Flow-Through
Client loginLogin

Cyber security and software · Australia

Flow-Through

An Australian cyber security and software practice.
Operating in security research on operational technology and IoT devices, alongside AI security research.

A building from the footpathA seven-storey commercial building seen from the footpath, drawn in line, with plant on the roof, a lift motor room, a mast, and the entry at street level. Some windows are lit, following the time of day in Canberra.

Position

The devices people buy arrive with whatever security their maker gave them.

A thermostat, a camera, a building controller, a plant’s PLC: each speaks a protocol written for a network with one trusted tenant, and each stays in service for a decade or more on the defaults it shipped with. AI is lowering the cost of finding a flaw and using one, month by month, and it lowers that cost for everyone.

Our position is that the people who own these devices should know what is in them before someone else finds out. So we look. We build our own testing tools, so the questions we put to a device are ours and the answers are measured against the standards a plant is held to. We run real controllers in a lab and attack them. What we find goes to the maker first, with the fix. That is our part, and it is ours to do while there is still time to do it well.

Latest

Report ·

Attacking and defending an EtherNet/IP water controller

A small water-treatment works on one controller, the real protocol on the wire, and three attack classes run against it. Deceive: false data injection, so the operator’s screen reads normal while the water changes. Seize: a lockout that takes the plant away from its operators. Destroy: a denial of service that takes the controller offline. Each is mapped to ATT&CK for ICS and IEC 62443 and closes with the detections that catch it.

The captured run drove the chlorine dose up and held the sensor the screen reads, so the plant went out of range while the console said otherwise.

Read the report Open the console

  • 11.14 mg/LTrue chlorine residual, captured run
  • 1.02 mg/LResidual on the operator’s screen, same moment
  • 380 kPaDistribution pressure, before
  • 54 kPaDistribution pressure, after

Research

  1. AdvisoryOut-of-bounds read in a telecontrol protocol libraryReported to the maintainer, fix pending, CVE requestedPending
  2. ReportAttacking and defending an EtherNet/IP water controllerThree attack classes, mapped to ATT&CK for ICS and IEC 62443, each with detectionsRead
  3. ToolscadafuzzOur own fuzzing suite for industrial control protocol stacks, open sourceSource
  4. LabWater treatment plant, EtherNet/IP and CIPIsolated control network with a replayable attack, console liveConsole
  5. LabData-centre building management environment, BACnet/IP30 devices and 819 points, the vendor remote-access paths drawn in, console liveConsole

The restResearchToolsLabsNotes