Activate Firmware Update Mode

From attackics
Jump to navigation Jump to search
Activate Firmware Update Mode
ID T800
Tactic Inhibit Response Function
Data Sources Application logs, Sequential event recorder, Network protocol analysis, Packet capture
External Contributors Joe Slowik - Dragos
Asset Field Controller/RTU/PLC/IED, Safety Instrumented System/Protection Relay


Adversaries may activate firmware update mode on devices to prevent expected response functions from engaging in reaction to an emergency or process malfunction. For example, devices such as protection relays may have an operation mode designed for firmware installation. This mode may halt process monitoring and related functions to allow new firmware to be loaded. A device left in update mode may be placed in an inactive holding state if no firmware is provided to it. By entering and leaving a device in this mode, the adversary may deny its usual functionalities.

Procedure Examples

  • The Industroyer SPIROTEC DoS module places the victim device into "firmware update" mode. This is a legitimate use case under normal circumstances, but in this case is used the adversary to prevent the SPIROTEC from performing its designed protective functions. As a result the normal safeguards are disabled, leaving an unprotected link in the electric transmission.1
  • The Industroyer SIPROTEC DoS module exploits the CVE-2015-5374 vulnerability in order to render a Siemens SIPROTEC device unresponsive. Once this vulnerability is successfully exploited, the target device stops responding to any commands until it is rebooted manually.2 Once the tool is executed it sends specifically crafted packets to port 50,000 of the target IP addresses using UDP. The UDP packet contains the following 18 byte payload: 0x11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E.2