Pivot Attack Using RF

Balint Seeber of Bastille walks through a pivot attack. A central hub speaks many RF protocols, often lesser-scrutinized ones like 802.15.4 and Zigbee, to industrial controls, lighting, power, HVAC, and access systems, and also connects to the corporate network. An attacker exploiting a protocol-implementation bug on the hub can pivot from the RF side into the corporate network to reach a targeted server and exfiltrate data; Bastille monitors those protocols and alerts on such activity.

Key Takeaways

• Hubs that bridge industrial RF protocols to the corporate network create a pivot path for attackers
• Protocols like Zigbee and 802.15.4 receive less security scrutiny, so implementation bugs are more likely
• Exploiting a bug on the hub lets an attacker cross from the RF side into the otherwise isolated corporate network
• Bastille monitors these protocols and can alert when such a pivot attack takes place

Video Transcript

Hello. My name is Balint Seeber, and I'm the Director of Vulnerability Research at Bastille. I'd like to take you through this pivot attack scenario. In this scenario, we have a central controller or a hub that is capable of communicating in a number of different languages, a number of different RF protocols, with some different devices here. And that hub is then connected into some central network. So if you imagined this within a corporation in a modern office building, you have various industrial control systems.

You might have lighting that is smart lighting controlled by a central hub. You might have a power backup system for a data center, and that is able to send health and telemetry data back to a central hub. You might also have environmental control systems like thermostats and air conditioning systems that will also send back information.

And then you might have physical access to that might also employ some radio protocol, and so that can report when doors are opened or not and have the hub control, then the opening of those doors and locks as well. These systems tend to use different protocols than you commonly hear about, so they tend not to be Wi-Fi or Bluetooth. One common example is 802.15.4 or ZigBee, and the various profiles that are built on top of that.

The issue is that a lot of these protocols haven't had the same scrutiny as the more well-known protocols that have been around for a longer period of time. The issue is then they don't receive the scrutiny, they don't have as many eyeballs actually going through the code and making sure everything is secure, and there are no bugs in the implementations on all these devices.

An issue is often that there might be a specification, but it's always a question of how well that's implemented on the device and how securely it's actually written in the source code running on these embedded devices. So in this particular scenario, a motivated attacker has actually gone in and discovered a bug in, for example, the implementation of the protocol that is in this case residing on the hub. And then they can attempt to communicate in any one of these other particular protocols, say for example, ZigBee.

And then they would send and receive their own transmissions to the hub. And what they essentially cause in the hub is the ability to pivot from the isolated component that is communicating, say, ZigBee or one of these industrial protocols back to the other portion that is connected into, in this case, corporate network that is otherwise not exposed to the devices on the hub.

And by doing so, they might theoretically be able to take malicious payload that they have handcrafted on their box and then put that into malicious payload that's actually sent over to the hub via this particular RF protocol. And that ends up going into the corporate network to perhaps a server that they've specifically targeted on the network there that contains some sensitive information.

Once that payload makes its way across a traditional, in this case, IP network, it enters this particular server, maybe it exploits some other vulnerability within the server, and then they exfiltrate that sensitive information to the cloud where they can then download. The Bastille solution is actually able to monitor a variety of different protocols that are used in the corporate and industrial context, and that will enable you to better see what is going on. And if some attack such as this takes place, then alert you to that fact.

So to learn more, please visit our website. website.