{"id":1580,"date":"2024-10-25T12:30:00","date_gmt":"2024-10-25T09:30:00","guid":{"rendered":"https:\/\/zerontek.com\/zt\/?p=1580"},"modified":"2024-10-25T12:30:00","modified_gmt":"2024-10-25T09:30:00","slug":"html5-in-the-wild-transforming-ot-interfaces-but-opening-new-risks","status":"publish","type":"post","link":"https:\/\/zerontek.com\/zt\/2024\/10\/25\/html5-in-the-wild-transforming-ot-interfaces-but-opening-new-risks\/","title":{"rendered":"HTML5 in the Wild: Transforming OT Interfaces but Opening New Risks"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Introduction<\/strong><\/h4>\n\n\n\n<p>Welcome to the 20th installment of &#8220;<a href=\"https:\/\/zerontek.com\/zt\/category\/ot-hunt\/\" target=\"_blank\" rel=\"noreferrer noopener\">OT Hunt<\/a><strong>\u201d<\/strong> where we dive into the challenges and opportunities within the realm of ICS\/OT devices connected to the internet. This series aims to raise awareness among asset owners and ICS vendors to proactively secure their infrastructures.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>The Topic at Hand<\/strong><\/h4>\n\n\n\n<p>This exploration came about by chance. I was researching <strong>SpiderControl<\/strong>, an OT vendor, as part of my usual work on<a href=\"https:\/\/www.icsrank.com\/\" target=\"_blank\" rel=\"noreferrer noopener\"> ICSRank<\/a>. According to their product page, the <strong>SpiderControl Easy Web-HMI<\/strong> uses <strong>HTML5<\/strong> to develop HMIs directly on <strong>PLCs<\/strong> such as <strong>Siemens, Beckhoff, and Raspberry Pi<\/strong>, without additional runtime or hardware requirements. Here\u2019s a quick summary:<\/p>\n\n\n\n<p><em>&#8220;The SpiderControl Easy Web-HMI allows users to build and deploy HTML5-based HMIs directly on various PLCs. It supports SCADA integration, remote PLC management via OPC UA and ADS protocols, and allows retrofitting legacy systems by converting outdated interfaces to HTML5.&#8221;<\/em><\/p>\n\n\n\n<p>The platform supports multiple vendors including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Baum\u00fcller, Beckhoff, Bosch Rexroth, CODESYS compatible devices, Phoenix Contact, Phytec, Raspberry Pi, Siemens, Wago<\/strong> \u3010<a href=\"https:\/\/spidercontrol.net\/spidercontrol-products\/easy-web-hmi-directly-on-the-sps\/?lang=en\" target=\"_blank\" rel=\"noreferrer noopener\">source<\/a>\u3011.<\/li>\n<\/ul>\n\n\n\n<p>They offer HMI editors that generate HTML5-based web interfaces, which eliminates the need for older, now-deprecated Java applets. However, I noticed that <strong>some SpiderControl interfaces still use applets<\/strong>, which generate browser errors, indicating they are still running \u201cin the wild.\u201d<\/p>\n\n\n\n<p>This technology is moving toward <strong>cloud-based deployment<\/strong>, with SpiderControl&#8217;s SCADA server available as a <strong>cloud app, Docker component, or in OT marketplaces like Phoenix PLCnext and Bosch ctrlX<\/strong>. This allows for remote monitoring and control of multiple PLCs from the cloud, demonstrating a shift in OT toward modern, flexible web technologies.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"313\" src=\"https:\/\/zerontek.com\/zt\/wp-content\/uploads\/2024\/10\/spider-web-1024x313.png\" alt=\"\" class=\"wp-image-1591\" srcset=\"https:\/\/zerontek.com\/zt\/wp-content\/uploads\/2024\/10\/spider-web-1024x313.png 1024w, https:\/\/zerontek.com\/zt\/wp-content\/uploads\/2024\/10\/spider-web-300x92.png 300w, https:\/\/zerontek.com\/zt\/wp-content\/uploads\/2024\/10\/spider-web-768x235.png 768w, https:\/\/zerontek.com\/zt\/wp-content\/uploads\/2024\/10\/spider-web.png 1344w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Finding SpiderControl Devices in the Wild<\/strong><\/h3>\n\n\n\n<p>Using <strong>Shodan<\/strong> and <strong>ZoomEye<\/strong>, I searched for devices running SpiderControl.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Shodan<\/strong>: <code>SpiderControl<\/code>    \u2192 <strong>100 results<\/strong><\/li>\n\n\n\n<li><strong>ZoomEye<\/strong>: <code>spidercontrol +app:\"Phoenix Contact httpd\"<\/code>    \u2192 <strong>2,800 results<\/strong><\/li>\n<\/ul>\n\n\n\n<p>A key observation was that most devices found through ZoomEye were deployed on <strong>Phoenix Contact PLCs<\/strong>, revealing the platform&#8217;s popularity with that vendor.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"443\" height=\"376\" src=\"https:\/\/zerontek.com\/zt\/wp-content\/uploads\/2024\/10\/pcworx-1.jpg\" alt=\"\" class=\"wp-image-1593\" srcset=\"https:\/\/zerontek.com\/zt\/wp-content\/uploads\/2024\/10\/pcworx-1.jpg 443w, https:\/\/zerontek.com\/zt\/wp-content\/uploads\/2024\/10\/pcworx-1-300x255.jpg 300w\" sizes=\"auto, (max-width: 443px) 100vw, 443px\" \/><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Common Findings from SpiderControl Deployments<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Open ports<\/strong>: FTP, HTTP (80), SNMP (161), SSH<\/li>\n\n\n\n<li><strong>SNMP banners<\/strong>: Revealed model information, firmware versions, and manufacturing details\u2014helpful for attackers to determine vulnerabilities.<\/li>\n\n\n\n<li><strong>Vulnerabilities<\/strong>: SpiderControl interfaces are known to have <strong><a href=\"https:\/\/www.securityweek.com\/ics-patch-tuesday-advisories-published-by-siemens-schneider-abb-cisa\/\" target=\"_blank\" rel=\"noreferrer noopener\">file upload vulnerabilities<\/a><\/strong>.<\/li>\n\n\n\n<li><strong>QNAP cloud storage<\/strong> and <strong>Honeywell XLWeb controllers<\/strong> were also found running alongside SpiderControl devices.<\/li>\n\n\n\n<li><strong>Issues detected<\/strong>:<\/li>\n\n\n\n<li>Unpatched or old <strong>jQuery<\/strong> libraries.<\/li>\n\n\n\n<li>Accessible default web interfaces.<\/li>\n\n\n\n<li>Use of outdated hardware like <strong>Huawei B2368-66 modems<\/strong>.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"898\" height=\"435\" src=\"https:\/\/zerontek.com\/zt\/wp-content\/uploads\/2024\/10\/snmp.png\" alt=\"\" class=\"wp-image-1588\" srcset=\"https:\/\/zerontek.com\/zt\/wp-content\/uploads\/2024\/10\/snmp.png 898w, https:\/\/zerontek.com\/zt\/wp-content\/uploads\/2024\/10\/snmp-300x145.png 300w, https:\/\/zerontek.com\/zt\/wp-content\/uploads\/2024\/10\/snmp-768x372.png 768w\" sizes=\"auto, (max-width: 898px) 100vw, 898px\" \/><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Risks of HTML5: HTML Smuggling and MITRE Technique T1027.006<\/strong><\/h3>\n\n\n\n<p>SpiderControl\u2019s shift to <strong>HTML5<\/strong> comes with certain risks. One significant threat is <strong>HTML smuggling<\/strong>, classified under<a href=\"https:\/\/attack.mitre.org\/techniques\/T1027\/006\/\" target=\"_blank\" rel=\"noreferrer noopener\"> <strong>MITRE ATT&amp;CK&#8217;s T1027.006<\/strong><\/a> as a <strong>Defense Evasion<\/strong> technique .<\/p>\n\n\n\n<p>This technique involves injecting malicious JavaScript into HTML5 files, using elements such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;a download=\"malicious.zip\" href=\"data:application\/zip;base64,&lt;base64_payload&gt;\"&gt;  \n   Download the Safe Report  \n&lt;\/a&gt;<\/code><\/pre>\n\n\n\n<p>When a user clicks the link, it downloads a <strong>malicious payload<\/strong> (e.g., a ZIP or EXE). HTML smuggling is often used in <strong>QakBot and EnvyScout<\/strong> attacks to distribute malware, bypassing firewalls and antivirus tools through <strong>social engineering<\/strong> tactics\u3010<a href=\"https:\/\/www.securityweek.com\/top-10-security-threats-html5-black-hat\/\" target=\"_blank\" rel=\"noreferrer noopener\">source<\/a>\u3011.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Detection Tip<\/strong>:<\/h4>\n\n\n\n<p>To verify if a web interface is using HTML5, open the page source and look for:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;!DOCTYPE html&gt;<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Analysis: Modernizing OT Systems and the Trade-Offs<\/strong><\/h3>\n\n\n\n<p>The shift to <strong>HTML5<\/strong> is necessary to replace <strong>outdated technologies like Java applets<\/strong>, but it introduces new risks. While I haven\u2019t encountered specific HTML smuggling incidents in OT environments, similar attacks have targeted <strong>banking systems<\/strong> using <strong>QakBot<\/strong>. This highlights the potential for exploitation if OT vendors do not configure their web-based systems securely .<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Conclusion<\/strong><\/h3>\n\n\n\n<p>As OT vendors adopt modern technologies like <strong>HTML5<\/strong>, they must remain vigilant. HTML5&#8217;s flexibility makes it a powerful tool, but it also expands the attack surface. For asset owners and vendors alike, <strong>ICSRank<\/strong> is here to help you <strong>discover, assess, and secure<\/strong> your ICS\/OT systems.<\/p>\n\n\n\n<p>Stay tuned for more insights in future OT Hunt installments. Our shared vigilance is essential in defending critical infrastructure from evolving cyber threats.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Welcome to the 20th installment of &#8220;OT Hunt\u201d where we dive into the challenges and opportunities within the realm of ICS\/OT devices connected to the internet. This series aims to raise awareness among asset owners and ICS vendors to proactively secure their infrastructures. The Topic at Hand This exploration came about by chance. I [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[170,4,245,216,266,3,252,270,14,138,81,168,48,264,67,260,23,271,265,5,238],"tags":[7,267,13,6,269,12,169,47,272,20,100,268,27,239],"class_list":["post-1580","post","type-post","status-publish","format-standard","hentry","category-attack-surface","category-cyber-security","category-hmi","category-honeywell","category-html5","category-ics-security","category-ics-ot-osint","category-javascript","category-malware","category-mitre-ics","category-osint","category-ot-hunt","category-ot-security","category-phoenix-contact","category-plc","category-scada","category-shodan","category-social-engineering","category-spidercontrol","category-vendors","category-zoomeye","tag-cyber-security","tag-html-smuggling","tag-ics","tag-ics-security","tag-javascript","tag-ot","tag-ot-hunt","tag-ot-security","tag-phishing","tag-shodan","tag-sulaiman-alhasawi","tag-t1027-006","tag-zerontek","tag-zoomeye"],"_links":{"self":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts\/1580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/comments?post=1580"}],"version-history":[{"count":12,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts\/1580\/revisions"}],"predecessor-version":[{"id":1596,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts\/1580\/revisions\/1596"}],"wp:attachment":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/media?parent=1580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/categories?post=1580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/tags?post=1580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}