In the first part of this series, we introduced the ‘turtles all the way down’ concept of the OT attack surface. Then, we dove into the layers of trust within that stack, exploring supply chain and insider threats in Part 2. Now, we move from the digital and trusted to the tangible and physical. In this third installment, based on Ray Blasko’s presentation at OT.SEC.CON, we’ll explore the world of physical security assessments. You can watch the full recordings on the BreakPoint Labs video hub.
You’ve spent millions on firewalls, endpoint detection, and sophisticated monitoring tools. Your digital fortress is state-of-the-art. But what if an attacker could bypass all of it in less than 60 seconds with a cheap lockpick and a bit of nerve?
For an offensive security professional, a physical compromise is often the most fun and eye-opening part of an assessment. While you’ve secured the digital front door, attackers are often able to just walk in through the back.
Case Study: Compromising a Water Utility
If an attacker needs to gain access to your OT environment as quickly as possible, the easiest path is often direct physical access. In the words of our Technical Director, Ray Blasko, “the first thing I’m going to do is I’m going to go find a remote site that’s unmanned and get in that way.”
These sites are a goldmine of vulnerabilities. Let’s walk through a real-world example from one of our assessments.
A water utility took us to a remote water tower. From their perspective, it was well-defended:
- A fence surrounded the entire property.
- The main gate had three different locks for three different organizations.
- A camera was pointed at the building’s main door, which was always locked.
- The water tower access ladder was locked at the bottom and the top.
The defender saw strengths. An attacker saw a playground of opportunities:
- The three locks on the gate were default Master Locks, which can be picked in about 30 seconds by an amateur. This just gave us three chances to get in.
- The door lock was equally easy to bypass.
- We didn’t need to pick the locks anyway. There was a large gap under the fence that an adult could slide through and a low adjacent wall that was easy to hop over.
- The two locks on the water tower access ladder? They were left unlocked.
- Finally, the back door to the building was completely unlocked.
Inside that unlocked building was a connected router inside an (unlocked) PLC cabinet. We plugged in a laptop and instantly had access not only to that site but to their entire main OT environment. Total time from arrival to full network compromise: under a minute.
The Wireless HID Attack and Other Physical Threats
Physical threats aren’t just about doors and fences. A wireless HID attack is particularly dangerous. Attackers have gotten creative with weaponized USB devices. This goes far beyond leaving a thumb drive in the parking lot. We’ve seen malicious hardware hidden in charging cables and even vape pens.
One of the most effective attacks uses wireless mice and keyboards. An attacker can use a tiny, cheap RF dongle to send keystrokes to a wireless mouse receiver from up to 50 feet away, telling the computer to execute commands. Even if you block USB drives, you can’t block Human Interface Devices (HID) like a mouse or keyboard, making this a perfect way to bypass controls and attack secure or even air-gapped networks. An attacker can plug one of these tiny receivers into the back of a machine, and it will likely go unnoticed for a long time.
How to Improve Your Physical Security Posture
- Create Deterrence: An attacker wants the path of least resistance. Upgrading to high-security locks makes picking them a 15-minute job instead of a 30-second one. That’s 15 minutes they’re exposed. Add barbed wire to fences, fix gaps, and ensure every door is actually locked.
- Improve Visibility: Multiple cameras and bright lighting make attackers uncomfortable. They are far less likely to attempt a breach if they have to do it under a spotlight.
- Validate Your Controls: Don’t just assume your security policies are working. Are unused network ports actually disabled? Is your RFID card system from 10 years ago using a protocol that has since been broken? Validate everything.
- Prohibit Risky Devices: Forbid the use of all wireless mice and keyboards in secure environments.
Your digital security is only as strong as the physical security that protects it. Don’t let an unlocked door be the downfall of your entire security program.
Up Next: In our final post, we’ll tie it all together and discuss how to build a proactive defense that can even stand up to advanced, nation-state level threats in “Proactive OT Security: Defending Against Zero-Days & Nation-States”
How resilient is your physical security? BreakPoint Labs conducts comprehensive physical security assessments to uncover the gaps you can’t see. Contact us to learn more.
About the Author
Ray Blasko is the Technical Director for offensive operations at BreakPoint Labs and a Red Team Operator for a DoD-certified Red Team, responsible for assessing and securing critical ICS/SCADA assets. He is recognized as a subject matter expert in both attacking and defending IT and OT environments, and he excels at resolving the technical and strategic issues that arise in protecting critical infrastructure. Ray holds numerous professional certifications and regularly presents at DoD Red Team conferences, trade conventions, and information security events.