Last week we discussed the increasing threat of ransomware in manufacturing environments. Methods of using commercially available tools to gain Command & Control (C2) were discussed. This week, we will continue the scenario – departing from the ransomware pertinent tasks of deleting credentials and encrypting data and instead discuss how persistence is gained for cyber-enabled sabotage of the mechanical properties in additively manufactured components.
One of the most critical setpoints in Fused Deposition Modeling (FDM) is the layer height, how thick or thin the 2.5D layer stacks are. This setting is one of the primary drivers of how long a print takes to complete. Layer height also plays a critical role in a parts mechanical strength properties – making this “dial” a key target for the digital saboteur equipped with specific process knowledge. CNC kitchen experimentally tested the effects of FDM layer height (0.05-0.4mm) on failure load. From the graph it can be seen that the optimal layer height is 0.15mm and the load to failure reduces dramatically when the layer height is greater than 0.3mm.
On a safety critical part, a layer height modification could cause a part to fail or precipitate a workplace injury. The layer height setting, as a representative example, could have profound impacts on the quality of a part and is rather opaque from a monitoring capability. BISON fields capabilities to deepen visibility into these opaque environments as it can help detect deviations from normal or expected settings. Furthermore, it provides a forensic examination of additive manufacturing files to help post incident root-cause analysis.
Like most manufacturing processes, setpoints are tightly coupled with other design parameters. In FDM, the layer height setting is bounded on the upper and lower ends by the nozzle diameter. A rule of thumb equation states that for a stable process producing mechanically robust components must not exceed a maximum layer thickness of 80% * Nozzle Diameter (0.5mm in our example calculations). The image below shows how Cura alerts a user to invalid and sub-optimal inputs.
Once an adversary has control over the manufacturing IT resource, it can be very easy to subvert the slicing software itself to manipulate critical settings that can fundamentally alter the quality of the manufactured object. During a recent audit of slicing software, BPL security engineers were able to manipulate key settings and configuration files for common slicing software. The slicing software failed to verify or validate the integrity of key components prior to execution and did not leave logging details of the anomalies. All software is buggy; however, basic security hygiene is needed to prevent manipulation by unsophisticated adversaries.
This invisible access gives hackers the option to change their attack goals and methods. For example, timing sabotaged manufactured components to be delivered to a critical supplier or significantly degrading a company pursuing a merger or acquisition could have significant ramifications. With the pentest finding that no integrity monitoring & alerting features exist in commonly used additive engineering workflows (both commercial and open-source), a solution had to be developed to address these concerns that have grown as manufacturing devices become more connected. At BreakPoint Labs our slogan is “Build. Protect. Learn.” We did just that with building BISON, a cybersecurity visibility capability, specifically to secure and deepen visibility into AM technologies.
If you are interested in learning more about securing AM or a demonstration of the BISON capability, please contact us at info@breakpoint-labs.com