Going Deeper Into Schneider Modicon PAC Security

This advanced course analyzes the security of Schneider Modicon PAC controllers through UMAS protocol weaknesses and password-protection bypasses. It demonstrates fuzzing, unauthorized controller operations, ransomware application insertion, and defensive recommendations.

Syllabus

Intro
About GEWU Lab
About Modicon PAC
Scenarios and Network PAC concept Top to bottom standard Ethernet network & Open architecture with direct Ethernet connection on backplane
Architecture & Functions
Enhanced cyber security Cybersecure-ready
Attack surface of PAC
What we focus on Weak private protocols are often the best way to breaking
Research setup
What is UMAS?
UMAS message format
UMAS function code
FUZZ UMAS Protocol
Select FUZZ samples
How to build FUZZ
UMAS FUZZ demo
Modicon PAC Application Password
How to bypass application passwor
How the password is stored Reverse UnityEncrypter.dll, the password hash algorithm is SHA-256
Authorization algorithm analysis
Leaked password hash in traffic
UMAS security function code 0x38
0x38 integrity check
0x38 message format
Summary the Authentication Bypas
Replay attack bypassing authorizat
Ransomware attack targeting level 1
Ransomware attack for M580?
Bypass authorization to replace ap
0x29 function code RCE
Ox29 RCE attack demo
How to protect