MITRE ATT&CK® stands for MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK). The MITRE ATT&CK framework is a curated knowledge base and model for cyber adversary behavior. It reflects the various phases of an adversary’s attack lifecycle and the platforms they are known to target.
As cyber threats become increasingly sophisticated, the need for robust and adaptable defense tools has never been more critical. Organizations utilize the MITRE ATT&CK framework to enhance their cybersecurity strategies by using the catalog of adversary tactics, techniques, and procedures (TTPs).
This framework enables cybersecurity teams to map detected threats to specific TTPs, facilitating a deeper understanding of attack vectors and improving threat intelligence.
It also plays a critical role in threat hunting, incident response, and enhancing detection and prevention systems. By aligning their security measures with the framework, organizations can identify gaps in their defenses, streamline their response efforts, and improve situational awareness.
The MITRE ATT&CK framework also fosters collaboration and information sharing among organizations, providing a common language to collectively enhance defenses against cyber threats. The tactics and techniques in the model provide a common taxonomy of real-world cyber threats from both offensive and defensive sides of cybersecurity. It also provides an appropriate level of categorization for adversary action and specific ways of defending against it.
Mitre Engeuinty created ATT&CK Workbench, allowing us and other organizations to manage and extend their local version of ATT&CK and keep it in sync with MITRE’s knowledge base. Why do we want to do that? So that our organization’s specific threat intelligence is aligned with the public ATT&CK knowledge base.
BreakPoint Labs has developed an Additive Manufacturing (AM) ATT&CK framework sponsored by the US Army Engineer Research and Development Center (ERDC). Through research and testing, we identified over 40 ways that AM processes could be targeted by cyber attacks. Then, starting with the current Industrial Control Systems (ICS) ATT&CK framework we modified the framework to include the 40+ new sub techniques. The AM framework’s techniques and sub-techniques map directly to BISON detectors. BISON is BreakPoint Labs cybersecurity for AM tool.
Along the top of the matrix are 12 Tactics (Figure 1). These represent the “why” or the goal of an attack. They include Discovery, Collection, Initial Access, impact, impair process control.
The techniques and sub-techniques (Figure 2) are “how” the goal is achieved.
Each sub-technique in the matrix can be expanded to find out more information.
For example, here (Figure 3), we see details of a critical severity cyber attack. The Hot End Crash (Fire Hazard & Physical Damage) – Z motors will crash the hot end assembly from its current height down into the print bed. This situation is extremely dangerous as the heated nozzle will be sunk into any material that has been deposited, causing a fire risk.
The manufacturing industry has been and will be subject to cyber attacks. Malicious cyber actors can easily sabotage AM processes. Visibility into AM processes so we can respond quickly and in a forensically sound manner to cyber attacks. The ATT&CK Framework can provide insight into existing security gaps and highlight the need for specific countermeasures and/or defensive capabilities. It’s tied to real-world events to help communicate and quantify risk to AM environments.
If you are interested in learning more about securing Additive Manufacturing or a demonstration of BreakPoint Lab’s BISON AM solution capability, please contact us at info@breakpoint-labs.com
In June, BreakPoint Labs (BPL) gave a presentation at RAPID+tct 2024. This was BPL’s third time presenting at North America’s biggest Additive Manufacturing (AM) event. Two of BPL’s SMEs gave a presentation, as part of RAPID+tct’s Defense conference track, on the “AM MITRE ATT&CK Framework”. The use of AM in Defense remains popular with many applications and many research projects being currently undertaken.
There were several major industry takeaways from RAPID+tct. The first is that there is a general consensus that the AM hype is over and that the industry is now in the trough of disillusionment, according to the Gartner Hype cycle (Figure 1). The trough of disillusionment happens when the original excitement wears off, and early adopters report performance issues and low ROI. We can see this is true due to recent mergers and acquisitions.
AM organizations need to consolidate and collaborate. It won’t be possible for organizations to be profitable and scalable without working together. The industry as a whole needs to focus on how to become more profitable with AM technology and not remain focused on new and innovative AM technology. While technological developments are important, the industry as a whole will become more profitable from AM applications. More needs to be done to integrate AM into real production environments and treat AM as another manufacturing tool rather than a separate process. We can also do more to leverage AM data to increase machine efficiencies and enhance part design.
An ongoing issue for the development of the AM industry is the need for skilled AM professionals. As companies across various industries, including aerospace, healthcare, and automotive, adopt 3D printing technologies, there is a need for professionals who can design, operate, and maintain these complex systems. Skilled AM professionals are essential for optimizing production processes, ensuring quality control, and driving innovation in product development. The AM workforce also needs professionals trained in advanced software, materials science, and engineering. This emphasizes the importance of targeted education and training programs. Institutions and industry partnerships are critical for developing training that addresses these skill gaps. Investing in the education and training of AM professionals not only supports the industry’s growth but also enhances global competitiveness and economic resilience. As the AM industry continues to grow, the need for a skilled workforce remains a critical factor in leveraging the full potential of additive manufacturing technologies.
Another notable industry change in the industry is the increase in Chinese AM companies. 42 Chinese companies exhibited at RAPID+tct 2024. This number is up from around 4 Chinese companies 2 years ago. Chinese AM companies are increasingly becoming world leaders in AM. Germany still leads the world market in yearly revenues, followed by the USA and China. Germany is solidly in first place as most of the companies producing industrial 3D printing hardware today are based in Germany as are many adopters and material manufacturers. However, the US is catching up with significant growth in polymer AM while China is growing, especially through domestic AM production and adoption (VoxelMatters). The global Additive Manufacturing market size was valued at USD 20.37 billion in 2023 and is expected to grow a CAGR of 23.3% from 2023 to 2030 (GrandView Research).
Overall, even though AM is going through a time of ups and downs, the long term outlook for the AM industry is positive with growth continuing into the next decade.
BreakPoint Labs has developed BISON, a tool for securing AM processes. If you are interested in learning more about securing AM, please contact us at info@breakpoint-labs.com.
Additive manufacturing (AM) engineers have been incredibly creative in developing ancillary systems that modify a printed parts mechanical properties. These systems mostly focus on the issue of anisotropic properties of additively built components. This blog post is a good reference if you are unfamiliar with isotropic vs anisotropic properties and how they impact 3d printing. A range of solutions exist ranging from upgrades to hobbyist printers, solutions from origin equipment manufacturers such as Essentium FlashFuse technology, to NASA redesigning a Lulzbot to be capable of printing advanced high temperature polymers.
While these ancillary technologies are great for achieving uniform part strength they pose a cyber-physical risk where subversion of these unmonitored subsystem processes could allow an attacker to sabotage part integrity and cause a component failure in operation use. The video below (systems advantages video chapter) is a great insight into how impactful these processing parameters are towards a parts mechanical strength & chemical resistance.
The above ancillary strength control sub-system was able to achieve material gradients ranging from amorphous to crystalline within a single component due to altering the input signal to an incandescent heater mounted to the toolhead. This heater is controlled with pulse width modulation (PWM). In unmonitored additive manufacturing systems there is no record of this input signal and no way of comparing an “as manufactured” components digital signature against a verified test specification. This blind spot introduces risk as a stealthy way to degrade a component’s performance. BISON currently maintains a historian storing the “as manufactured” PWD signals controlling toolhead and build plate temperature, making our AM security solution easily expandable to monitor ancillary subsystems, ensuring there is no deviation from specification during manufacturing operations.
If you are interested in learning more about securing AM or a demonstration of the BISON capability, please contact us at info@breakpoint-labs.com
The Federal Energy Regulatory Commission (FERC) reported 16 potential market manipulation cases in 2018. The 1990’s saw a restructuring of the electric grid in the USA with a shift from government owned infrastructure to privatized. This introduced trading markets for electricity featuring a day-ahead market and a real-time market. 14 of the 16 suspected market manipulation cases were closed with no action. Not enough evidence / visibility was available to address the threat. This lack of evidence combined with the fact that a 1% level of real-time demand can be naturally induced through a sporting event or concert creates an opportunity for attackers to go undetected. A short sale trade in the real-time market has massive profitability with as little as a 1% change in demand. Existing research into high wattage botnets have focused on consumer synchronous on/off of high draw appliances such as EV chargers or HVAC equipment. BreakPoint Labs has extended this research with a focus on additive manufacturing equipment being the vector for energy trading market manipulation. Not only have we identified the threat but we have developed the necessary visibility to detect this type of attack. An additive facility protected with BISON will be one of the few cases where a suspected energy market manipulation will be detectable.
The thermal history below was captured using a PID autotune Gcode. This is a common maintenance command but should not be issued during normal or idle operations. This can easily pop a fuse if multiple printers are on a circuit.
Issued Command: M303 E-1 s110. The power consumption was monitored on our test printer. M303 PID Autotune Electrical Draw; Idle Wattage: 10 watts. High Point PID Autotune Wattage: 146
Important Caveat: This testing was performed on a Lulzbot Taz SideKick 289, the smallest build envelope printer offered by this OEM. The larger the build envelope the larger the electrical draw is. It has been noted that the current X & Y dimensions on the larger format Lulzbot models are maxed out as a function of how efficient current silicone pad bed heaters are. A larger build envelope would require the use of two 120V outlets to accommodate the larger bed heater demands or more efficient heaters. There are FDM printers that require 240V power to heat the bed (the 3D Platform series as an example). These large format printers still rely on the same Gcode language to change PID setpoints and have the same lack of even basic cybersecurity measures.
It is common for industrial users of additive manufacturing to operate a fleet consisting of dozens of FDM printers and a handful of larger format machines. Slant 3D has taken this to an extreme and based their manufacturing facility at an old train station primarily due to the amount of electric supply to the facility as the key fleet consideration.
At facilities like Slant 3D’s train maintenance facility, a 3000-5000 unit print farm, it’s not hard to imagine that an attacker would be able to hit the critical mass of high-wattage smart-devices required for a botnet to be able to impact energy trading markets. We cannot allow attackers to profit from these market manipulations at the expense of increased electric bills for the end operators. A Georgia Tech study concluded that there would be a 7% increase for impacted devices. The potential economic impact is massive. In an attacker scenario where a market player (electric plant owner) operates the botnet, it is estimated up to $24 million extra profit. In the case of nation state attackers it is estimated at $350 million in economic damages. This attack happens while remaining within the forecasting error for these markets in order for the attackers to maintain stealth.
Do you operate connected high-wattage devices and are interested in securing them from botnet attacks? If so, please contact us at info@breakpoint-labs.com to learn more about how BISON can secure your AM environment.
References
https://www.usenix.org/conference/usenixsecurity18/presentation/soltan
Georgia Tech BlackHat 2020 https://www.youtube.com/watch?v=Df4tPM6aGcA
To extract the greatest value from advanced manufacturing, a shift to codesign with AI is needed to realize the full potential of DfAM (design for additive manufacturing). 3D printing offers unlimited design freedom, giving the advantage to reduce weight via intelligent lattices and topology optimization that were not previously possible with subtractive methods. AI codesign can iterate designs in significantly less time than a human engineer alone. The cybersecurity of these processes must be taken into consideration due to the fact that these methods are currently suited for extreme operating environments that benefit the most from these manufacturing breakthroughs. If a part is going through AI design workflows it is most likely a critical part and its failure would be catastrophic. This can be seen in automotive applications with Bugatti’s additively manufactured brake caliper.
A failure of a brake caliper due to cyber-sabotage in AI codesign could easily cause a fatal car crash. The weight savings of 40% sprung weight cannot be ignored when considering fuel consumption, and as automotive technology trickles down into the consumer market, these AI optimizations will contribute towards driving down carbon emissions. It will be critical to already have in place the detection capabilities to determine if AI codesign has been altered either via tampering with operator inputs into performance characteristics or via switching out a less than optimal iteration into the production environment. BISON will provide valuable insights into post-failure analysis should an incident occur due to AI codesign components. If you are interested in a deeper dive into benefits the automotive industry can gain from these design approaches please read this blog post from nTop – the leading software company focused on these methods.
As you can see (above) the controls to create a repeatable workflow are highly complex and alterations here would be hard to notice and very likely make it to the manufacturing floor. BISON gives you the ability to upload a trusted source manufacturing file, in this scenario, a validated AI codesigned bracket. Using Bison’s ability to hash an as-manufactured-component against the trusted file an operator can quickly learn that alterations have been made even if the components look visually identical.
The Department of Defense is already pursuing these methods in flight critical components. Episode #43 of The Cool Parts Show showcases a helicopter heat exchanger that has enhanced performance over traditionally machined versions.
“Advanced Engineering Solutions applied geometry that could only be made through additive manufacturing to the redesign of a heat exchanger for the gearbox oil of a helicopter. The result: four times the cooling in a heat exchanger one half the size of the original. Gyroid lattices inside this heat exchanger maximize inner surface area to achieve the more effective heat transfer.” (The Cool Parts Show Episode 43)
Does your manufacturing process depend on mission critical AI co-designed components? If so, please contact us at info@breakpoint-labs.com to learn more about how BISON can secure your AM environment.
As additive manufacturing (AM) matures and continues to gain popularity, it becomes an increasingly attractive target for cyberattacks. Therefore, being proactive in preparing for these security threats, particularly for high-value targets, is of paramount importance. A recently published paper [1] identifies the importance of developing and implementing a forensic readiness model to prepare for attacks on 3D printers. According to the paper’s authors, current forensic readiness models “do not consider AM processes and may be ineffective” for crimes that involve 3D printers, which motivated their work in developing a forensic readiness framework for AM.
The framework, which the authors refer to as the Forensic Readiness for Material Extrusion-based Printing Process (FRoMEPP), emphasizes the need to establish a “forensically ready” printing environment before an incident occurs in order to allow for the acquisition and preservation of relevant data as an attack is occurring, not after the attack subsides when data can be lost or overwritten. The different components of the framework are shown in Figure 1.
The authors identify several categories of cyber-domain information that are critical to monitor during an attack, including operating system logs, network logs, and application logs. These three log types cover a wide range of activities, from user account sessions and file access activities, to network traffic (e.g., SSH and HTTP connections), and finally to CAD and slicer software usage. By collecting and analyzing multiple logs, investigators can piece together the events of an attack with the assurance that the results of the investigation can be corroborated using multiple data sources.
Similar to investigations in other domains, the paper emphasizes that preserving and archiving evidence related to AM attacks is imperative. According to NIST IR 8387, “Digital Evidence Preservation” [2], digital evidence retention policies may vary between jurisdictions and organizations. However, in the absence of local statutes or policies, organizations should determine for themselves how long evidence should be preserved, which highlights the need for a flexible retention solution.
The proposed FRoMEPP framework [1] goes into much more detail and includes other critical aspects of the forensic readiness model, including the employment of out-of-band sensors and the selection of a suitable monitoring scheme. For the sake of brevity, we can’t cover the entire paper, but interested readers are encouraged to review the rest of the paper using the link in the footer.
Anticipating the demand for a security-hardened device that protects against cyberattacks on additive manufacturing machines, BreakPoint Labs has developed BISON to provide cutting-edge cyber defense capabilities in a small, convenient form factor. BISON captures critical cybersecurity information in the machine-to-machine communications between the controller and printer, and can ingest Windows security event logs and certain application logs for advanced analysis. This data is archived in the system until manually removed by an operator, ensuring that pertinent information is preserved for any post-incident investigations.
If you are interested in learning more about how BISON can secure your AM environment, please contact us at info@breakpoint-labs.com.
[1] https://www.sciencedirect.com/science/article/pii/S2666281723000112
[2] https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8387.pdf
The growing accessibility of 3D printers and downloadable models online has made it easier than ever to produce products and printed parts from home. Millions of digital design files are available for sale or for free online. Intellectual property (IP) owners have a strong interest in protecting their work and preventing the counterfeit manufacturing of their products. As one example, Honda demanded that all Honda-related files available on Printables.com be taken down just last year [1]. Unfortunately, copyright ownership can be difficult to prove in the world of digital files and 3D printed objects. Presented with a 3D printed object, how could one prove that it originated from a specific manufacturer or printer, and wasn’t printed by someone who made a replica based on the original product?
One possible solution is the use of digital watermarking. By embedding identification information or other metadata into the 3D model or 3D object, it’s possible to show that a model or printed object came from a specific company or printer. In this form of watermarking, the identification data can either be inserted directly into the 3D model before being sent to a 3D printer, or added to the G-code after the slicing phase.
In one study, researchers developed a blind watermarking algorithm designed to be applied to 3D printed objects using fused deposition modeling (FDM) 3D printers [2]. The term “blind watermarking” is used to describe the ability to locate and read the watermark data from the object without requiring the original, non-watermarked object for comparison. In this technique, the researchers were able to embed predetermined watermark data into the object by varying the thickness of the printed layers. Another study introduced a method that can generate unique fingerprints of 3D printers by using the thermodynamic properties of the printer’s extruder hot-end to build a watermark [3]. This technique allows manufacturers to insert digital watermarks into their 3D products that can indicate both where the object was printed (i.e., the company or manufacturer), and which specific printer and extruder hot-end were used to print the object in the manufacturing facility.
As digital watermarking techniques become increasingly advanced and robust against attacks, it’s important to recognize their limitations. One common assumption is that instructions sent to a 3D printer are executed without modification. In this way, as long as the printer is configured correctly and doesn’t malfunction, the watermark data will be properly transferred to the object being printed. However, manufacturers who use watermarking techniques should be aware of the risk of instructions being manipulated, corrupted, or dropped. If left unchecked, a malicious actor could inject themselves into the pipeline and cause minor or major changes to the G-code, resulting in a printed product that resembles the model in appearance, but is just different enough to remove or obfuscate any watermark that should have been added. A skilled attacker could even add their own watermark to the data, calling into question the authenticity and true IP owner of the products once placed onto the market.
To detect these types of attacks, BreakPoint Labs has developed BISON, which monitors the G-code executed by an additive-manufacturing machine and compares it to the intended G-code. In doing so, every command is verified. If an unusual or unintended command is executed, an alert is sent to the operator.
If you are interested in learning more about securing additive manufacturing or a demonstration of BreakPoint Lab’s BISON AM solution capability, please contact us at info@breakpoint-labs.com.
[2] https://ieeexplore.ieee.org/document/8943311
[3] https://ieeexplore.ieee.org/document/9385084
Imagine you are a hobbyist 3D printer who has not considered the cybersecurity concerns of your connected additive devices. You are out grocery shopping and come home to flashing lights and dozens of police officers. You see them carry an evidence bag with a small 3D printed object in it that you have never seen before. You just became victim to a crime known as swatting but now with compromised additive machines you are giving the person executing the swat a physical presence in your home. This allowed the attacker to download an object into your home. The object in an evidence bag we mentioned earlier is an auto SEAR device to transform a semi-auto into a full auto firearm.
“Having an auto sear without the proper federal license, which requires an extensive background check and costly fees, can carry a 10-year federal prison sentence.” (The Trace)
It is unfortunate that this class of crime has seen a huge increase over recent years:
“Putting a figure on swatting cases is difficult because swatting is not classified as a specific category in the crime statistics database of the Federal Bureau of Investigation (FBI). However, a former FBI special agent has revealed that swatting cases more than doubled from 400 in 2011 to over 1,000 in 2019.” (Fortinet)
As more home based manufacturing machines become networked, the risk of allowing a malicious outsider to send a physical object that only takes a matter of minutes to print but could make a victim spend a decade in jail is incredibly concerning. This is a situation in which a defendant will not have the needed information to prove their innocence. At best the victim is now fighting a costly uphill battle and at worst will be found guilty of a felony due to the remote actions of an unknown attacker, potentially even a foreign attacker. Swatting operations are frequently run as for-hire services from abroad.
What seems like a niche concern in operational technology could precipitate a life altering nightmare for the victim. The ease of enacting this twist to the crime of swatting to potential impact on target combined with the difficulty in identifying or prosecuting those involved makes this scenario a very real concern. Having visibility into your AM processes can help bring clarity to swatting incidents.
If you are interested in learning more about securing AM or a demonstration of the BISON capability, please contact us at info@breakpoint-labs.com
Can 3D print operations be disrupted from an upstream exploit? In this blog we will explore how an alternative energy solution for powering AM equipment can be exploited to disrupt manufacturing operations. A second round of Hollywood hack fact checking will occur pertaining to Mr. Robot and battery exploitation that was based on this event. Below is an additive machine being powered with a Goal Zero lithium battery. The overlays show the digital data streams these connected devices output, as well as a common security problem with smart devices – default credentials that are easily obtained with a simple Google search, leaving the door open for further exploitation.
Blue Arrow = demonstrating the problem of default credentials in connected devices.
Green Arrow = AM data stream that is typically offline but can be networked with a print server.
Gray Arrow = Physical button that toggles the 110V inverter on / off. The phone app interface allows remote control of this button.
Red Arrow = Digital read out of the physical battery status panel, this can indicate battery state (standby, operating, charging, discharging).
In previous blog topics we have demonstrated the potential to ransomware a non network connected AM device by firmware modification. Many OT manufacturing assets have firmware that most are not even aware of, causing blindspots in companies cyber asset libraries (even individual servo motors have firmware). This is also the case with backup power equipment. A recent real world example would be TLSSTORM, but Hollywood has taken interest in cyber-physical hacking as well. In Mr. Robot season 2 finale (eps2.9_pyth0n-pt2.p7z) a UPS is subject to firmware modification. See this “fact-checking” article from the technical advisors for that episode here.
Applying a firmware modification to a Goal Zero lithium battery can be used to disrupt additive manufacturing operations. To cause maximum disruption a randomized timer can be implemented to toggle the inverter on / off (gray arrow). The inverter is responsible for converting the stored 12V power to usable 110V power. There are inefficiencies in this conversion and having the inverter powered on causes parasitic drain even when not actively outputting 110V power – hence the need to turn this feature off when not in use. When toggled off maliciously the printer will power off in an unsafe manner. This not only causes an environmental hazard and damage to manufacturing equipment but can be a huge human resource drain. Operators unaware of the cyber nature of an upstream exploited asset will focus troubleshooting efforts on the AM device itself, which in reality does not need maintenance as it is not the source of error.
Reviewing the last commands sent in the BISON platform can help identify this as a power interruption and not a printer issue. With this visibility a machine operator will be clued into the true source of manufacturing disruption. From there additional troubleshooting steps can be taken, such as setting a camera up on the Goal Zero to monitor for inverter “blips.”
If you are interested in learning more about securing AM or a demonstration of the BISON capability, please contact us at info@breakpoint-labs.com
It’s the start of conference season for the major USA Additive Manufacturing (AM) events, with TIPE just finished and AMUG and RAPID+tct coming soon it’s time to look at the predicted AM trends for 2023. What was noticeable at this year’s TIPE conference was the acknowledgement in many presentations that we need to start taking AM cybersecurity seriously. Something that had been absent from TIPE 2022. With the manufacturing industry having been targeted by cyber threats in recent years, it’s important that the AM industry be aware of cybersecurity risks and how to manage them. Let’s look at a summary of some predicted trends for AM and Cybersecurity for 2023.
There is an overlap between global cybersecurity trends and AM trends for 2023. Stratasys predicts significant development in AM pre and post-processing, workflow, automation, and connectivity. Having in-situ monitoring for AM boosts reliability and repeatability for printed parts. AM machines need to be connected in order to have continuous monitoring and visibility into the AM processes. Cybersecurity trends for 2023 also predict that we can expect to see an increase in connected devices/IoT devices and cloud services. However, the more devices we connect together and network, the more risks exist that attackers can maliciously attack and access our data. In 2023, analysts at Gartner predict there will be 43 billion IoT-connected devices in the world.
The use of AM service bureaus is expected to increase in 2023 as more organizations utilize AM but don’t want to take on the cost of their own machines. Small and medium size service bureaus do not necessarily have the resources or capabilities to secure themselves against cyber threats. Even though larger organizations may be well protected, these small AM service bureau contractors can be the weakest link in the chain for cybersecurity.
An important step that can be taken at any organization is to ensure that they are working towards initiating and fostering a culture of awareness around cybersecurity issues. Cybersecurity is not just an IT department issue. All employees should have an awareness of the threats and take basic precautions to ensure safety. Forbes states that “Cyberattacks aren’t a question of “if”; they’re a question of “when.” The only way organizations can stop an attack or reduce its impact is by identifying unusual activity across their entire ecosystem of users, applications and infrastructure.” Threat detection and response tools are key to having a secure cyber environment. BreakPoint Lab’s BISON AM tool gives AM users visibility into their additive manufacturing machines. BISON gives the user valuable insight into their part and verifies that what is printed is as intended.
If you are interested in learning more about securing Additive Manufacturing or a demonstration of BreakPoint Lab’s BISON AM solution capability, please contact us at info@breakpoint-labs.com
