SlideShare ist ein Scribd-Unternehmen logo

Scada deep inside: protocols and security mechanisms

•
•
Aleksandr Timorin
Aleksandr Timorin
Präsentationen & Vorträge
1 von 84
Downloaden Sie, um offline zu lesen
SCADA deep inside: protocols and security mechanisms Aleksandr Timorin ! ! ! ! ! ! ! ! HACK.LU 2014, 21-24 October 2014, Luxembourg
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 2 # whoami ! • SCADA security researcher, main specialisation - industrial protocols • penetration tester • SCADAStrangeLove team member -> scadasl.org • speaker at PHDays, Power Of Community, Chaos Communication Congress (workshop), CONFidence etc. • @atimorin • atimorin@gmail.com
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 3 # whoami
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 4 # agenda • intro to scada world • current situation in ICS network security • overview of industrial protocols • well-known protocols: profinet, modbus, dnp3, goose • go to particular: • IEC 61850-8-1 (MMS) • IEC 61870-5-101/104 • FTE • Siemens S7 • how to analyse protocols • real case • outro: releases, QA
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 5 # intro to scada world ICS - Industrial Control System SCADA - Supervisory Control And Data Acquisition PLC - Programmable Logic Controller HMI - Human-Machine Interface RTU - Remote Telemetry Unit Sensor, Actuator ! … and much more ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 6 # intro to scada world many many vendors in the world: • siemens • advantech • citectscada • codesys • moxa • schneider electric • rslogics • general electric • wellintech • sielco sistemi • emerson • abb • advanced micro controls • …. problems in security: ! • each vendor - own protocol, technology etc. • out-of-date: don’t touch if it works! • patch management cycle ! ! wild wild industrial world
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 7 # current situation in ICS network security ICS NETWORK absolutely unbreakable ???
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 8 # current situation in ICS network security NO, because of: ! ➡ typical network devices with default/crappy settings ➡ unpatched, old as dirt, full of junk software [malware] engineering workstations ➡ wireless AP with WEP (if the best happend) ➡ low physical security ➡ … and ➡ industrial protocols
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 9 # current situation in ICS network security !! ➡ typical network devices with default/crappy settings ➡ unpatched, old as dirt, full of junk software [malware] engineering workstations ➡ wireless AP with WER (if the best happend) ➡ low physical security ➡ … and ➡ industrial protocols
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 10 # current situation in ICS network security How protocols live in the network ? ! • full expanse • not blocked by firewalls/switches • accessible between LAN segments • works from data link layer to application layer • easy to detect • easy to intercept, analyse, reproduce and reply (but not all ! )
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 11 # overview of industrial protocols • modbus • profibus • profinet • dnp3 • ethernet/ip • s5/s7 (siemens protocols family) • CIP (rockwell automation) • cc-link (mitsubishi electric factory automation) • bacnet • iec 60870, iec 61850, iec 61107 • m-bus • zigbee • goose … iec - international electrotechnical commission
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 12 # overview of industrial protocols
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 13 # modbus • published by Modicon (now Schneider Electric) in 1979 • widely used for connecting industrial electronic devices • in XX: through rs-232/rs-485 • in XXI: modbus tcp • standard port 502/tcp ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 14 # modbus functions: ! • data access: read/write coils, registers, file records • diagnostics: device identification • user defined functions ! ! ! tools: ! • wireshark dissector • plcscan ( https://code.google.com/p/plcscan/ ) • modbus-discover nse (by Alexander Rudakov) • modbus simulators ()
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 15 # modbus security ? • no authentication • no encryption • no security ! transaction id: 2 bytes protocol id: 2 bytes (always 0) length: 2 bytes unit id: 1 byte function code: 1 byte data …
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 16 # dnp3 DNP3 Distributed Network Protocol • first version in 1990 • standartized by IEEE only on 2010 • mainly used in water and electric industry • master - outstation communication • tcp/udp standard port 20000 ! tools: • wireshark dissector • free implementation https://code.google.com/p/dnp3/ ! security ? DNP3 Secure Authentication v5. First version in 2007. Add device and user authentication Data protection
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 17 # dnp3 dnp3 frame: • header - 10 bytes • data - max 282 bytes ! header: • sync - 2 bytes • length -1 byte • link control - 1 byte • destination addr - 2 bytes • source addr - 2 bytes • crc - 2 bytes ! each device in network has unique address 1..65520 crc for every 16 bytes of data -> max frame len = 292 bytes work on iso/osi layers: data link layer, transport layer, application layer
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 18 # profinet dcp PROFINET family ! • Profinet CBA/IO/PTCP/DCP • iec 61158, iec 61784 in 2003 • Ethernet type 0x8892 • exchange data in real-time cycles • multicast discovery devices and stations ! security ? • no encryption • no authentication • no security
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 19 # profinet dcp PROFINET DCP - Discovery and basic Configuration Protocol ! ! ! ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 20 # profinet dcp frame types: • request 0xfefe • response 0xfeff • get/set 0xfefd ! multicast identify (scapy code): payload=‘fefe05000401000200800004ffff’.decode(‘hex’) srp(Ether(type=0x8892, src=smac, dst=’01:0e:cf:00:00:00’)/payload) ! fefe request 05 service id: identify 00 service type: request 04010002 xid (request id) 0080 delay 0004 data len ff option: all ff suboption: all
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 21 # profinet dcp • main interesting fields for playing is option and suboption • for example, set/get network info: opt 0x01, subopt 0x02 • led flashing: opt 0x05, subopt 0x03 ! so we can: • scan profinet supported devices and stations • change name of station • change ip, netmask, gateway • request full network info • LED flashing: PLC, HMI (simulates that smth wrong with device) • and much more
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 22 # profinet dcp profinet dcp scanner (raw sockets and scapy versions) ! ! ! ! ! ! ! discover all devices (PC, PLC, HMI) in subnet !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 23 # profinet dcp profinet fuzzer: fuzz options and sub options on plc siemens s7-1200 ! CVE-2014-2252 “An attacker could cause the device to go into defect mode if specially crafted PROFINET packets are sent to the device. A cold restart is required to recover the system.” ! what is “specially crafted profinet packets” ?
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 24 # profinet dcp CVE-2014-2252 ! just “set” request: set network info with all zero values. ! ip 0.0.0.0 mask 0.0.0.0 gw 0.0.0.0 !!!!
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 25 # profinet dcp DEMO: CVE-2014-2252
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 26 # goose GSE - Generic Substation Events - fast and reliable mechanism for transfer events data over entire substation networks: • IEC 61850 • multicast, broadcast mechanism ! GSE: • GOOSE: Generic Object Oriented Substations Events • GSSE: Generic Substation State Events
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 27 # goose • data as grouped dataset • transmitted within 4 ms • works on second layer (Ethernet) of ISO/OSI model • using publisher-subscriber mechanism -> broadcast, multicast MAC addresses (publisher ~ sender, subscriber ~ receiver) • use VLAN (IEEE 802.1Q standard) • message priority level (by VLAN PCP - Priority Code Point - in TCI field of packet) • retransmission mechanism and a message state number (new or retransmitted) • brand independent (i.e., IDE - intelligent electronic devices by some vendors doesn’t require specific cables)
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 28 # goose Attack scenarios: • easy to receive multicast or broadcast packets • easy to analyse, modify and reply packets • DDoS • by manipulating the state number in packet we can control the data set which transmitted in entire network (hijacking of communication channel) • VLAN hopping ! Tools: • wireshark dissector • easy to create your own scanner or injection tool • scapy based tool https://github.com/mdehus/goose-IEC61850-scapy
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 29 # IEC 61850-8-1 IEC 61850-8-1 (MMS) !!!!! MMS - Manufacturing Message Specification
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 30 # IEC 61850-8-1 • since 1980 • ISO 9501-1, 2003 • use ISO-TSAP as transport • standard tcp port 102 ! functions: • read/write tags, variables, domains (large unstructured data, i.e. program code) • start/stop/rewrite firmware on PLC • read/write/del files and directories ! security ? • simple methods whitelist • TLS (in theory, but in practice not supported by vendors and haven’t seen before in products) ! tools: • wireshark dissector • python and nmap identify scripts • emulator, open source libs
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 31 # IEC 61850-8-1
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 32 # IEC 61850-8-1 ~ nmap —script mms-identify.nse —script-args=‘mms-identify.timeout=500’ -p 102 <host> ! ! ! ! ! ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 33 # IEC 61870-5-101/104 IEC 61870-5-101/104 ! mainly for gathering telemetry in electricity distribution and power system automation ! huge list of functions, depends on vendors implementation: • read/write tags • upload/download files • broadcast connected devices discovery • time sync • reset process command • query log files • etc. ! security ? • no auth, no encryption • simple ip address whitelist (ip of master devices defined on slaves)
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 34 # IEC 61870-5-101/104 IEC 61870-5-101/104 ! standard tcp port 2404 ! tools: • simulators: sim104, mrts-ng etc. • wireshark dissector • python and nmap identify scripts
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 35 # IEC 61870-5-101/104
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 36 # IEC 61870-5-101/104 ~ nmap --script iec-identify.nse --script-args='iec-identify.timeout=500' -p 2404 <host> ! ! ! ! ! ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 37 # FTE Fault Tolerant Ethernet by Honeywell ! Provides robust and low-cost technology for industrial networks. Each FTE-node connected twice to network, support actual route table and exchanges route table with other nodes through multicast request. ! UDP as a transport. ! Proprietary protocol.
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 38 # FTE ! attack vectors: • flood udp ports • send multicast packets with fake routing table ! ! multicast packet —> ! headers: 0x01000810 0x01a01001 send each second
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 39 # FTE 0x23 node index ! 0x433330302023303335 node name (C300 #5) ! 0x44 and 0xca bytes of packets counter ! 0x32312032 part of firmware version full: EXP3 10.1-65.57 Sat Dec 06 20:22:33 2008 (Fri Nov 21 20:22:57 2008)
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 40 # Siemens ! TIA Portal (Totally Intergated Automation Portal) !! TIA - intellectual kernel of more than 100000 products created last 15 years. !! What about users, passwords and permissions?
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 41 # Siemens PLC read/write protection for main and critical operations: CPU start/stop/data change, project upload, firmware update, etc. ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 42 # Siemens TIA Portal PEData.plf passwords history ! ! ! ! ! ! ! ! ! ! passwords in sha-1 but “helpful” redbox value: password_len * 2 + 1 srsly>? for what???
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 43 # Siemens After notification Siemens “strengthened” users passwords and switched to md5… ! ! ! ! ! !!!! TIA Portal V12 UPD 3
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 44 # Siemens s7 password hashes extractor ! ! ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 45 # Siemens Improve user rights ! ! ! ! ! ! ! !!!!!!!!! User rights - 2 bytes after second md5 hash: 0x8001 —> 0xFFFF
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 46 # Siemens SCADA <-> PLC auth scheme: ! scada -> plc: auth request scada <- plc: challenge scada -> plc: response = HMAC(SHA1(password), challenge) scada <- plc: auth result ! python scripts (for 1200 and 1500 Siemens S7 PLC) for extracting all challenge-responses, export to JtR format and simple bruteforce ! want to crack password? use john the ripper!
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 47 # Siemens
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 48 # Siemens Bruteforce PLC online! ! Use powerful THC-Hydra Tested on S7-300 PLC. Should work on S7-200, S7-400 ! ! ! ~ hydra -F -V -P ./wordlist/500-worst-passwords.txt s7-300://<host>
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 49 # Siemens
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 50 # it’s a cookie time! PRE-DEMO: plc-ownage
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 51 # it’s a cookie time! • CVE-2014-2250, CVE-2014-2251 • SSA-654382, SSA-456423 • Affected devices: • Siemens S7-1200 PLC • Siemens S7-1500 PLC • CVSS Base Score: 8.3 ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 52 # it’s a cookie time! Tested on S7-1200 CPU 1212C, firmware V 2.2.0 ! ! ! ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 53 # it’s a cookie time! PmzR9733Q8rG3LpwjCGZT9N/ocMAAQABAAKK1woAqsgAAAAAAAAAAIrXIUM= ! uLiHXZUTy2GMgjr1KmgmcNN/ocMAAQACAAKK1woAqsgAAAAAAAAAAIrXIUM= ! Mu/vgiIgtrxq0LVp26nkMtN/ocMAAQADAAKK1woAqsgAAAAAAAAAAIrXIUM= ! tjH6vtNWCfa+QZHPDtCnKdN/ocMAAgADAAKK1woAqsgAAAAAAAAAAIrXIUM= ! ! ! ! 3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! b8b8875d9513cb618c823af52a682670d37fa1c30001000200028ad70a00aac800000000000000008ad72143 ! 32efef822220b6bc6ad0b569dba9e432d37fa1c30001000300028ad70a00aac800000000000000008ad72143 ! b631fabed35609f6be4191cf0ed0a729d37fa1c30002000300028ad70a00aac800000000000000008ad72143
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 54 # it’s a cookie time! 3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! ! 3e6cd1f7bdf743cac6dcba708c21994f + d37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! ! 3e6cd1f7bdf743cac6dcba708c21994f - ? d37fa1c3 - ? 0001 - ? 0001 - ? 00028ad7 - ? 0a00aac8 - ? 00000000000000008ad72143 - ?
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 55 # it’s a cookie time! 3e6cd1f7bdf743cac6dcba708c21994f MD5 of ? (16 bytes) d37fa1c3 CONST (4 bytes) 0001 user logout counter (2 bytes) 0001 counter of issued cookies for this user (2 bytes) 00028ad7 value that doesn’t matter (4 bytes) 0a00aac8 user IP address (10.0.170.200) (4 bytes) 00000000000000008ad72143 value that doesn’t matter (12 bytes) ! ! ! So, what about 3e6cd1f7bdf743cac6dcba708c21994f ???
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 56 # it’s a cookie time! ! 3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! ! 3e6cd1f7bdf743cac6dcba708c21994f ! ! MD5( NEXT 26 BYTES OF COOKIE + 16BYTES OF SECRET + 2 NULL BYTES) ! ! What is SECRET ?
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 57 # it’s a cookie time! SECRET generates after PLC start by ~PRNG. ! PRNG is a little bit harder than standard C PRNG. ! SEED in {0x0000 , 0xFFFF} ! ! ! ! ! ! ! ! It’s too much for bruteforce (PLC so tender >_<)
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 58 # it’s a cookie time! What about SEED ? SEED very often depends on time value ! SEED = PLC START TIME + 320 ! 320 by practical way: secret generates after ~ 3-4 seconds of PLC start using current time ! ! How to obtain PLC START TIME ? ! ! ! PLC START TIME = CURRENT TIME – UPTIME
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 59 # it’s a cookie time! Current time via web interface ! ! ! ! ! ! ! ! Uptime via SNMP with hardcoded read community string “public”
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 60 # it’s a cookie time! !!! * 100 - calculation lapse !!!! To generate cookie we should brute: • logout number (2 bytes, max 65535) • number of issued cookies (2 bytes, max 65535) • seed value (2 bytes, but max 100) ! ! Still too many values to bruteforce …
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 61 # it’s a cookie time! But if user (admin) not logged out properly then after 7 logins it is not possible to login again ! We should restart PLC or wait 30 minutes (cookie expire time) ! ! ! ! ! ! ! ! We can minimize logout and issued cookies counters to 7 To generate cookie we should brute: • logout number (2 bytes, max 7) • number of issued cookies (2 bytes, max 7) • seed value (2 bytes, but max 100)
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 62 # it’s a cookie time!
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 63 # it’s a cookie time! Exploitation dependences: ! • >= 1 success logins to PLC after last restart • SNMP enabled ! BUT IT DOES NOT NEED LOGIN AND PASSWORD !!! ! CVE Timeline: ! • End of July 2013 – vulnerability discovered • 5 August 2013 – vendor notified • 20 March 2014 – patch released, first public advisory
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 64 # heartbleed • a lot of software, devices etc. of popular vendors affected • it’ll be long long story (because of patch management and devices with lifecycle ~10-15 yers) • check https://ics-cert.us-cert.gov/advisories for openssl vulns ! Siemens also vulnerable (ICSA-14-105-03B): • eLAN-8.2 eLAN prior to 8.3.3 •WinCC OA only V3.12 • S7-1500 V1.5 • CP1543-1 V1.1 • APE 2.0 ! ! ! DEMO: winccoa-heartbleed
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 65 # S7 protocol ! ! ! ! ! ! ! ! ! Standard port 102/TCP ! By Siemens terms it is ISO-on-TCP (RFC 1006) based communication protocol
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 66 # S7 protocol Materials: ! • “Exploiting Siemens Simatic S7 PLCs” by Dillon Beresford • wireshark dissector • libnodave - free communication library • snap7 - open source communication suite • plcscan
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 67 # S7 protocol • based on iso-tcp -> block oriented protocol • block - PDU (Protocol Data Unit) • functions and commands oriented -> each frame contains function request or reply to it ! S7 commands: • plc start/stop cpu • firmware update • read/write data (blocks, tags) • system info • authentication • etc…
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 68 # S7 protocol History of S7: • S5 Communication (FETCH/WRITE, Sinec H1) • S7 Communication • “Another” S7 Communication ! Simply “another” S7 looks like: !! TCP : HEADER | ISO TCP ! ISO TCP: TPKT | COTP | S7 PDU
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 69 # S7 protocol • For old versions: wireshark dissectors, libraries, simulators. ! • Because we know all about that versions of protocol. ! • But we know next to nothing about “another” S7. !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 70 # S7 protocol Find your target: • S7 200/300/400 family ! ! ! ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 71 # S7 protocol Find your target: • S7 1200/1500 family ! ! ! ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 72 # How to analyse protocols
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 73 # How to analyse protocols How to analyse protocols ? ! ! Rob Savoye, FOSDEM 2009 “Reverse engineering of proprietary protocols, tools and techniques” ! “Believe it or not, if you stare at the hex dumps long enough, you start to see the patterns” !!!
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 74 # How to analyse protocols
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 75 # How to analyse protocols show_byte_sequences.py ! ! ! ! ! ! ! ! ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 76 # How to analyse protocols s7-show-payloads.py ! ! ! ! ! ! ! ! ! ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 77 # How to analyse protocols s7-packet-structure.py ! ! ! ! ! ! ! ! ! ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 78 # tools recommendations ! Protocol analysing involves: ! • tcpdump, wireshark/tshark + dissectors (keep them up to date from original source) • hex editor • python, perl, etc. • scapy framework • tools like ncat, socat, strings, xxd • sysinternals suite • fuzzers (your own or for example Zulu fuzzer by NCC Group) • disassembler (not so often) ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 79 # How to analyse protocols Use your knowledge about protocols: ! • it’s a universal and complex approach • you can: • detect devices and their protocols • monitor state, commands, exchanging data • inject, modify, reply packets in real-time !! Because most of them INSECURE BY DESIGN ! real example?
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 80 # real case Energetic turbine ! ! ! ! ! ! ! !!!!!!! ! ! Simple UDP packet that set “speed” of turbine to 57 (min=0, max=100)
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 81 # real case What will happen if you send another packet, another value? ! ! ! ! ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 82 # real case Yes, you’re right ! ! ! ! ! ! ! ! ! !
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 83 # outro all scripts, tools -> https://github.com/atimorin/scada-tools ! ! greetz to: @scadasl @repdet @GiftsUngiven Dmitry Sklyarov !!!! QA ?
SCADA deep inside: protocols and security mechanisms HACK.LU 2014 84 # Thank you! ! SCADASTRANGELOVE ! PEACE IS OUR PROFESSION !!!!!!!!!! @atimorin atimorin@gmail.com !

Empfohlen

Attacking SCADA systems: Story Of SCADASTRANGELOVE
Attacking SCADA systems: Story Of SCADASTRANGELOVEAttacking SCADA systems: Story Of SCADASTRANGELOVE
Attacking SCADA systems: Story Of SCADASTRANGELOVEAleksandr Timorin
 
Alexander Timorin, Dmitry Efanov. Industrial protocols for pentesters
Alexander Timorin, Dmitry Efanov. Industrial protocols for pentestersAlexander Timorin, Dmitry Efanov. Industrial protocols for pentesters
Alexander Timorin, Dmitry Efanov. Industrial protocols for pentestersPositive Hack Days
 
SCADA deep inside: protocols and security mechanisms
SCADA deep inside: protocols and security mechanismsSCADA deep inside: protocols and security mechanisms
SCADA deep inside: protocols and security mechanismsAleksandr Timorin
 
SCADA hacking industrial-scale fun
SCADA hacking industrial-scale funSCADA hacking industrial-scale fun
SCADA hacking industrial-scale funJan Seidl
 
The journey to ICS - Extended
The journey to ICS - Extended The journey to ICS - Extended
The journey to ICS - Extended Larry Vandenaweele
 
ICS Security 101 by Sandeep Singh
ICS Security 101 by Sandeep SinghICS Security 101 by Sandeep Singh
ICS Security 101 by Sandeep SinghOWASP Delhi
 
PLX Technology Company Overview
PLX Technology Company OverviewPLX Technology Company Overview
PLX Technology Company OverviewPLX Technology
 
Next Generation War: EDR vs RED TEAM
Next Generation War: EDR vs RED TEAMNext Generation War: EDR vs RED TEAM
Next Generation War: EDR vs RED TEAMBGA Cyber Security
 

Empfohlen

Attacking SCADA systems: Story Of SCADASTRANGELOVE
Attacking SCADA systems: Story Of SCADASTRANGELOVEAttacking SCADA systems: Story Of SCADASTRANGELOVE
Attacking SCADA systems: Story Of SCADASTRANGELOVEAleksandr Timorin
 
Alexander Timorin, Dmitry Efanov. Industrial protocols for pentesters
Alexander Timorin, Dmitry Efanov. Industrial protocols for pentestersAlexander Timorin, Dmitry Efanov. Industrial protocols for pentesters
Alexander Timorin, Dmitry Efanov. Industrial protocols for pentestersPositive Hack Days
 
SCADA deep inside: protocols and security mechanisms
SCADA deep inside: protocols and security mechanismsSCADA deep inside: protocols and security mechanisms
SCADA deep inside: protocols and security mechanismsAleksandr Timorin
 
SCADA hacking industrial-scale fun
SCADA hacking industrial-scale funSCADA hacking industrial-scale fun
SCADA hacking industrial-scale funJan Seidl
 
The journey to ICS - Extended
The journey to ICS - Extended The journey to ICS - Extended
The journey to ICS - Extended Larry Vandenaweele
 
ICS Security 101 by Sandeep Singh
ICS Security 101 by Sandeep SinghICS Security 101 by Sandeep Singh
ICS Security 101 by Sandeep SinghOWASP Delhi
 
PLX Technology Company Overview
PLX Technology Company OverviewPLX Technology Company Overview
PLX Technology Company OverviewPLX Technology
 
Next Generation War: EDR vs RED TEAM
Next Generation War: EDR vs RED TEAMNext Generation War: EDR vs RED TEAM
Next Generation War: EDR vs RED TEAMBGA Cyber Security
 
Python Programming for Arduino
Python Programming for ArduinoPython Programming for Arduino
Python Programming for Arduinorsorage
 
Comparison of MQTT and DDS as M2M Protocols for the Internet of Things
Comparison of MQTT and DDS as M2M Protocols for the Internet of ThingsComparison of MQTT and DDS as M2M Protocols for the Internet of Things
Comparison of MQTT and DDS as M2M Protocols for the Internet of ThingsReal-Time Innovations (RTI)
 
SCADA Security Presentation
SCADA Security PresentationSCADA Security Presentation
SCADA Security PresentationFilip Maertens
 
SCADA Security
SCADA SecuritySCADA Security
SCADA Securityamiable_indian
 
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...Cisco Canada
 
Zero trust in a hybrid architecture
Zero trust in a hybrid architectureZero trust in a hybrid architecture
Zero trust in a hybrid architectureHybrid IT Europe
 
Hacktive Directory Forensics - HackCon18, Oslo
Hacktive Directory Forensics - HackCon18, OsloHacktive Directory Forensics - HackCon18, Oslo
Hacktive Directory Forensics - HackCon18, OsloYossi Sassi
 
10 Reasons for Choosing OpenSplice DDS
10 Reasons for Choosing OpenSplice DDS10 Reasons for Choosing OpenSplice DDS
10 Reasons for Choosing OpenSplice DDSAngelo Corsaro
 
PCI express
PCI expressPCI express
PCI expresssarangaprabod
 
CNIT 141 13. TLS
CNIT 141 13. TLSCNIT 141 13. TLS
CNIT 141 13. TLSSam Bowne
 
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...arnaudsoullie
 
Zephyr: Creating a Best-of-Breed, Secure RTOS for IoT
Zephyr: Creating a Best-of-Breed, Secure RTOS for IoTZephyr: Creating a Best-of-Breed, Secure RTOS for IoT
Zephyr: Creating a Best-of-Breed, Secure RTOS for IoTLinuxCon ContainerCon CloudOpen China
 
Introduction to Frida
Introduction to FridaIntroduction to Frida
Introduction to FridaAbhishekJaiswal270
 
Integrity Protection for Embedded Systems
Integrity Protection for Embedded SystemsIntegrity Protection for Embedded Systems
Integrity Protection for Embedded SystemsSamsung Open Source Group
 
Deep Dive into the OPC UA / DDS Gateway Specification
Deep Dive into the OPC UA / DDS Gateway SpecificationDeep Dive into the OPC UA / DDS Gateway Specification
Deep Dive into the OPC UA / DDS Gateway SpecificationGerardo Pardo-Castellote
 
Board support package_on_linux
Board support package_on_linuxBoard support package_on_linux
Board support package_on_linuxVandana Salve
 
Introduction to Linux Drivers
Introduction to Linux DriversIntroduction to Linux Drivers
Introduction to Linux DriversAnil Kumar Pugalia
 
Privileged Access Management (PAM)
Privileged Access Management (PAM)Privileged Access Management (PAM)
Privileged Access Management (PAM)danb02
 
Reconnaissance of Virtio: What’s new and how it’s all connected?
Reconnaissance of Virtio: What’s new and how it’s all connected?Reconnaissance of Virtio: What’s new and how it’s all connected?
Reconnaissance of Virtio: What’s new and how it’s all connected?Samsung Open Source Group
 
The Current ICS Threat Landscape
The Current ICS Threat LandscapeThe Current ICS Threat Landscape
The Current ICS Threat LandscapeDragos, Inc.
 
Managing The Security Risks Of Your Scada System, Ahmad Alanazy, 2012
Managing The Security Risks Of Your Scada System, Ahmad Alanazy, 2012Managing The Security Risks Of Your Scada System, Ahmad Alanazy, 2012
Managing The Security Risks Of Your Scada System, Ahmad Alanazy, 2012Ahmed Al Enizi
 
Scada architecture
Scada architectureScada architecture
Scada architectureinvincibleneo
 

Weitere ähnliche Inhalte

Was ist angesagt?

Python Programming for Arduino
Python Programming for ArduinoPython Programming for Arduino
Python Programming for Arduinorsorage
 
Comparison of MQTT and DDS as M2M Protocols for the Internet of Things
Comparison of MQTT and DDS as M2M Protocols for the Internet of ThingsComparison of MQTT and DDS as M2M Protocols for the Internet of Things
Comparison of MQTT and DDS as M2M Protocols for the Internet of ThingsReal-Time Innovations (RTI)
 
SCADA Security Presentation
SCADA Security PresentationSCADA Security Presentation
SCADA Security PresentationFilip Maertens
 
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...Cisco Canada
 
Zero trust in a hybrid architecture
Zero trust in a hybrid architectureZero trust in a hybrid architecture
Zero trust in a hybrid architectureHybrid IT Europe
 
Hacktive Directory Forensics - HackCon18, Oslo
Hacktive Directory Forensics - HackCon18, OsloHacktive Directory Forensics - HackCon18, Oslo
Hacktive Directory Forensics - HackCon18, OsloYossi Sassi
 
10 Reasons for Choosing OpenSplice DDS
10 Reasons for Choosing OpenSplice DDS10 Reasons for Choosing OpenSplice DDS
10 Reasons for Choosing OpenSplice DDSAngelo Corsaro
 
CNIT 141 13. TLS
CNIT 141 13. TLSCNIT 141 13. TLS
CNIT 141 13. TLSSam Bowne
 
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...arnaudsoullie
 
Deep Dive into the OPC UA / DDS Gateway Specification
Deep Dive into the OPC UA / DDS Gateway SpecificationDeep Dive into the OPC UA / DDS Gateway Specification
Deep Dive into the OPC UA / DDS Gateway SpecificationGerardo Pardo-Castellote
 
Board support package_on_linux
Board support package_on_linuxBoard support package_on_linux
Board support package_on_linuxVandana Salve
 
Privileged Access Management (PAM)
Privileged Access Management (PAM)Privileged Access Management (PAM)
Privileged Access Management (PAM)danb02
 
Reconnaissance of Virtio: What’s new and how it’s all connected?
Reconnaissance of Virtio: What’s new and how it’s all connected?Reconnaissance of Virtio: What’s new and how it’s all connected?
Reconnaissance of Virtio: What’s new and how it’s all connected?Samsung Open Source Group
 
The Current ICS Threat Landscape
The Current ICS Threat LandscapeThe Current ICS Threat Landscape
The Current ICS Threat LandscapeDragos, Inc.
 

Was ist angesagt? (20)

Python Programming for Arduino
Python Programming for ArduinoPython Programming for Arduino
Python Programming for Arduino
 
Comparison of MQTT and DDS as M2M Protocols for the Internet of Things
Comparison of MQTT and DDS as M2M Protocols for the Internet of ThingsComparison of MQTT and DDS as M2M Protocols for the Internet of Things
Comparison of MQTT and DDS as M2M Protocols for the Internet of Things
 
SCADA Security Presentation
SCADA Security PresentationSCADA Security Presentation
SCADA Security Presentation
 
SCADA Security
SCADA SecuritySCADA Security
SCADA Security
 
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...
Cisco Connect Vancouver 2017 - Putting firepower into the next generation fir...
 
Zero trust in a hybrid architecture
Zero trust in a hybrid architectureZero trust in a hybrid architecture
Zero trust in a hybrid architecture
 
Hacktive Directory Forensics - HackCon18, Oslo
Hacktive Directory Forensics - HackCon18, OsloHacktive Directory Forensics - HackCon18, Oslo
Hacktive Directory Forensics - HackCon18, Oslo
 
10 Reasons for Choosing OpenSplice DDS
10 Reasons for Choosing OpenSplice DDS10 Reasons for Choosing OpenSplice DDS
10 Reasons for Choosing OpenSplice DDS
 
PCI express
PCI expressPCI express
PCI express
 
CNIT 141 13. TLS
CNIT 141 13. TLSCNIT 141 13. TLS
CNIT 141 13. TLS
 
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
 
Zephyr: Creating a Best-of-Breed, Secure RTOS for IoT
Zephyr: Creating a Best-of-Breed, Secure RTOS for IoTZephyr: Creating a Best-of-Breed, Secure RTOS for IoT
Zephyr: Creating a Best-of-Breed, Secure RTOS for IoT
 
Introduction to Frida
Introduction to FridaIntroduction to Frida
Introduction to Frida
 
Integrity Protection for Embedded Systems
Integrity Protection for Embedded SystemsIntegrity Protection for Embedded Systems
Integrity Protection for Embedded Systems
 
Deep Dive into the OPC UA / DDS Gateway Specification
Deep Dive into the OPC UA / DDS Gateway SpecificationDeep Dive into the OPC UA / DDS Gateway Specification
Deep Dive into the OPC UA / DDS Gateway Specification
 
Board support package_on_linux
Board support package_on_linuxBoard support package_on_linux
Board support package_on_linux
 
Introduction to Linux Drivers
Introduction to Linux DriversIntroduction to Linux Drivers
Introduction to Linux Drivers
 
Privileged Access Management (PAM)
Privileged Access Management (PAM)Privileged Access Management (PAM)
Privileged Access Management (PAM)
 
Reconnaissance of Virtio: What’s new and how it’s all connected?
Reconnaissance of Virtio: What’s new and how it’s all connected?Reconnaissance of Virtio: What’s new and how it’s all connected?
Reconnaissance of Virtio: What’s new and how it’s all connected?
 
The Current ICS Threat Landscape
The Current ICS Threat LandscapeThe Current ICS Threat Landscape
The Current ICS Threat Landscape
 

Andere mochten auch

Managing The Security Risks Of Your Scada System, Ahmad Alanazy, 2012
Managing The Security Risks Of Your Scada System, Ahmad Alanazy, 2012Managing The Security Risks Of Your Scada System, Ahmad Alanazy, 2012
Managing The Security Risks Of Your Scada System, Ahmad Alanazy, 2012Ahmed Al Enizi
 
Scada
ScadaScada
ScadaTribi
 
SCADA Software or Swiss Cheese Software?　 by Celil UNUVER
SCADA Software or Swiss Cheese Software?　 by Celil UNUVERSCADA Software or Swiss Cheese Software?　 by Celil UNUVER
SCADA Software or Swiss Cheese Software?　 by Celil UNUVERCODE BLUE
 
BlackHat Europe 2010: SCADA and ICS for Security Experts
BlackHat Europe 2010: SCADA and ICS for Security ExpertsBlackHat Europe 2010: SCADA and ICS for Security Experts
BlackHat Europe 2010: SCADA and ICS for Security ExpertsJames Arlen
 
SCADA deep inside:protocols and software architecture
SCADA deep inside:protocols and software architectureSCADA deep inside:protocols and software architecture
SCADA deep inside:protocols and software architectureqqlan
 
Industrial protocols for pentesters
Industrial protocols for pentestersIndustrial protocols for pentesters
Industrial protocols for pentestersAleksandr Timorin
 
Notacon 7 - SCADA and ICS for Security Experts
Notacon 7 - SCADA and ICS for Security ExpertsNotacon 7 - SCADA and ICS for Security Experts
Notacon 7 - SCADA and ICS for Security ExpertsJames Arlen
 
Protecting Infrastructure from Cyber Attacks
Protecting Infrastructure from Cyber AttacksProtecting Infrastructure from Cyber Attacks
Protecting Infrastructure from Cyber AttacksMaurice Dawson
 
SANS ICS Security Survey Report 2016
SANS ICS Security Survey Report 2016 SANS ICS Security Survey Report 2016
SANS ICS Security Survey Report 2016 Derek Harp
 
Industrial Control System Security Overview
Industrial Control System Security OverviewIndustrial Control System Security Overview
Industrial Control System Security Overviewpgmaynard
 
Cyber Security Threats to Industrial Control Systems
Cyber Security Threats to Industrial Control SystemsCyber Security Threats to Industrial Control Systems
Cyber Security Threats to Industrial Control SystemsDavid Spinks
 
Using Assessment Tools on ICS (English)
Using Assessment Tools on ICS (English)Using Assessment Tools on ICS (English)
Using Assessment Tools on ICS (English)Digital Bond
 
Scada Security & Penetration Testing
Scada Security & Penetration TestingScada Security & Penetration Testing
Scada Security & Penetration TestingAhmed Sherif
 

Andere mochten auch (20)

Managing The Security Risks Of Your Scada System, Ahmad Alanazy, 2012
Managing The Security Risks Of Your Scada System, Ahmad Alanazy, 2012Managing The Security Risks Of Your Scada System, Ahmad Alanazy, 2012
Managing The Security Risks Of Your Scada System, Ahmad Alanazy, 2012
 
Scada architecture
Scada architectureScada architecture
Scada architecture
 
Scada
ScadaScada
Scada
 
All about scada
All about scadaAll about scada
All about scada
 
Scada
ScadaScada
Scada
 
nullcon 2011 - Exploiting SCADA Systems
nullcon 2011 - Exploiting SCADA Systemsnullcon 2011 - Exploiting SCADA Systems
nullcon 2011 - Exploiting SCADA Systems
 
SCADA
SCADASCADA
SCADA
 
SCADA Software or Swiss Cheese Software?　 by Celil UNUVER
SCADA Software or Swiss Cheese Software?　 by Celil UNUVERSCADA Software or Swiss Cheese Software?　 by Celil UNUVER
SCADA Software or Swiss Cheese Software?　 by Celil UNUVER
 
BlackHat Europe 2010: SCADA and ICS for Security Experts
BlackHat Europe 2010: SCADA and ICS for Security ExpertsBlackHat Europe 2010: SCADA and ICS for Security Experts
BlackHat Europe 2010: SCADA and ICS for Security Experts
 
SCADA deep inside:protocols and software architecture
SCADA deep inside:protocols and software architectureSCADA deep inside:protocols and software architecture
SCADA deep inside:protocols and software architecture
 
Industrial protocols for pentesters
Industrial protocols for pentestersIndustrial protocols for pentesters
Industrial protocols for pentesters
 
Notacon 7 - SCADA and ICS for Security Experts
Notacon 7 - SCADA and ICS for Security ExpertsNotacon 7 - SCADA and ICS for Security Experts
Notacon 7 - SCADA and ICS for Security Experts
 
Protecting Infrastructure from Cyber Attacks
Protecting Infrastructure from Cyber AttacksProtecting Infrastructure from Cyber Attacks
Protecting Infrastructure from Cyber Attacks
 
SANS ICS Security Survey Report 2016
SANS ICS Security Survey Report 2016 SANS ICS Security Survey Report 2016
SANS ICS Security Survey Report 2016
 
Industrial Control System Security Overview
Industrial Control System Security OverviewIndustrial Control System Security Overview
Industrial Control System Security Overview
 
Cyber Security Threats to Industrial Control Systems
Cyber Security Threats to Industrial Control SystemsCyber Security Threats to Industrial Control Systems
Cyber Security Threats to Industrial Control Systems
 
ICS security
ICS securityICS security
ICS security
 
Using Assessment Tools on ICS (English)
Using Assessment Tools on ICS (English)Using Assessment Tools on ICS (English)
Using Assessment Tools on ICS (English)
 
Improving SCADA Security
Improving SCADA SecurityImproving SCADA Security
Improving SCADA Security
 
Scada Security & Penetration Testing
Scada Security & Penetration TestingScada Security & Penetration Testing
Scada Security & Penetration Testing
 

Ähnlich wie Scada deep inside: protocols and security mechanisms

CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security...
CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security...CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security...
CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security...PROIDEA
 
OWASP Appsec USA 2014 Talk "Pwning the Pawns with Wihawk" Santhosh Kumar
OWASP Appsec USA 2014 Talk "Pwning the Pawns with Wihawk" Santhosh Kumar OWASP Appsec USA 2014 Talk "Pwning the Pawns with Wihawk" Santhosh Kumar
OWASP Appsec USA 2014 Talk "Pwning the Pawns with Wihawk" Santhosh Kumar Santhosh Kumar
 
Compromising Industrial Facilities From 40 Miles Away
Compromising Industrial Facilities From 40 Miles AwayCompromising Industrial Facilities From 40 Miles Away
Compromising Industrial Facilities From 40 Miles AwayEnergySec
 
2017 - LISA - LinkedIn's Distributed Firewall (DFW)
2017 - LISA - LinkedIn's Distributed Firewall (DFW)2017 - LISA - LinkedIn's Distributed Firewall (DFW)
2017 - LISA - LinkedIn's Distributed Firewall (DFW)Mike Svoboda
 
BSides London 2015 - Proprietary network protocols - risky business on the wire.
BSides London 2015 - Proprietary network protocols - risky business on the wire.BSides London 2015 - Proprietary network protocols - risky business on the wire.
BSides London 2015 - Proprietary network protocols - risky business on the wire.Jakub Kałużny
 
Industrial protocols for pentesters
Industrial protocols for pentestersIndustrial protocols for pentesters
Industrial protocols for pentestersPositive Hack Days
 
NSC 2014 HomePlugAV PLC: Practical attacks and backdooring (slides)
NSC 2014 HomePlugAV PLC: Practical attacks and backdooring (slides)NSC 2014 HomePlugAV PLC: Practical attacks and backdooring (slides)
NSC 2014 HomePlugAV PLC: Practical attacks and backdooring (slides)📡 Sebastien Dudek
 
NSC #2 - D1 03 - Sébastien Dudek - HomePlugAV PLC
NSC #2 - D1 03 - Sébastien Dudek - HomePlugAV PLCNSC #2 - D1 03 - Sébastien Dudek - HomePlugAV PLC
NSC #2 - D1 03 - Sébastien Dudek - HomePlugAV PLCNoSuchCon
 
Nozomi Networks SCADAguardian - Data-Sheet
Nozomi Networks SCADAguardian - Data-SheetNozomi Networks SCADAguardian - Data-Sheet
Nozomi Networks SCADAguardian - Data-SheetNozomi Networks
 
Industrial protocols for pentesters
Industrial protocols for pentestersIndustrial protocols for pentesters
Industrial protocols for pentestersPositive Hack Days
 
microcontrollersstm32wlseriesproductwebinarpresentation1625231766205.pdf
microcontrollersstm32wlseriesproductwebinarpresentation1625231766205.pdfmicrocontrollersstm32wlseriesproductwebinarpresentation1625231766205.pdf
microcontrollersstm32wlseriesproductwebinarpresentation1625231766205.pdfadfadfadf
 
Shameful Secrets of Proprietary Network Protocols - OWASP AppSec EU 2014
Shameful Secrets of Proprietary Network Protocols - OWASP AppSec EU 2014Shameful Secrets of Proprietary Network Protocols - OWASP AppSec EU 2014
Shameful Secrets of Proprietary Network Protocols - OWASP AppSec EU 2014Jakub Kałużny
 
OT Security - h-c0n 2020
OT Security - h-c0n 2020OT Security - h-c0n 2020
OT Security - h-c0n 2020Jose Palanco
 
Next Generation Serial Console Server the Dominion SX II
Next Generation Serial Console Server the Dominion SX II Next Generation Serial Console Server the Dominion SX II
Next Generation Serial Console Server the Dominion SX II Raritan
 
ICP DAS USA Products Presentation
ICP DAS USA Products PresentationICP DAS USA Products Presentation
ICP DAS USA Products PresentationColin McLeod
 
Case Study At91RM9200 Data Hub Controller
Case Study At91RM9200 Data Hub ControllerCase Study At91RM9200 Data Hub Controller
Case Study At91RM9200 Data Hub ControllerPromwad
 
CableTap - Wirelessly Tapping Your Home Network
CableTap - Wirelessly Tapping Your Home NetworkCableTap - Wirelessly Tapping Your Home Network
CableTap - Wirelessly Tapping Your Home NetworkChristopher Grayson
 
Shameful secrets of proprietary network protocols
Shameful secrets of proprietary network protocolsShameful secrets of proprietary network protocols
Shameful secrets of proprietary network protocolsSlawomir Jasek
 
Training manual on scada
Training manual on scadaTraining manual on scada
Training manual on scadabhavuksharma10
 

Ähnlich wie Scada deep inside: protocols and security mechanisms (20)

CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security...
CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security...CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security...
CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security...
 
OWASP Appsec USA 2014 Talk "Pwning the Pawns with Wihawk" Santhosh Kumar
OWASP Appsec USA 2014 Talk "Pwning the Pawns with Wihawk" Santhosh Kumar OWASP Appsec USA 2014 Talk "Pwning the Pawns with Wihawk" Santhosh Kumar
OWASP Appsec USA 2014 Talk "Pwning the Pawns with Wihawk" Santhosh Kumar
 
Compromising Industrial Facilities From 40 Miles Away
Compromising Industrial Facilities From 40 Miles AwayCompromising Industrial Facilities From 40 Miles Away
Compromising Industrial Facilities From 40 Miles Away
 
2017 - LISA - LinkedIn's Distributed Firewall (DFW)
2017 - LISA - LinkedIn's Distributed Firewall (DFW)2017 - LISA - LinkedIn's Distributed Firewall (DFW)
2017 - LISA - LinkedIn's Distributed Firewall (DFW)
 
BSides London 2015 - Proprietary network protocols - risky business on the wire.
BSides London 2015 - Proprietary network protocols - risky business on the wire.BSides London 2015 - Proprietary network protocols - risky business on the wire.
BSides London 2015 - Proprietary network protocols - risky business on the wire.
 
Industrial protocols for pentesters
Industrial protocols for pentestersIndustrial protocols for pentesters
Industrial protocols for pentesters
 
NSC 2014 HomePlugAV PLC: Practical attacks and backdooring (slides)
NSC 2014 HomePlugAV PLC: Practical attacks and backdooring (slides)NSC 2014 HomePlugAV PLC: Practical attacks and backdooring (slides)
NSC 2014 HomePlugAV PLC: Practical attacks and backdooring (slides)
 
NSC #2 - D1 03 - Sébastien Dudek - HomePlugAV PLC
NSC #2 - D1 03 - Sébastien Dudek - HomePlugAV PLCNSC #2 - D1 03 - Sébastien Dudek - HomePlugAV PLC
NSC #2 - D1 03 - Sébastien Dudek - HomePlugAV PLC
 
Nozomi Networks SCADAguardian - Data-Sheet
Nozomi Networks SCADAguardian - Data-SheetNozomi Networks SCADAguardian - Data-Sheet
Nozomi Networks SCADAguardian - Data-Sheet
 
Industrial protocols for pentesters
Industrial protocols for pentestersIndustrial protocols for pentesters
Industrial protocols for pentesters
 
microcontrollersstm32wlseriesproductwebinarpresentation1625231766205.pdf
microcontrollersstm32wlseriesproductwebinarpresentation1625231766205.pdfmicrocontrollersstm32wlseriesproductwebinarpresentation1625231766205.pdf
microcontrollersstm32wlseriesproductwebinarpresentation1625231766205.pdf
 
Shameful Secrets of Proprietary Network Protocols - OWASP AppSec EU 2014
Shameful Secrets of Proprietary Network Protocols - OWASP AppSec EU 2014Shameful Secrets of Proprietary Network Protocols - OWASP AppSec EU 2014
Shameful Secrets of Proprietary Network Protocols - OWASP AppSec EU 2014
 
OT Security - h-c0n 2020
OT Security - h-c0n 2020OT Security - h-c0n 2020
OT Security - h-c0n 2020
 
Next Generation Serial Console Server the Dominion SX II
Next Generation Serial Console Server the Dominion SX II Next Generation Serial Console Server the Dominion SX II
Next Generation Serial Console Server the Dominion SX II
 
ICP DAS USA Products Presentation
ICP DAS USA Products PresentationICP DAS USA Products Presentation
ICP DAS USA Products Presentation
 
Case Study At91RM9200 Data Hub Controller
Case Study At91RM9200 Data Hub ControllerCase Study At91RM9200 Data Hub Controller
Case Study At91RM9200 Data Hub Controller
 
CableTap - Wirelessly Tapping Your Home Network
CableTap - Wirelessly Tapping Your Home NetworkCableTap - Wirelessly Tapping Your Home Network
CableTap - Wirelessly Tapping Your Home Network
 
ADAM-3600 Sales kit_WATER.pptx
ADAM-3600 Sales kit_WATER.pptxADAM-3600 Sales kit_WATER.pptx
ADAM-3600 Sales kit_WATER.pptx
 
Shameful secrets of proprietary network protocols
Shameful secrets of proprietary network protocolsShameful secrets of proprietary network protocols
Shameful secrets of proprietary network protocols
 
Training manual on scada
Training manual on scadaTraining manual on scada
Training manual on scada
 

Kürzlich hochgeladen

Testing with Fewer Resources: Toward Adaptive Approaches for Cost-effective ...
Testing with Fewer Resources: Toward Adaptive Approaches for Cost-effective ...Testing with Fewer Resources: Toward Adaptive Approaches for Cost-effective ...
Testing with Fewer Resources: Toward Adaptive Approaches for Cost-effective ...Sebastiano Panichella
 
Don't Miss Out: Strategies for Making the Most of the Ethena DigitalOpportunity
Don't Miss Out: Strategies for Making the Most of the Ethena DigitalOpportunityDon't Miss Out: Strategies for Making the Most of the Ethena DigitalOpportunity
Don't Miss Out: Strategies for Making the Most of the Ethena DigitalOpportunityApp Ethena
 
Engaging Eid Ul Fitr Presentation for Kindergartners.pptx
Engaging Eid Ul Fitr Presentation for Kindergartners.pptxEngaging Eid Ul Fitr Presentation for Kindergartners.pptx
Engaging Eid Ul Fitr Presentation for Kindergartners.pptxAsifArshad8
 
THE COUNTRY WHO SOLVED THE WORLD_HOW CHINA LAUNCHED THE CIVILIZATION REVOLUTI...
THE COUNTRY WHO SOLVED THE WORLD_HOW CHINA LAUNCHED THE CIVILIZATION REVOLUTI...THE COUNTRY WHO SOLVED THE WORLD_HOW CHINA LAUNCHED THE CIVILIZATION REVOLUTI...
THE COUNTRY WHO SOLVED THE WORLD_HOW CHINA LAUNCHED THE CIVILIZATION REVOLUTI...漢銘 謝
 
A Guide to Choosing the Ideal Air Cooler
A Guide to Choosing the Ideal Air CoolerA Guide to Choosing the Ideal Air Cooler
A Guide to Choosing the Ideal Air Coolerenquirieskenstar
 
Quality by design.. ppt for RA (1ST SEM
Quality by design.. ppt for RA (1ST SEMQuality by design.. ppt for RA (1ST SEM
Quality by design.. ppt for RA (1ST SEMCharmi13
 
Application of GIS in Landslide Disaster Response.pptx
Application of GIS in Landslide Disaster Response.pptxApplication of GIS in Landslide Disaster Response.pptx
Application of GIS in Landslide Disaster Response.pptxRoquia Salam
 
05.02 MMC - Assignment 4 - Image Attribution Lovepreet.pptx
05.02 MMC - Assignment 4 - Image Attribution Lovepreet.pptx05.02 MMC - Assignment 4 - Image Attribution Lovepreet.pptx
05.02 MMC - Assignment 4 - Image Attribution Lovepreet.pptxerickamwana1
 
proposal kumeneger edited.docx A kumeeger
proposal kumeneger edited.docx A kumeegerproposal kumeneger edited.docx A kumeeger
proposal kumeneger edited.docx A kumeegerkumenegertelayegrama
 
Internship Presentation | PPT | CSE | SE
Internship Presentation | PPT | CSE | SEInternship Presentation | PPT | CSE | SE
Internship Presentation | PPT | CSE | SESaleh Ibne Omar
 
General Elections Final Press Noteas per M
General Elections Final Press Noteas per MGeneral Elections Final Press Noteas per M
General Elections Final Press Noteas per MVidyaAdsule1
 
RACHEL-ANN M. TENIBRO PRODUCT RESEARCH PRESENTATION
RACHEL-ANN M. TENIBRO PRODUCT RESEARCH PRESENTATIONRACHEL-ANN M. TENIBRO PRODUCT RESEARCH PRESENTATION
RACHEL-ANN M. TENIBRO PRODUCT RESEARCH PRESENTATIONRachelAnnTenibroAmaz
 
Chizaram's Women Tech Makers Deck. .pptx
Chizaram's Women Tech Makers Deck. .pptxChizaram's Women Tech Makers Deck. .pptx
Chizaram's Women Tech Makers Deck. .pptxogubuikealex
 
cse-csp batch4 review-1.1.pptx cyber security
cse-csp batch4 review-1.1.pptx cyber securitycse-csp batch4 review-1.1.pptx cyber security
cse-csp batch4 review-1.1.pptx cyber securitysandeepnani2260
 
GESCO SE Press and Analyst Conference on Financial Results 2024
GESCO SE Press and Analyst Conference on Financial Results 2024GESCO SE Press and Analyst Conference on Financial Results 2024
GESCO SE Press and Analyst Conference on Financial Results 2024GESCO SE
 
Testing and Development Challenges for Complex Cyber-Physical Systems: Insigh...
Testing and Development Challenges for Complex Cyber-Physical Systems: Insigh...Testing and Development Challenges for Complex Cyber-Physical Systems: Insigh...
Testing and Development Challenges for Complex Cyber-Physical Systems: Insigh...Sebastiano Panichella
 
INDIAN GCP GUIDELINE. for Regulatory affair 1st sem CRR
INDIAN GCP GUIDELINE. for Regulatory affair 1st sem CRRINDIAN GCP GUIDELINE. for Regulatory affair 1st sem CRR
INDIAN GCP GUIDELINE. for Regulatory affair 1st sem CRRsarwankumar4524
 

Kürzlich hochgeladen (17)

Testing with Fewer Resources: Toward Adaptive Approaches for Cost-effective ...
Testing with Fewer Resources: Toward Adaptive Approaches for Cost-effective ...Testing with Fewer Resources: Toward Adaptive Approaches for Cost-effective ...
Testing with Fewer Resources: Toward Adaptive Approaches for Cost-effective ...
 
Don't Miss Out: Strategies for Making the Most of the Ethena DigitalOpportunity
Don't Miss Out: Strategies for Making the Most of the Ethena DigitalOpportunityDon't Miss Out: Strategies for Making the Most of the Ethena DigitalOpportunity
Don't Miss Out: Strategies for Making the Most of the Ethena DigitalOpportunity
 
Engaging Eid Ul Fitr Presentation for Kindergartners.pptx
Engaging Eid Ul Fitr Presentation for Kindergartners.pptxEngaging Eid Ul Fitr Presentation for Kindergartners.pptx
Engaging Eid Ul Fitr Presentation for Kindergartners.pptx
 
THE COUNTRY WHO SOLVED THE WORLD_HOW CHINA LAUNCHED THE CIVILIZATION REVOLUTI...
THE COUNTRY WHO SOLVED THE WORLD_HOW CHINA LAUNCHED THE CIVILIZATION REVOLUTI...THE COUNTRY WHO SOLVED THE WORLD_HOW CHINA LAUNCHED THE CIVILIZATION REVOLUTI...
THE COUNTRY WHO SOLVED THE WORLD_HOW CHINA LAUNCHED THE CIVILIZATION REVOLUTI...
 
A Guide to Choosing the Ideal Air Cooler
A Guide to Choosing the Ideal Air CoolerA Guide to Choosing the Ideal Air Cooler
A Guide to Choosing the Ideal Air Cooler
 
Quality by design.. ppt for RA (1ST SEM
Quality by design.. ppt for RA (1ST SEMQuality by design.. ppt for RA (1ST SEM
Quality by design.. ppt for RA (1ST SEM
 
Application of GIS in Landslide Disaster Response.pptx
Application of GIS in Landslide Disaster Response.pptxApplication of GIS in Landslide Disaster Response.pptx
Application of GIS in Landslide Disaster Response.pptx
 
05.02 MMC - Assignment 4 - Image Attribution Lovepreet.pptx
05.02 MMC - Assignment 4 - Image Attribution Lovepreet.pptx05.02 MMC - Assignment 4 - Image Attribution Lovepreet.pptx
05.02 MMC - Assignment 4 - Image Attribution Lovepreet.pptx
 
proposal kumeneger edited.docx A kumeeger
proposal kumeneger edited.docx A kumeegerproposal kumeneger edited.docx A kumeeger
proposal kumeneger edited.docx A kumeeger
 
Internship Presentation | PPT | CSE | SE
Internship Presentation | PPT | CSE | SEInternship Presentation | PPT | CSE | SE
Internship Presentation | PPT | CSE | SE
 
General Elections Final Press Noteas per M
General Elections Final Press Noteas per MGeneral Elections Final Press Noteas per M
General Elections Final Press Noteas per M
 
RACHEL-ANN M. TENIBRO PRODUCT RESEARCH PRESENTATION
RACHEL-ANN M. TENIBRO PRODUCT RESEARCH PRESENTATIONRACHEL-ANN M. TENIBRO PRODUCT RESEARCH PRESENTATION
RACHEL-ANN M. TENIBRO PRODUCT RESEARCH PRESENTATION
 
Chizaram's Women Tech Makers Deck. .pptx
Chizaram's Women Tech Makers Deck. .pptxChizaram's Women Tech Makers Deck. .pptx
Chizaram's Women Tech Makers Deck. .pptx
 
cse-csp batch4 review-1.1.pptx cyber security
cse-csp batch4 review-1.1.pptx cyber securitycse-csp batch4 review-1.1.pptx cyber security
cse-csp batch4 review-1.1.pptx cyber security
 
GESCO SE Press and Analyst Conference on Financial Results 2024
GESCO SE Press and Analyst Conference on Financial Results 2024GESCO SE Press and Analyst Conference on Financial Results 2024
GESCO SE Press and Analyst Conference on Financial Results 2024
 
Testing and Development Challenges for Complex Cyber-Physical Systems: Insigh...
Testing and Development Challenges for Complex Cyber-Physical Systems: Insigh...Testing and Development Challenges for Complex Cyber-Physical Systems: Insigh...
Testing and Development Challenges for Complex Cyber-Physical Systems: Insigh...
 
INDIAN GCP GUIDELINE. for Regulatory affair 1st sem CRR
INDIAN GCP GUIDELINE. for Regulatory affair 1st sem CRRINDIAN GCP GUIDELINE. for Regulatory affair 1st sem CRR
INDIAN GCP GUIDELINE. for Regulatory affair 1st sem CRR
 

Scada deep inside: protocols and security mechanisms

  • 1. SCADA deep inside: protocols and security mechanisms Aleksandr Timorin ! ! ! ! ! ! ! ! HACK.LU 2014, 21-24 October 2014, Luxembourg
  • 2. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 2 # whoami ! • SCADA security researcher, main specialisation - industrial protocols • penetration tester • SCADAStrangeLove team member -> scadasl.org • speaker at PHDays, Power Of Community, Chaos Communication Congress (workshop), CONFidence etc. • @atimorin • atimorin@gmail.com
  • 3. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 3 # whoami
  • 4. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 4 # agenda • intro to scada world • current situation in ICS network security • overview of industrial protocols • well-known protocols: profinet, modbus, dnp3, goose • go to particular: • IEC 61850-8-1 (MMS) • IEC 61870-5-101/104 • FTE • Siemens S7 • how to analyse protocols • real case • outro: releases, QA
  • 5. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 5 # intro to scada world ICS - Industrial Control System SCADA - Supervisory Control And Data Acquisition PLC - Programmable Logic Controller HMI - Human-Machine Interface RTU - Remote Telemetry Unit Sensor, Actuator ! … and much more ! ! !
  • 6. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 6 # intro to scada world many many vendors in the world: • siemens • advantech • citectscada • codesys • moxa • schneider electric • rslogics • general electric • wellintech • sielco sistemi • emerson • abb • advanced micro controls • …. problems in security: ! • each vendor - own protocol, technology etc. • out-of-date: don’t touch if it works! • patch management cycle ! ! wild wild industrial world
  • 7. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 7 # current situation in ICS network security ICS NETWORK absolutely unbreakable ???
  • 8. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 8 # current situation in ICS network security NO, because of: ! ➡ typical network devices with default/crappy settings ➡ unpatched, old as dirt, full of junk software [malware] engineering workstations ➡ wireless AP with WEP (if the best happend) ➡ low physical security ➡ … and ➡ industrial protocols
  • 9. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 9 # current situation in ICS network security !! ➡ typical network devices with default/crappy settings ➡ unpatched, old as dirt, full of junk software [malware] engineering workstations ➡ wireless AP with WER (if the best happend) ➡ low physical security ➡ … and ➡ industrial protocols
  • 10. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 10 # current situation in ICS network security How protocols live in the network ? ! • full expanse • not blocked by firewalls/switches • accessible between LAN segments • works from data link layer to application layer • easy to detect • easy to intercept, analyse, reproduce and reply (but not all ! )
  • 11. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 11 # overview of industrial protocols • modbus • profibus • profinet • dnp3 • ethernet/ip • s5/s7 (siemens protocols family) • CIP (rockwell automation) • cc-link (mitsubishi electric factory automation) • bacnet • iec 60870, iec 61850, iec 61107 • m-bus • zigbee • goose … iec - international electrotechnical commission
  • 12. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 12 # overview of industrial protocols
  • 13. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 13 # modbus • published by Modicon (now Schneider Electric) in 1979 • widely used for connecting industrial electronic devices • in XX: through rs-232/rs-485 • in XXI: modbus tcp • standard port 502/tcp ! ! !
  • 14. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 14 # modbus functions: ! • data access: read/write coils, registers, file records • diagnostics: device identification • user defined functions ! ! ! tools: ! • wireshark dissector • plcscan ( https://code.google.com/p/plcscan/ ) • modbus-discover nse (by Alexander Rudakov) • modbus simulators ()
  • 15. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 15 # modbus security ? • no authentication • no encryption • no security ! transaction id: 2 bytes protocol id: 2 bytes (always 0) length: 2 bytes unit id: 1 byte function code: 1 byte data …
  • 16. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 16 # dnp3 DNP3 Distributed Network Protocol • first version in 1990 • standartized by IEEE only on 2010 • mainly used in water and electric industry • master - outstation communication • tcp/udp standard port 20000 ! tools: • wireshark dissector • free implementation https://code.google.com/p/dnp3/ ! security ? DNP3 Secure Authentication v5. First version in 2007. Add device and user authentication Data protection
  • 17. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 17 # dnp3 dnp3 frame: • header - 10 bytes • data - max 282 bytes ! header: • sync - 2 bytes • length -1 byte • link control - 1 byte • destination addr - 2 bytes • source addr - 2 bytes • crc - 2 bytes ! each device in network has unique address 1..65520 crc for every 16 bytes of data -> max frame len = 292 bytes work on iso/osi layers: data link layer, transport layer, application layer
  • 18. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 18 # profinet dcp PROFINET family ! • Profinet CBA/IO/PTCP/DCP • iec 61158, iec 61784 in 2003 • Ethernet type 0x8892 • exchange data in real-time cycles • multicast discovery devices and stations ! security ? • no encryption • no authentication • no security
  • 19. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 19 # profinet dcp PROFINET DCP - Discovery and basic Configuration Protocol ! ! ! ! ! ! ! ! !
  • 20. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 20 # profinet dcp frame types: • request 0xfefe • response 0xfeff • get/set 0xfefd ! multicast identify (scapy code): payload=‘fefe05000401000200800004ffff’.decode(‘hex’) srp(Ether(type=0x8892, src=smac, dst=’01:0e:cf:00:00:00’)/payload) ! fefe request 05 service id: identify 00 service type: request 04010002 xid (request id) 0080 delay 0004 data len ff option: all ff suboption: all
  • 21. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 21 # profinet dcp • main interesting fields for playing is option and suboption • for example, set/get network info: opt 0x01, subopt 0x02 • led flashing: opt 0x05, subopt 0x03 ! so we can: • scan profinet supported devices and stations • change name of station • change ip, netmask, gateway • request full network info • LED flashing: PLC, HMI (simulates that smth wrong with device) • and much more
  • 22. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 22 # profinet dcp profinet dcp scanner (raw sockets and scapy versions) ! ! ! ! ! ! ! discover all devices (PC, PLC, HMI) in subnet !
  • 23. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 23 # profinet dcp profinet fuzzer: fuzz options and sub options on plc siemens s7-1200 ! CVE-2014-2252 “An attacker could cause the device to go into defect mode if specially crafted PROFINET packets are sent to the device. A cold restart is required to recover the system.” ! what is “specially crafted profinet packets” ?
  • 24. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 24 # profinet dcp CVE-2014-2252 ! just “set” request: set network info with all zero values. ! ip 0.0.0.0 mask 0.0.0.0 gw 0.0.0.0 !!!!
  • 25. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 25 # profinet dcp DEMO: CVE-2014-2252
  • 26. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 26 # goose GSE - Generic Substation Events - fast and reliable mechanism for transfer events data over entire substation networks: • IEC 61850 • multicast, broadcast mechanism ! GSE: • GOOSE: Generic Object Oriented Substations Events • GSSE: Generic Substation State Events
  • 27. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 27 # goose • data as grouped dataset • transmitted within 4 ms • works on second layer (Ethernet) of ISO/OSI model • using publisher-subscriber mechanism -> broadcast, multicast MAC addresses (publisher ~ sender, subscriber ~ receiver) • use VLAN (IEEE 802.1Q standard) • message priority level (by VLAN PCP - Priority Code Point - in TCI field of packet) • retransmission mechanism and a message state number (new or retransmitted) • brand independent (i.e., IDE - intelligent electronic devices by some vendors doesn’t require specific cables)
  • 28. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 28 # goose Attack scenarios: • easy to receive multicast or broadcast packets • easy to analyse, modify and reply packets • DDoS • by manipulating the state number in packet we can control the data set which transmitted in entire network (hijacking of communication channel) • VLAN hopping ! Tools: • wireshark dissector • easy to create your own scanner or injection tool • scapy based tool https://github.com/mdehus/goose-IEC61850-scapy
  • 29. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 29 # IEC 61850-8-1 IEC 61850-8-1 (MMS) !!!!! MMS - Manufacturing Message Specification
  • 30. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 30 # IEC 61850-8-1 • since 1980 • ISO 9501-1, 2003 • use ISO-TSAP as transport • standard tcp port 102 ! functions: • read/write tags, variables, domains (large unstructured data, i.e. program code) • start/stop/rewrite firmware on PLC • read/write/del files and directories ! security ? • simple methods whitelist • TLS (in theory, but in practice not supported by vendors and haven’t seen before in products) ! tools: • wireshark dissector • python and nmap identify scripts • emulator, open source libs
  • 31. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 31 # IEC 61850-8-1
  • 32. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 32 # IEC 61850-8-1 ~ nmap —script mms-identify.nse —script-args=‘mms-identify.timeout=500’ -p 102 <host> ! ! ! ! ! ! ! ! ! ! !
  • 33. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 33 # IEC 61870-5-101/104 IEC 61870-5-101/104 ! mainly for gathering telemetry in electricity distribution and power system automation ! huge list of functions, depends on vendors implementation: • read/write tags • upload/download files • broadcast connected devices discovery • time sync • reset process command • query log files • etc. ! security ? • no auth, no encryption • simple ip address whitelist (ip of master devices defined on slaves)
  • 34. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 34 # IEC 61870-5-101/104 IEC 61870-5-101/104 ! standard tcp port 2404 ! tools: • simulators: sim104, mrts-ng etc. • wireshark dissector • python and nmap identify scripts
  • 35. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 35 # IEC 61870-5-101/104
  • 36. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 36 # IEC 61870-5-101/104 ~ nmap --script iec-identify.nse --script-args='iec-identify.timeout=500' -p 2404 <host> ! ! ! ! ! ! ! ! ! ! !
  • 37. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 37 # FTE Fault Tolerant Ethernet by Honeywell ! Provides robust and low-cost technology for industrial networks. Each FTE-node connected twice to network, support actual route table and exchanges route table with other nodes through multicast request. ! UDP as a transport. ! Proprietary protocol.
  • 38. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 38 # FTE ! attack vectors: • flood udp ports • send multicast packets with fake routing table ! ! multicast packet —> ! headers: 0x01000810 0x01a01001 send each second
  • 39. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 39 # FTE 0x23 node index ! 0x433330302023303335 node name (C300 #5) ! 0x44 and 0xca bytes of packets counter ! 0x32312032 part of firmware version full: EXP3 10.1-65.57 Sat Dec 06 20:22:33 2008 (Fri Nov 21 20:22:57 2008)
  • 40. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 40 # Siemens ! TIA Portal (Totally Intergated Automation Portal) !! TIA - intellectual kernel of more than 100000 products created last 15 years. !! What about users, passwords and permissions?
  • 41. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 41 # Siemens PLC read/write protection for main and critical operations: CPU start/stop/data change, project upload, firmware update, etc. ! ! ! ! ! !
  • 42. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 42 # Siemens TIA Portal PEData.plf passwords history ! ! ! ! ! ! ! ! ! ! passwords in sha-1 but “helpful” redbox value: password_len * 2 + 1 srsly>? for what???
  • 43. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 43 # Siemens After notification Siemens “strengthened” users passwords and switched to md5… ! ! ! ! ! !!!! TIA Portal V12 UPD 3
  • 44. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 44 # Siemens s7 password hashes extractor ! ! ! ! ! ! ! !
  • 45. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 45 # Siemens Improve user rights ! ! ! ! ! ! ! !!!!!!!!! User rights - 2 bytes after second md5 hash: 0x8001 —> 0xFFFF
  • 46. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 46 # Siemens SCADA <-> PLC auth scheme: ! scada -> plc: auth request scada <- plc: challenge scada -> plc: response = HMAC(SHA1(password), challenge) scada <- plc: auth result ! python scripts (for 1200 and 1500 Siemens S7 PLC) for extracting all challenge-responses, export to JtR format and simple bruteforce ! want to crack password? use john the ripper!
  • 47. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 47 # Siemens
  • 48. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 48 # Siemens Bruteforce PLC online! ! Use powerful THC-Hydra Tested on S7-300 PLC. Should work on S7-200, S7-400 ! ! ! ~ hydra -F -V -P ./wordlist/500-worst-passwords.txt s7-300://<host>
  • 49. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 49 # Siemens
  • 50. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 50 # it’s a cookie time! PRE-DEMO: plc-ownage
  • 51. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 51 # it’s a cookie time! • CVE-2014-2250, CVE-2014-2251 • SSA-654382, SSA-456423 • Affected devices: • Siemens S7-1200 PLC • Siemens S7-1500 PLC • CVSS Base Score: 8.3 ! ! !
  • 52. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 52 # it’s a cookie time! Tested on S7-1200 CPU 1212C, firmware V 2.2.0 ! ! ! ! ! ! ! ! !
  • 53. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 53 # it’s a cookie time! PmzR9733Q8rG3LpwjCGZT9N/ocMAAQABAAKK1woAqsgAAAAAAAAAAIrXIUM= ! uLiHXZUTy2GMgjr1KmgmcNN/ocMAAQACAAKK1woAqsgAAAAAAAAAAIrXIUM= ! Mu/vgiIgtrxq0LVp26nkMtN/ocMAAQADAAKK1woAqsgAAAAAAAAAAIrXIUM= ! tjH6vtNWCfa+QZHPDtCnKdN/ocMAAgADAAKK1woAqsgAAAAAAAAAAIrXIUM= ! ! ! ! 3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! b8b8875d9513cb618c823af52a682670d37fa1c30001000200028ad70a00aac800000000000000008ad72143 ! 32efef822220b6bc6ad0b569dba9e432d37fa1c30001000300028ad70a00aac800000000000000008ad72143 ! b631fabed35609f6be4191cf0ed0a729d37fa1c30002000300028ad70a00aac800000000000000008ad72143
  • 54. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 54 # it’s a cookie time! 3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! ! 3e6cd1f7bdf743cac6dcba708c21994f + d37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! ! 3e6cd1f7bdf743cac6dcba708c21994f - ? d37fa1c3 - ? 0001 - ? 0001 - ? 00028ad7 - ? 0a00aac8 - ? 00000000000000008ad72143 - ?
  • 55. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 55 # it’s a cookie time! 3e6cd1f7bdf743cac6dcba708c21994f MD5 of ? (16 bytes) d37fa1c3 CONST (4 bytes) 0001 user logout counter (2 bytes) 0001 counter of issued cookies for this user (2 bytes) 00028ad7 value that doesn’t matter (4 bytes) 0a00aac8 user IP address (10.0.170.200) (4 bytes) 00000000000000008ad72143 value that doesn’t matter (12 bytes) ! ! ! So, what about 3e6cd1f7bdf743cac6dcba708c21994f ???
  • 56. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 56 # it’s a cookie time! ! 3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! ! 3e6cd1f7bdf743cac6dcba708c21994f ! ! MD5( NEXT 26 BYTES OF COOKIE + 16BYTES OF SECRET + 2 NULL BYTES) ! ! What is SECRET ?
  • 57. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 57 # it’s a cookie time! SECRET generates after PLC start by ~PRNG. ! PRNG is a little bit harder than standard C PRNG. ! SEED in {0x0000 , 0xFFFF} ! ! ! ! ! ! ! ! It’s too much for bruteforce (PLC so tender >_<)
  • 58. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 58 # it’s a cookie time! What about SEED ? SEED very often depends on time value ! SEED = PLC START TIME + 320 ! 320 by practical way: secret generates after ~ 3-4 seconds of PLC start using current time ! ! How to obtain PLC START TIME ? ! ! ! PLC START TIME = CURRENT TIME – UPTIME
  • 59. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 59 # it’s a cookie time! Current time via web interface ! ! ! ! ! ! ! ! Uptime via SNMP with hardcoded read community string “public”
  • 60. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 60 # it’s a cookie time! !!! * 100 - calculation lapse !!!! To generate cookie we should brute: • logout number (2 bytes, max 65535) • number of issued cookies (2 bytes, max 65535) • seed value (2 bytes, but max 100) ! ! Still too many values to bruteforce …
  • 61. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 61 # it’s a cookie time! But if user (admin) not logged out properly then after 7 logins it is not possible to login again ! We should restart PLC or wait 30 minutes (cookie expire time) ! ! ! ! ! ! ! ! We can minimize logout and issued cookies counters to 7 To generate cookie we should brute: • logout number (2 bytes, max 7) • number of issued cookies (2 bytes, max 7) • seed value (2 bytes, but max 100)
  • 62. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 62 # it’s a cookie time!
  • 63. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 63 # it’s a cookie time! Exploitation dependences: ! • >= 1 success logins to PLC after last restart • SNMP enabled ! BUT IT DOES NOT NEED LOGIN AND PASSWORD !!! ! CVE Timeline: ! • End of July 2013 – vulnerability discovered • 5 August 2013 – vendor notified • 20 March 2014 – patch released, first public advisory
  • 64. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 64 # heartbleed • a lot of software, devices etc. of popular vendors affected • it’ll be long long story (because of patch management and devices with lifecycle ~10-15 yers) • check https://ics-cert.us-cert.gov/advisories for openssl vulns ! Siemens also vulnerable (ICSA-14-105-03B): • eLAN-8.2 eLAN prior to 8.3.3 •WinCC OA only V3.12 • S7-1500 V1.5 • CP1543-1 V1.1 • APE 2.0 ! ! ! DEMO: winccoa-heartbleed
  • 65. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 65 # S7 protocol ! ! ! ! ! ! ! ! ! Standard port 102/TCP ! By Siemens terms it is ISO-on-TCP (RFC 1006) based communication protocol
  • 66. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 66 # S7 protocol Materials: ! • “Exploiting Siemens Simatic S7 PLCs” by Dillon Beresford • wireshark dissector • libnodave - free communication library • snap7 - open source communication suite • plcscan
  • 67. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 67 # S7 protocol • based on iso-tcp -> block oriented protocol • block - PDU (Protocol Data Unit) • functions and commands oriented -> each frame contains function request or reply to it ! S7 commands: • plc start/stop cpu • firmware update • read/write data (blocks, tags) • system info • authentication • etc…
  • 68. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 68 # S7 protocol History of S7: • S5 Communication (FETCH/WRITE, Sinec H1) • S7 Communication • “Another” S7 Communication ! Simply “another” S7 looks like: !! TCP : HEADER | ISO TCP ! ISO TCP: TPKT | COTP | S7 PDU
  • 69. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 69 # S7 protocol • For old versions: wireshark dissectors, libraries, simulators. ! • Because we know all about that versions of protocol. ! • But we know next to nothing about “another” S7. !
  • 70. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 70 # S7 protocol Find your target: • S7 200/300/400 family ! ! ! ! ! ! ! ! !
  • 71. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 71 # S7 protocol Find your target: • S7 1200/1500 family ! ! ! ! ! ! ! ! !
  • 72. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 72 # How to analyse protocols
  • 73. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 73 # How to analyse protocols How to analyse protocols ? ! ! Rob Savoye, FOSDEM 2009 “Reverse engineering of proprietary protocols, tools and techniques” ! “Believe it or not, if you stare at the hex dumps long enough, you start to see the patterns” !!!
  • 74. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 74 # How to analyse protocols
  • 75. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 75 # How to analyse protocols show_byte_sequences.py ! ! ! ! ! ! ! ! ! ! ! ! ! !
  • 76. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 76 # How to analyse protocols s7-show-payloads.py ! ! ! ! ! ! ! ! ! ! ! ! ! ! !
  • 77. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 77 # How to analyse protocols s7-packet-structure.py ! ! ! ! ! ! ! ! ! ! ! ! ! ! !
  • 78. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 78 # tools recommendations ! Protocol analysing involves: ! • tcpdump, wireshark/tshark + dissectors (keep them up to date from original source) • hex editor • python, perl, etc. • scapy framework • tools like ncat, socat, strings, xxd • sysinternals suite • fuzzers (your own or for example Zulu fuzzer by NCC Group) • disassembler (not so often) ! !
  • 79. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 79 # How to analyse protocols Use your knowledge about protocols: ! • it’s a universal and complex approach • you can: • detect devices and their protocols • monitor state, commands, exchanging data • inject, modify, reply packets in real-time !! Because most of them INSECURE BY DESIGN ! real example?
  • 80. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 80 # real case Energetic turbine ! ! ! ! ! ! ! !!!!!!! ! ! Simple UDP packet that set “speed” of turbine to 57 (min=0, max=100)
  • 81. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 81 # real case What will happen if you send another packet, another value? ! ! ! ! ! ! ! ! ! !
  • 82. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 82 # real case Yes, you’re right ! ! ! ! ! ! ! ! ! !
  • 83. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 83 # outro all scripts, tools -> https://github.com/atimorin/scada-tools ! ! greetz to: @scadasl @repdet @GiftsUngiven Dmitry Sklyarov !!!! QA ?
  • 84. SCADA deep inside: protocols and security mechanisms HACK.LU 2014 84 # Thank you! ! SCADASTRANGELOVE ! PEACE IS OUR PROFESSION !!!!!!!!!! @atimorin atimorin@gmail.com !