ITSEC Newsletter 2024-10-03

While DLL hijacking attacks can take on many different forms, this blog post will explore a specific type of attack called DLL proxying, providing insights into how it works, the potential risks it poses, and briefly the methodology for discovering these vulnerable DLLs, which led to the discovery of several zero-day vulnerable DLLs that Microsoft has acknowledged but opted to not fix at this time. As we discuss the methodology, we will also examine how to easily weaponize these DLLs for covert attacks.

Framatome’s Teleperm XS (TXS) is a digital Instrumentation & Control platform designed specifically for use in safety systems in Nuclear power plants, as a replacement for, or upgrades to their analog counterparts. It is one of the most widely used digital safety I&C platforms, sustaining the main defense line (Reactor Protection System, Engineered Safety Features Actuation System) in dozens of nuclear reactors globally, including Europe, USA, Russia, and China. Obviously, that was a good opportunity to dig deeper into the, usually, closed world of nuclear digital safety I&C systems, so I bought some of the most important TXS modules. That was the starting point for the research I'm releasing today: "A Practical Analysis of Cyber-Physical Attacks Against Nuclear Reactors". This research paper aims to provide a comprehensive technical analysis of hypothetical cyber-physical attacks targeting the safety systems of nuclear reactors (PWRs), such as the Reactor Protection System (RPS) and the Engineered Safety Features Actuation System (ESFAS).