An Analysis Of Computer Numerical Control Machines In Industry 4.0

An Analysis Of Computer Numerical Control Machines In Industry 4.0

Speakers: Marco Balduzzi, Senior Threat Researcher, Trend Micro

Conference: HITB Amsterdam

YouTube: https://www.youtube.com/watch?v=b3k7R8FUdIE

Overview

In this compelling talk at HITB Amsterdam, Marco Balduzzi, a Senior Threat Researcher at Trend Micro, presented groundbreaking research into the security posture of Computer Numerical Control (CNC) machines within the context of Industry 4.0. Balduzzi highlighted the critical role these highly complex and expensive machines play across various industrial sectors, from automotive manufacturing to aerospace, operating with precision to produce everything from drill bits to car components. Despite their ubiquitous presence and immense value, the security of CNC machines has, until now, remained largely unexplored by the cybersecurity community. This research represents a vital first step in addressing this significant gap, revealing a vast and largely unprotected attack surface.

The presentation underscored the urgent need for a deeper understanding of CNC machine vulnerabilities, emphasizing that an attack on these systems could have catastrophic consequences, including physical harm to operators, production line disruption, significant financial losses due to damaged equipment or faulty products, and intellectual property theft. Balduzzi and his team, in collaboration with industrial partner Celada, gained unprecedented access to real-world CNC machines and simulators from leading global manufacturers. Their findings expose a pervasive lack of fundamental security controls, legacy software issues, and inherent design flaws that leave these critical industrial assets highly susceptible to a wide array of sophisticated attacks.

Background

▶ Watch: Introduction to CNC machines and research motivation (0:00)

CNC machines are the backbone of modern manufacturing, encompassing a diverse range of tools such as drills, mills, and grinders. They are characterized by their high cost, intricate operation, and critical importance to both operational safety and business continuity. The advent of Industry 4.0 has led to increased connectivity for these machines, integrating them into enterprise and production networks for remote management, control, and data collection. This connectivity, while enabling new efficiencies, simultaneously introduces a significantly expanded attack surface that has largely gone unaddressed.

The supply chain for CNC machines is notably complex, a factor that profoundly impacts their security. The process typically involves an NC (Numerical Control) manufacturer developing the core controller, which is then sold to numerous machine manufacturers. These manufacturers integrate the controller into their physical machines, which are subsequently distributed through local resellers and deployed by integrators to the end-user. This multi-tiered structure means that a vulnerability introduced by the NC manufacturer at the beginning of the chain can propagate downstream, affecting potentially thousands of machines from various manufacturers. Similarly, proprietary protocols or technological choices made at the controller level dictate the entire ecosystem. Recognizing this, Balduzzi's research strategically focused on the NC manufacturers, as addressing vulnerabilities at this foundational level offers the broadest impact. The study encompassed four major NC vendors, including two dominant Japanese manufacturers, the European leader Heidenhain (Germany), and Haas (USA), known for its Formula 1 team. These companies collectively represent a substantial portion of the global controller market, with several boasting over a billion dollars in revenue. The research utilized both virtual and physical control simulators for initial testing to prevent machine damage and streamline experiments, with all critical findings validated on real-world physical CNC machines.

Key Findings

▶ Watch: Leaking G-code and dumping controller firmware (13:50)

The research uncovered a widespread and alarming lack of robust security practices across all major CNC controller vendors examined. The core vulnerabilities identified fell into several macro-categories, demonstrating a systemic problem rather than isolated incidents. These included the pervasive presence of legacy software, often running outdated operating systems or services with known vulnerabilities. This frequently led to information leakage, allowing attackers to glean sensitive operational data or even proprietary program code. A critical deficiency was the widespread lack of authentication, or instances where authentication mechanisms were either broken or not enabled by default, leaving critical services openly exposed. Furthermore, the controllers suffered from a fundamental lack of resource control, meaning that once an attacker gained access to a specific memory region or file system, there was often no effective separation of privileges, enabling lateral movement and unauthorized access to other critical system functions.

Across the four major vendors studied, the research team successfully demonstrated five distinct classes of attacks: simple compromise (e.g., gaining remote access), damage (to the manufactured piece or the machine itself), denial of service (DoS) (halting production), hijacking (altering machine behavior or output), and information theft (exfiltrating proprietary manufacturing data or program code). Strikingly, nearly all vendors were found to be equally vulnerable across these attack classes, suggesting a common underlying architectural and security philosophy that prioritizes functionality over protection. Balduzzi emphasized that these findings represent "just the point of the iceberg," indicating that the vast attack surface of CNC machines likely harbors many more undiscovered vulnerabilities. The immediate and significant impact of these vulnerabilities, ranging from minor production flaws to catastrophic equipment failure and operator safety risks, underscores the criticality of these findings.

Technical Deep Dive

▶ Watch: Disabling the emergency stop (feed hold) button (32:30)

The research methodology involved a multi-phase approach, beginning with initial automated vulnerability scanning using tools like Nessus to identify generic operating system or service-level vulnerabilities (e.g., outdated Windows services). This allowed the team to filter out non-CNC-specific issues and focus on vulnerabilities inherent to the CNC domain. The core of the deep dive centered on domain-specific technologies and protocols that facilitate remote interaction and data exchange with CNC controllers.

Two key protocols were analyzed:

1. Internet Q Commands (Haas): This is a proprietary protocol developed by Haas for remote interaction with its controllers. It allows querying machine status (serial number, production count) and, critically, reading from and writing to specific memory locations. The documentation indicated that writing was intended for local program variables, but the research found it was possible to write to system operation variables, directly influencing machine behavior.
2. MTConnect: An industry-standard protocol designed to standardize communication between different vendors' machines. It often exposes machine data in XML or JSON formats, including axis positions, production counts, and alarm states.

The team leveraged these protocols, along with other inherent system weaknesses, to develop a comprehensive suite of Proof-of-Concept (PoC) attacks:

• Information Leakage and Firmware Dumping:
• MTConnect G-Code Leakage: One vendor's MTConnect implementation exposed the currently executing line of G-Code. A simple Python script could continuously query the service, effectively dumping the entire proprietary program code running on the machine. Since G-Code is uncompiled, this allows direct intellectual property theft.
• Firmware Extraction (Seiko Board): On a controller utilizing a Seiko board, a physical jumper (Jumper 27) allowed booting from an external MicroSD card. By leveraging a vendor debugging bug that leaked the bootloader in their Git repository, the team was able to boot a custom u-boot system, SSH into the controller, and dump its complete firmware. The vendor initially failed to grasp the severity of this.

• Lack of Resource Control and Operational Hijacking:
• Disabling Single-Step Debug Mode (Haas): By writing to a system variable via the Internet Q commands protocol, attackers could remotely disable the "single-step" debug mode on a Haas machine. This mode requires operator confirmation for each program instruction. Bypassing it forced the machine to execute the entire program without intervention, posing a significant safety risk to operators debugging code and potentially damaging the workpiece.
• Parametric Program Hijacking: CNC programs often use parameters to allow variations in production (e.g., number of holes, dimensions). If an attacker can dump the G-Code and understand these parameters, they can then connect to the machine and remotely alter these variables, changing the machine's behavior (e.g., modifying a program to drill five holes instead of two).

• Simple Compromise and Backdoors (Okuma):
• Leveraging an old (2010) Metasploit vulnerability against an Okuma controller, the team installed a malicious plugin. Okuma machines support extending functionality via applications, similar to browser plugins. This malicious app served as a backdoor, connecting back to an attacker's command-and-control server, reporting machine details (name, serial number, controller type), and allowing remote manipulation of machine variables.

• Damage and Production Sabotage:
• Micro-Defects via Tool Compensation: CNC machines use tool compensation parameters (e.g., "wear") to account for drill bit degradation. An attacker could remotely connect and introduce a subtle compensation value (e.g., 0.25 millimeters). This seemingly minor change would cause the machine to drill at a slightly incorrect depth (e.g., 4.80mm instead of 5.05mm), leading to micro-defects that are extremely difficult for quality assurance to detect. For mass production, this could result in millions of faulty pieces and massive recall costs.
• Catastrophic Tool/Part Damage: By manipulating the wear parameter more aggressively (e.g., setting it to -10 centimeters), the machine would incorrectly compensate, driving the tool far beyond its intended depth, causing it to crash and break against the workpiece. This was demonstrated using a 3D-printed plastic tool to avoid destroying expensive industrial equipment.
• Automated Advanced Management Tool Abuse: Modern CNCs have systems to automatically change worn-out tools. Attackers could reset the tool lifetime value to 100%, preventing the machine from performing scheduled tool changes. This forces the machine to continue operating with a degraded tool, leading to damage to both the tool and the workpiece, potentially incurring hundreds of thousands of dollars in losses.

• Program Rewriting (FANUC):
• On a high-end FANUC controller, the research team demonstrated the ability to download an existing program (e.g., program O1000), modify its G-Code, and then re-upload the altered program. The machine automatically substituted the original program with the malicious one without any operator notification or confirmation, effectively hijacking the entire production process.

• Disabling Safety Features:
• Feed Hold Button Deactivation: The "feed hold" button is a critical emergency stop, akin to a car's brake. The team discovered an undocumented feature allowing the remote disabling of this button. By writing to specific memory addresses that control this functionality (due to a lack of separation of duties), an attacker could render the emergency stop inoperable, creating an extreme safety hazard for operators. This vulnerability was considered so severe it was patched immediately.

• Manufacturing Espionage and DoS:
• Production Line Monitoring: By monitoring services, attackers could dump real-time manufacturing information: machine name, serial number, controller type, current program, executed instructions, and production counters (e.g., pieces produced). This enables industrial espionage, allowing competitors to track production rates or steal proprietary processes.
• Triggering Software Alarms: Attackers could remotely trigger non-physical software alarms on the machine, causing disruption and potentially leading to a denial-of-service state.
• Ransomware: A proof-of-concept using Visual Basic demonstrated how an attacker could screen-lock an Okuma controller, demanding a ransom to unlock it and resume production. This highlights the potential for significant financial impact from DoS attacks.

Demo / Proof of Concept

▶ Watch: Challenges of disclosure and recommended countermeasures (37:30)

The talk was rich with practical demonstrations and proofs of concept, illustrating the real-world impact of the identified vulnerabilities. While specific video segments were not part of the output, Balduzzi described a range of effective attacks. These included showing how an attacker could remotely bypass the single-step debug mode on a Haas machine, forcing it to run a program to completion without operator intervention. He detailed the creation of subtle micro-defects in a manufactured piece by manipulating tool compensation parameters, and conversely, how catastrophic damage could be inflicted by more aggressive parameter changes leading to a tool crash. The live leakage of G-Code from a running machine via MTConnect, displaying the real-time execution of program instructions, underscored the severity of intellectual property theft. Furthermore, the ability to remotely rewrite an entire FANUC program and disable the critical "feed hold" emergency stop button were presented as stark examples of the profound control an attacker could gain over these industrial systems. These demonstrations were crucial in conveying the tangible risks posed by the security deficiencies.

Defensive Implications

▶ Watch: Q&A: Reverse engineering proprietary protocols and fixes (44:40)

The findings presented in this research carry significant implications for industrial defenders and asset owners. Given the complexity and criticality of CNC machines, a multi-faceted defense strategy is essential:

1. Network Segmentation: This remains a foundational and critical control. CNC machines, especially those on the production network, should be strictly segmented from enterprise networks. While often considered obvious, Balduzzi noted that this is frequently not the case, or that industrial gateways themselves introduce vulnerabilities that can bypass segmentation. Defenders must treat the production network as a high-security zone.
2. Asset Visibility and Security Testing: CNC machines, with their embedded operating systems and custom software, must be included in an organization's asset inventory and regular security testing regimes. They should not be overlooked simply because they are "machines" rather than traditional IT endpoints. This involves identifying all connected services, understanding their purpose, and assessing their security posture.
3. Secure Procurement: When purchasing new CNC machines, security must be a key consideration, not just cost. Buyers should inquire about built-in security features, authentication mechanisms, and vendor patching policies. Prioritizing security during procurement can prevent costly retrofits or incidents later.
4. Authentication Enforcement: Where authentication is available, it must be enabled by default and properly configured. For protocols lacking authentication entirely, compensating controls like network access controls and dedicated industrial firewalls are imperative to restrict access to trusted sources only.
5. Address Supply Chain Weaknesses: End-users should demand greater transparency and accountability from NC manufacturers regarding security. The complex supply chain creates a "shift of responsibility" where no single entity fully owns the security burden. This needs to change through industry standards and contractual obligations.
6. Patch Management Strategy: While patching ICS/OT environments is notoriously difficult due to uptime requirements and complex validation processes, a robust patch management strategy is still necessary. This includes planning for maintenance windows, thorough testing in non-production environments, and clear communication channels with vendors for vulnerability advisories and fixes.
7. Architectural Improvements: Vendors must address fundamental architectural flaws, such as the lack of resource control and separation of duties within their operating systems and proprietary protocols. This requires a re-evaluation of how memory and system variables are exposed and protected.

Key Takeaways

• CNC machines are critical and highly vulnerable: Despite their central role in manufacturing and high cost, CNC machines exhibit a pervasive lack of fundamental security controls, making them susceptible to a wide array of attacks.
• Complex supply chain exacerbates security issues: Vulnerabilities introduced by NC manufacturers propagate throughout the entire supply chain, and the distributed responsibility hinders effective remediation and disclosure.
• Pervasive legacy software and poor security hygiene: Many controllers run outdated software, lack proper authentication (or have it disabled by default), and suffer from a fundamental lack of resource separation, opening doors to various compromises.
• Attacks range from subtle to catastrophic: Adversaries can cause micro-defects that are hard to detect, steal proprietary G-Code, hijack production parameters, disable critical safety features, or inflict physical damage to machines and products.
• Defenders must integrate CNCs into security programs: These machines are not isolated silos; they must be included in asset inventories, subjected to security testing, and protected by robust network segmentation and access controls, with security prioritized during procurement.
• Responsible disclosure is a challenging, educational process: Engaging with vendors in the ICS/OT space requires patience and often involves acting as a consultant to explain the severity and implications of security findings. Organizations like CISA play a crucial role in facilitating this process.

About the Speaker(s)

Marco Balduzzi is a Senior Threat Researcher at Trend Micro. He has a long-standing history with the HITB conference series, having given his first talk at HITB Kuala Lumpur in 2011, demonstrating his sustained engagement with the cybersecurity community over more than a decade. His research, as showcased in this talk, focuses on critical and emerging areas of cybersecurity, particularly within industrial control systems and IoT, aiming to uncover and address vulnerabilities in foundational technologies that underpin modern industries.