Detouring Danger: Finding and Exploiting Privileged File Operations in SCADA Systems

Explore a 43-minute conference talk from Ekoparty Security Conference that delves into the critical vulnerabilities found in privileged file operations within OT/ICS and SCADA systems. Learn how these security flaws in Engineering Workstations can lead to unauthorized access, system manipulation, privilege escalation, and potential system failures. Discover the innovative approach using Microsoft Detours open-source library to develop a specialized DLL for deep system inspection, overcoming the limitations of traditional source code analysis tools. Examine real-world exploitation scenarios and their implications for ICS environments, including risks of system interruption, Blue Screen of Death (BSOD), and boot cycle issues. Gain valuable insights into effective vulnerability discovery strategies for critical environments and understand the security implications of these findings in widely-used SCADA software.