In the first part of this series, we introduced the ‘turtles all the way down’ concept of the OT attack surface. Then, we dove into the layers of trust within that stack, exploring supply chain and insider threats in Part 2. Now, we move from the digital and trusted to the tangible and physical. In this third installment, based on Ray Blasko’s presentation at OT.SEC.CON, we’ll explore the world of physical security assessments. You can watch the full recordings on the BreakPoint Labs video hub.
You’ve spent millions on firewalls, endpoint detection, and sophisticated monitoring tools. Your digital fortress is state-of-the-art. But what if an attacker could bypass all of it in less than 60 seconds with a cheap lockpick and a bit of nerve?
For an offensive security professional, a physical compromise is often the most fun and eye-opening part of an assessment. While you’ve secured the digital front door, attackers are often able to just walk in through the back.
If an attacker needs to gain access to your OT environment as quickly as possible, the easiest path is often direct physical access. In the words of our Technical Director, Ray Blasko, “the first thing I’m going to do is I’m going to go find a remote site that’s unmanned and get in that way.”
These sites are a goldmine of vulnerabilities. Let’s walk through a real-world example from one of our assessments.
A water utility took us to a remote water tower. From their perspective, it was well-defended:
The defender saw strengths. An attacker saw a playground of opportunities:
Inside that unlocked building was a connected router inside an (unlocked) PLC cabinet. We plugged in a laptop and instantly had access not only to that site but to their entire main OT environment. Total time from arrival to full network compromise: under a minute.
Physical threats aren’t just about doors and fences. A wireless HID attack is particularly dangerous. Attackers have gotten creative with weaponized USB devices. This goes far beyond leaving a thumb drive in the parking lot. We’ve seen malicious hardware hidden in charging cables and even vape pens.
One of the most effective attacks uses wireless mice and keyboards. An attacker can use a tiny, cheap RF dongle to send keystrokes to a wireless mouse receiver from up to 50 feet away, telling the computer to execute commands. Even if you block USB drives, you can’t block Human Interface Devices (HID) like a mouse or keyboard, making this a perfect way to bypass controls and attack secure or even air-gapped networks. An attacker can plug one of these tiny receivers into the back of a machine, and it will likely go unnoticed for a long time.
Your digital security is only as strong as the physical security that protects it. Don’t let an unlocked door be the downfall of your entire security program.
Up Next: In our final post, we’ll tie it all together and discuss how to build a proactive defense that can even stand up to advanced, nation-state level threats in “Proactive OT Security: Defending Against Zero-Days & Nation-States”
How resilient is your physical security? BreakPoint Labs conducts comprehensive physical security assessments to uncover the gaps you can’t see. Contact us to learn more.
Ray Blasko is the Technical Director for offensive operations at BreakPoint Labs and a Red Team Operator for a DoD-certified Red Team, responsible for assessing and securing critical ICS/SCADA assets. He is recognized as a subject matter expert in both attacking and defending IT and OT environments, and he excels at resolving the technical and strategic issues that arise in protecting critical infrastructure. Ray holds numerous professional certifications and regularly presents at DoD Red Team conferences, trade conventions, and information security events.
