From Exploits to Forensics Evidence - Unraveling the Unitronics Attack

Explore a detailed Black Hat conference presentation that investigates a significant cyber attack on Unitronics Vision PLC & HMI controllers used in water facilities worldwide. Learn how researchers collaborated with government agencies and CERT teams to analyze the attack by CyberAveng3rs, reverse engineer the EWS and communication protocols, and develop forensic tools to investigate compromised PLCs. Discover the methodology used to bypass attacker-implemented password locks, extract forensic artifacts, and restore device configurations. Examine newly discovered critical vulnerabilities in the Unitronics Unistream series, including pre-authentication remote code execution possibilities. Gain insights into the complete attack analysis process, from initial exploitation to forensic evidence gathering, while accessing open-source tools developed during the investigation.