Security of Digital Manufacturing Attack Surfaces, Threats, and Defenses

Overview of Digital Manufacturing (DM) Security

• Definition of Digital Manufacturing (DM): Unlike traditional manufacturing where paper blueprints were physically moved from engineers to machinists, digital manufacturing is a networked ecosystem. It integrates computer-aided design (CAD) software, machines, sensors, and supply chains into a unified digital thread.

• The Shift in Risk: Connectivity creates new vulnerabilities. In traditional setups, physical isolation provided security. In DM, every networked stage is a potential entry point for attackers. A failure can lead to factory sabotage, production line halts, or the deployment of defective/unsafe parts.

• Context within IoT:

  • Digital manufacturing represents Industrial IoT ($\text{IIoT}$).

  • Week $1$ Recall: The attack surface includes every networked stage of the pipeline.

  • Week $2$ Recall: IoT device vulnerabilities (unpatched software, isolation issues) are prevalent in factory equipment.

  • New Dimension: The supply chain extends the attack surface beyond the factory's physical walls.

The Five-Stage Digital Manufacturing Pipeline

Digital manufacturing operates as a sequence of five distinct stages where data is stored, transmitted, or processed. A design file must travel through these stages before a physical part exists.

• Stage $1$: Design (CAD File Creation):

  • An engineer uses software to draw the part.

  • The output is a digital file describing the full geometry.

• Stage $2$: Process Planning (Instruction Generation):

  • Software translates the CAD design into machine-specific commands (sequence of movements).

• Stage $3$: Machine Controller (Instruction Execution):

  • A dedicated computer on the factory floor reads instructions to drive motors, cutting tools, or print heads.

• Stage $4$: Sensors (Output Monitoring):

  • Sensors measure physical parameters (temperature, position, thickness) and provide real-time feedback to the controller.

• Stage $5$: Quality Inspection (Verification):

  • The finished part is checked against original specifications before entering the supply chain.

Threat Taxonomy and Attacker Objectives

Mahesh et al. identify three main threat goals targeting different victims with varying discovery timelines.

• Piracy (IP Theft):

  • Goal: Copy the design without authorization/payment to gain a competitive advantage.

  • Harmed Party: The manufacturer (lost revenue).

  • Discovery: Relatively quick; usually when a copied product appears on the market.

• Counterfeiting:

  • Goal: Produce and sell unauthorized, often substandard copies.

  • Harmed Party: The buyer (receives unsafe or uncertified parts).

  • Discovery: Weeks or months; when the part fails certification or quality checks.

• Sabotage:

  • Goal: Introduce hidden defects causing failure during service/use.

  • Harmed Party: The end user (catastrophic field failure).

  • Discovery: Months or years; often only when specific load conditions are reached. This is the most dangerous threat because it may leave no digital trace.

Attacker Perspective of the DM Pipeline

Each stage of the pipeline corresponds to specific attack methods and threat goals:

• Design Stage: Attacker copies or modifies CAD files. (Goal: Piracy/Sabotage).

• Process Planning Stage: Attacker alters machine instructions after approval. The file looks correct, but the machine builds a different part. (Goal: Sabotage).

• Machine Controller Stage: Attacker installs ransomware or manipulates real-time commands. (Goal: Disruption/Sabotage).

• Sensors Stage: Attacker injects false readings. The controller perceives "normal" operation while the machine produces defects. (Goal: Sabotage).

• Quality Inspection Stage: Standard visual checks fail to see internal defects. (Goal: Sabotage).

Industrial IoT (IIoT) and IT/OT Convergence

• The Hybrid Machine Tool Example: Modern systems often combine additive manufacturing ($3\text{D}$ printing) and subtractive manufacturing (milling) in one device.

• IT/OT Gap:

  • OT (Operational Technology): Hardware/controllers designed for long-term isolation, often lacking modern security layers.

  • IT (Information Technology): Software and networks used for data management.

  • Convergence Problem: When OT connects to IT, it inherits network threats without having the necessary defenses like logging or patching.

• Component Vulnerabilities:

  • Tools (Milling/Lasers): They lack independent verification; they execute any received instruction.

  • Controllers: Often run unpatched/legacy OS (e.g., Windows). Compromising a controller grants full control over the connected hardware.

  • Sensors: Lack sufficient activity logging; manipulated data is often accepted as "ground truth."

Case Study: The Dr0wned Attack

• The Scenario: Researchers demonstrated a sabotage attack on a $3\text{D}$-printed quadcopter propeller.

• Entry Point: The controller PC was compromised via an unpatched vulnerability in $WinRAR$.

• The Attack: The original design file was replaced with a counterfeit file that modified propeller joints to reduce fatigue life.

• Outcome: The machine printed the defective part without alerts; visual inspection was passed.

• Detection: The defect was only caught through rigorous structural load testing.

• Key Lesson: Digital controls protect files and networks, but without monitoring the physical build, interior sabotage remains invisible.

Case Study: WannaCry at Honda Sayama Plant

• The Incident: In June $2017$, a Honda factory in Tokyo went offline for $48\text{ hours}$.

• The Malware: $WannaCry$ ransomware exploited legacy, unpatched Windows systems via a backdoor.

• Network Failure: Both Industrial Control Systems (ICS) and IT networks were impacted, signaling a lack of network segmentation.

• Classification: A Denial of Service ($\text{DoS}$) attack in a manufacturing context—the goal was to halt production, not steal data.

• The Patching Dilemma: In factories, applying a standard IT patch without vendor validation risks stopping a production line. Thus, factories often fall behind on updates.

Case Study: The Invisible Sabotage

• The Method: An attacker modified a print file to replace build material with a temporary filler material (which washes away post-print) inside the part.

• The Result: The outside looked normal, but the part contained hidden empty spaces.

• Detection Requirement: This type of sabotage can only be caught using expert imaging like $X\text{-ray}$ scanning.

• Defense Insight: Checking the finished part is often too late; defense must happen at the moment of printing by monitoring material usage.

Supply Chain Security

• The "Weakest Link" Principle: A large manufacturer's security is only as strong as the smallest supplier it connects to.

• Targeting SMEs: Medium and small-scale enterprises often have fewer security resources but possess the same high-value design files and network access points.

• Attack Vector: Attackers bypass the primary manufacturer's defenses by compromising a trusted, less-secure supplier partner.

Defensive Strategies in Digital Manufacturing

Protecting Design Files

• Design Obfuscation: The designer embeds hidden "traps" or features that require specific printing instructions known only to the authorized user. Without the "key," the file prints a broken or non-functional shape. This makes stolen files useless (Piracy defense).

• Digital Watermarking: Unique hidden marks are embedded in every copy shared with suppliers. If a file is leaked, the mark identifies exactly which supplier was the source. (Piracy attribution).

Authenticating Physical Parts

• Embedded QR Codes: A code is fragmented and printed inside the structure of the part. It is invisible to the eye and can only be read via $X\text{-ray}$ at the correct angle.

• The Two-Code Trick: A design file contains two internal codes, but the manufacturer removes one before printing. If a fake is made from a stolen original file, it will contain both codes, failing the authentication scan.

• Unique Internal Patterns: Building unique shapes inside the material that a counterfeiter cannot see or replicate from surface-level inspection.

Manufacturing Network Defenses

• Built-in Security: Moving away from "security by isolation" toward "security by design." This includes strict activity logging in hardware and secure communication protocols.

• Network Segmentation: Isolating OT controllers on separate segments from IT/office networks to prevent lateral movement of malware.

Process Monitoring

• Real-time External Observation: Using sensors to check the machine's physical actions (temperature, nozzle position) against a known correct model while the part is being built.

• The Last Line of Defense: It catches attacks where the file or network defenses were bypassed. If a machine is compromised and starts building a defective part, process monitoring triggers an immediate alert.

Defensive Decision-Making (Think Like a Defender)

• Patching vs. Isolation: In manufacturing, isolation is often safer than untested patching. An untested patch can cause an immediate production halt (unacceptable in OT), whereas isolation removes the threat exposure while keeping the machine running.

• Supplier Requirements: Security mandates must be a prerequisite for access. Training your own staff or encrypting internal files does not mitigate the risk of an attacker using a supplier's legitimate portal access.

• Detecting Internal Defects: When network logs and file access records show no intrusion, the attack likely occurred at the controller level during runtime. Only process monitoring (layer-by-layer check) can catch such "invisible" discrepancies.