Industrial Ouroboros: Deep Lateral Movement via Living Off the Plant
Richard Derbyshire
TL;DR
<3-5 sentence high-level summary> The paper addresses the challenge of lateral movement within OT environments at the lowest Purdue level (level 1) by introducing a PLC-native technique called living off the plant (LOTP). It demonstrates deep lateral movement using native PLC communications, specifically via PUT/GET library blocks in Siemens S7-300, without changing core PLC code, enabling cross-site and serial-network traversal. The work presents four threat-scenario models (non-routable, IP-to-Serial, site-to-site WAN, and multi-hop) and a practical proof-of-concept, highlighting covert operation and stealth advantages. The findings underscore the need to rethink OT defensive practices and ISA/IEC 62443 guidance to account for LOTP-style lateral movement and PLC-centric threats.
Abstract
Lateral movement is a tactic that adversaries employ most frequently in enterprise IT environments to traverse between assets. In operational technology (OT) environments, however, few methods exist for lateral movement between domain-specific devices, particularly programmable logic controllers (PLCs). Existing techniques often rely on complex chains of vulnerabilities, which are noisy and can be patched. This paper describes the first PLC-centric lateral movement technique that relies exclusively on the native functionality of the victim environment. This OT-specific form of `living off the land' is herein distinguished as `living off the plant' (LOTP). The described technique also facilitates escape from IP networks onto legacy serial networks via dual-homed PLCs. Furthermore, this technique is covert, leveraging common network communication functions that are challenging to detect. This serves as a reminder of the risks posed by LOTP techniques within OT, highlighting the need for a fundamental reconsideration of traditional OT defensive practices.