Ravindra BagaleCourses & study guides

43. IoT and OT Security – Cameras, Smart Devices, Plant Networks

43.7 Firmware, Updates and Supply-Chain Hygiene

By Last updated:

Cameras and PLCs often:

  • Ship with old OpenSSL / BusyBox
  • Need vendor signed firmware – random "crack firmware" Telegram file = backdoor
  • Sit for years without patch because "line cannot stop"
  • Trust a USB stick from a "helpful" vendor tech

Blue hygiene (concepts):

  1. Inventory model + firmware version
  2. Subscribe to vendor PSIRT / CERT-In advisories that apply
  3. Test update on a spare / window; verify hash/signature when vendor publishes one
  4. Disable unused services after upgrade (Telnet likes to return)
  5. Supply chain: buy from known channel; change support passwords after vendor visit

Stuxnet (2010) remains the classic OT awareness story in exam modules: malware that propagated in industrial environments and impacted uranium enrichment centrifuges in Iran, as widely reported – proof that software can have physical effects. We study it as history and defence motivation, not as a rebuild kit.

Red team (attacker) does Blue team (defender) detects / stops
Tricks staff into unsigned firmware USB Signed updates only; write-protect where possible; train
Abuses old CVE on abandoned camera OS Replace or isolate EOL devices; VLAN + egress deny
Compromises vendor update channel (SUNBURST-class lesson) Outbound allow-list; monitor admin suites; staged rollouts

Ravindra Bagale's Tip

Students flash the "latest cracked ROM". Unsigned firmware = you invited Red in. Interview: "Patch in a change window; verify vendor signature; isolate EOL IoT." Keep this in mind.

Lab

For one fictional camera model in notes: invent (clearly labelled fictional) current version 1.0.2 and advisory "upgrade to 1.0.5". Write rollback plan if video dies. 6 lines. No real plant flash.

Real incident: TRITON / TRISIS against safety controllers (2017)

In 2017, Mandiant (FireEye) publicly described TRITON (also called TRISIS / HatMan in other reporting): malware aimed at Schneider Electric Triconex safety instrumented system (SIS) controllers – the last-resort safety layer that can shut a process down safely. Public write-ups describe attackers reaching an SIS engineering workstation and deploying a framework to interact with the controllers; some controllers entered a failed-safe state and shut the process, which triggered investigation. CISA later published malware analysis (HatMan). Weakness: path to safety systems, insufficient isolation of SIS networks, trust in engineering workstations. Defence: hard segregation of SIS, monitored engineering access, application whitelisting on engineering hosts, anomaly detection on TriStation-class protocols – and never "practise" against real SIS. Source: Mandiant TRITON blog (Dec 2017); CISA MAR HatMan; Schneider Electric advisories (verify).