AI
Why OPC UA Gets Exposed to the Internet
OPC UA is the industrial automation protocol that convinced operators it was safe to skip VPNs. Unlike Modbus or older serial protocols, it ships with transport encryption and mutual certificate-based authentication. That combination made it popular for connecting PLCs, HMIs, and SCADA systems across trust boundaries, including over the public internet, to control remote assets like wind turbines.
That design choice is precisely what makes its cryptographic flaws consequential.
How the Two-Layer Handshake Works
The protocol has two layers. The secure channel performs an RSA handshake: client and server exchange nonces, each signed with the sender’s private key and encrypted for the recipient, then both sides derive AES/HMAC session keys. Above that, the session layer exchanges signed challenges to confirm device identity.
The flaw: the signed challenge format is identical in both directions, with no field marking a message as “from client” or “from server.” Many OPC UA nodes act as both client and server and share the same certificate, so a signature from either direction validates against the same public key.
Reflection and Relay Authentication Bypass
Challenge signatures look identical in both directions, making a server its own signing oracle. The attacker connects to the target, claims to be the target, receives a challenge, opens a second connection, and presents that challenge back. The server signs it. That signature goes into the first connection and passes device authentication without holding a private key.
The attack targets the HTTPS variant specifically. When OPC UA runs over HTTPS, the secure channel RSA handshake is skipped because TLS handles transport. Server-only TLS does not authenticate the client, so the session challenge is the only gate. Reflection removes it.
Bleichenbacher Padding Oracle Against TCP
The TCP variant still requires breaking the secure channel RSA handshake, so Tervoort applied Bleichenbacher’s 1998 PKCS#1 v1.5 attack against the deprecated cipher suite most implementations still accept. Most OPC UA servers return identical error messages for padding failures and signature failures, blocking an error-based oracle. The timing gap came from OPC UA’s multi-block RSA structure: repeating the attacker’s cipher block 100 times forces the server, on a valid-padding guess, to run 100 expensive RSA decryptions before rejecting the message.
“is a very expensive operation.” (Tom Tervoort)
That response-time gap reaches tens of seconds, with no statistical filtering needed to distinguish valid from invalid padding.
Live Demo and Vendor Impact
The timing-oracle attack demo (23:53) shows the tool in action: it spoofs a signature, sends the session request, holds the connection open on one TCP stream, and runs Bleichenbacher queries on separate connections to decrypt the server’s nonce.
Against a fast C implementation the attack completed in 15 minutes; other implementations took 30 minutes to two hours. Of seven implementations tested, five were vulnerable, four of those in their default configuration. The OPC Foundation responded in one hour, convened all vendors that day, and coordinated patches including Siemens fixes for WinCC.
Mitigations and Threat Model
Turning off the HTTPS variant and the legacy PKCS#1 v1.5 cipher removes both attack surfaces for most setups. Some implementations still run decryption with the deprecated padding even after it is nominally disabled, so running the public testing tool against your server is the only way to confirm a patch held.
For internet-exposed servers, IP allowlisting is the practical backstop. Operators who cannot patch quickly should add a VPN rather than relying on OPC UA’s own authentication. Both attacks apply only to certificate-based device authentication; setups using password authentication are not affected.
Q&A
Critical OT systems in remote locations (mines in Africa) won’t patch. Does this require more regulation or centralized control-system management? Tervoort said network segmentation is the practical fallback for environments that cannot patch; for internet exposure specifically, IP allowlisting plus VPNs is the baseline, and regulation requiring those controls would be a straightforward step. ▶ 35:53
Have you looked at attacking OAEP padding via Manger’s attack given the ECB-like multi-block structure? Tervoort looked at chosen-ciphertext attacks against OAEP in the multi-block context but could not get them to work in practice because all tested implementations validated the message signature in a way that prevented further information leakage. ▶ 39:50
Notable Quotes
pragmatic trust on first use solution. Tom Tervoort · ▶ 3:39
is a very expensive operation. Tom Tervoort · ▶ 21:53
don’t put this on the internet Tom Tervoort · ▶ 39:33
Key Takeaways
- OPC UA’s HTTPS variant allows a reflection attack that bypasses session authentication with no private key required.
- Repeating a PKCS#1 v1.5 cipher block 100 times amplifies the timing gap to tens of seconds, making Bleichenbacher practical in 15-120 minutes.
- 5 of 7 tested implementations were vulnerable in default configurations; check vendor advisories and disable the legacy RSA cipher and HTTPS feature.