Coursera Flash Sale
40% Off Coursera Plus for 3 Months!
Grab it
Explore critical security vulnerabilities in the OPC UA industrial automation protocol through this 36-minute DEF CON 33 conference talk. Delve into the cryptographic weaknesses that Tom Tervoort discovered in OPC UA, a widely-used communication standard for industrial automation and IoT systems that connects OT networks, bridges IT and OT environments, and links field systems with cloud infrastructure. Learn how OPC UA's built-in cryptographic authentication and transport security layer, often considered sufficient to eliminate the need for VPN tunnels between OT trust zones, actually contains exploitable flaws. Discover two significant protocol vulnerabilities that can be weaponized into practical authentication bypass attacks, including signing oracles, signature spoofing padding oracles, and techniques for transforming "RSA-ECB" into a timing side channel amplifier. Follow the detailed process of converting theoretical cryptographic flaws into highly practical exploits that work against various OPC UA implementations and configurations, understanding the potential impact on industrial control systems and the broader implications for OT security.
