipher PCOM. This typically involves:

1. Network Traffic Capture: Intercepting communications between a legitimate engineering workstation and a Unitronics PLC.
2. Packet Analysis: Examining captured packets to identify patterns, command structures, data fields, and responses.
3. Binary Reverse Engineering: Disassembling and de-compiling the firmware or the engineering workstation software to understand how PCOM commands are constructed, processed, and what functions they invoke on the device. Tools like Ghidra or IDA Pro would be crucial in this phase.

The "weak authentication" described in advisories was, in reality, often a complete absence of authentication for PCOM in older firmware versions. For devices running these older firmwares, simply having the Unitronics engineering workstation software and the public IP address of the target PLC was sufficient to gain full control. The default password 1111 was only introduced in later firmware versions, and even then, it was a weak, easily guessable credential. This meant that attackers only needed to scan for Unitronics devices exposed to the internet (e.g., via Shodan) and connect using the vendor's own software.

Once connected, the attack process was straightforward:

1. Establish PCOM Connection: The attacker used the engineering workstation software to initiate a connection to the PLC via its public IP address, bypassing any non-existent or default authentication.
2. Download New Project Logic: The workstation software allows operators to upload new "projects" to the PLC, which include both the control logic and the HMI display configuration. The attackers simply created a malicious project containing their defacement image and message.
3. Reprogramming and Defacement: By downloading this new project, the attackers effectively reprogrammed the PLC. While the primary visible effect was the HMI defacement ("You've been hacked"), the critical question for forensic investigators was whether this new project also contained malicious operational logic designed to disrupt or contaminate water systems. This required detailed analysis of the downloaded project's code, a complex task given the proprietary nature of Unitronics' programming environment.

The challenge for forensics was not just understanding the PCOM protocol to communicate with the device, but also to extract the current and potentially previous project logic, event logs, or any other volatile or non-volatile data that could shed light on the attackers' full intentions and activities. This process involved leveraging the reverse-engineered PCOM knowledge to craft forensic tools or adapt existing ones to interact with the device at a low level, bypassing the limitations of the vendor's standard tools if they were designed only for programming, not deep forensic data extraction.

Demo / Proof of Concept

▶ Watch: Unitronics Vision: old series, no security mechanisms (4:00)

While the talk does not detail a live, step-by-step demonstration of the attack or forensic process, the speaker explicitly outlines the methodology employed to understand the attack and extract forensic evidence. The "showcase" refers to the explanation of their research process rather than an interactive demo. This methodology involved:

1. Acquisition of a Target Device: Obtaining a Unitronics Vision PLC, identical to those attacked, to serve as a lab environment.
2. Replication of Attack Vector: Understanding that the attack involved downloading new project logic, the researchers would have simulated this by using the legitimate Unitronics engineering workstation software to connect to the lab PLC and upload different projects.
3. PCOM Protocol Analysis: This is the cornerstone. The researchers would have used network sniffers (like Wireshark) to capture traffic between the engineering workstation and the PLC. By analyzing these captures, they would identify the specific PCOM commands used for project upload, HMI screen updates, and data read/write operations.
4. Reverse Engineering Binaries: Decompiling the PLC's firmware and/or the engineering workstation's executables (using tools like IDA Pro or Ghidra) to precisely map PCOM commands to internal device functions and data structures. This would reveal how the device processes incoming commands, where data is stored, and how logic is executed.
5. Developing Forensic Capabilities: Based on the reverse-engineered PCOM protocol, the team would then develop custom scripts or tools capable of:

• Connecting to the Unitronics PLC using the PCOM protocol.
• Extracting the currently running project logic from the device.
• Reading internal device registers, memory areas, and logs that might contain clues about the attack, such as connection timestamps, user activity, or previous project versions.
• Identifying where the HMI screen data (e.g., the defacement image) is stored and how it can be retrieved.

The goal of this "demonstrated process" was to illustrate how, in the absence of standard forensic tools or documentation for such a proprietary embedded system, a dedicated team can reverse engineer the necessary components to conduct a thorough investigation and answer critical questions about an incident. This includes determining if the attackers did more than just deface the HMI, by analyzing the actual operational logic that was downloaded.

Defensive Implications

▶ Watch: Critical PCOM protocol had no password (5:20)

The Unitronics attack serves as a stark reminder of the inherent vulnerabilities in legacy Industrial Control Systems and highlights several critical defensive implications for organizations operating such infrastructure:

1. Eliminate Public Exposure: The most immediate and crucial defensive measure is to ensure that critical OT/ICS devices, especially those lacking robust security features, are never directly exposed to the public internet. Network segmentation, firewalls, and secure remote access solutions (e.g., VPNs with multi-factor authentication) are essential to prevent direct connectivity.
2. Implement Strong Authentication (Where Possible): For devices that do support authentication, even if it's a basic password, operators must change default credentials immediately and enforce strong, unique passwords. If the PCOM protocol or similar proprietary protocols offer password protection, it must be enabled and configured.
3. Patch and Update Firmware: While the Unitronics Vision series is an older line, any available firmware updates that introduce security enhancements (like PCOM password support) should be applied diligently. Organizations must maintain an inventory of their OT assets, including firmware versions, to track vulnerabilities and applicable patches.
4. Network Monitoring and Anomaly Detection: Implement deep packet inspection and protocol analysis on OT networks to detect unusual PCOM traffic, unauthorized project downloads, or unexpected commands. Anomaly detection systems can flag deviations from normal operational behavior, indicating potential compromise.
5. Regular Backups of PLC Logic: Operators should routinely back up their PLC project logic. In the event of an attack involving logic modification, a verified clean backup allows for quick restoration of safe operations and provides a baseline for forensic comparison.
6. Understand Proprietary Protocols: For critical infrastructure components that rely on proprietary protocols, security teams should proactively invest in understanding these protocols through vendor engagement, internal research, or third-party analysis. This knowledge is vital for both proactive defense and reactive incident response.
7. Incident Response Planning for OT: Develop and regularly test incident response plans specifically tailored for OT environments. These plans should account for the unique challenges of embedded systems, proprietary protocols, and the potential for physical impact. This includes procedures for forensic data acquisition from non-standard devices.
8. Vendor Engagement and Secure-by-Design: Organizations should advocate for more secure-by-design principles in new OT equipment and pressure vendors to provide better security features, documentation, and support for forensic analysis. The reliance on decades-old, insecure technology must be addressed.
9. Cyber-Physical Security Convergence: The incident underscores the need for convergence between IT and OT security teams. IT security expertise in network defense, threat intelligence, and incident response must be adapted and applied to the unique context of operational technology to protect against sophisticated APTs.

Key Takeaways

• Legacy OT/ICS are Highly Vulnerable: The Unitronics Vision series, an older PLC/HMI lineup from the early 2000s, exemplified severe security deficiencies, including a complete lack of encryption and, in many cases, no authentication for its proprietary PCOM protocol.
• Simple Attacks Can Have Major Impact: The "Cyber Avengers" APT executed a low-complexity attack—simply downloading new logic to publicly exposed devices—yet achieved widespread defacement and generated significant public fear and panic, especially concerning water facilities.
• Proprietary Protocols Hinder Defense and Forensics: The undocumented and proprietary nature of the PCOM protocol necessitated extensive reverse engineering for both understanding the attack mechanism and conducting forensic investigations, highlighting a major challenge in securing and analyzing embedded systems.
• Public Exposure is Catastrophic: Direct exposure of critical infrastructure devices to the internet, coupled with weak or absent authentication, creates an open invitation for attackers and must be eliminated through robust network segmentation and secure remote access.
• Beyond Defacement: The Unseen Threat: While the attack's visible effect was HMI defacement, the core forensic question revolved around whether the downloaded logic also contained malicious operational changes, emphasizing the need for deep analysis beyond surface-level indicators.
• Proactive Forensics is Key to Understanding APTs: The ability to conduct detailed forensic analysis on compromised OT devices, even those with non-standard architectures, is crucial for understanding attacker motivations, capabilities, and ensuring complete remediation.

About the Speaker(s)

Noam is a dedicated vulnerability researcher whose primary professional focus is on identifying security flaws in various OT (Operational Technology) and IoT (Internet of Things) devices. His daily work involves logging into devices such as HMIs (Human-Machine Interfaces), PLCs (Programmable Logic Controllers), routers, switches, and IP cameras, with the objective of discovering vulnerabilities. Noam is committed to the practice of responsible disclosure, ensuring that identified weaknesses are reported to vendors so they can be remediated, thereby contributing to a safer and more protected global infrastructure. In this talk, he applied his deep expertise in vulnerability research to a forensic investigation, demonstrating the versatility of his skills in both proactive security and incident response.