Vulnerability Analysis of 2013
SCADA issues
Amol Sarwate
Director of Vulnerability Labs, Qualys Inc.
Hosted by OWASP & the NYC Chapter

Agenda
SCADA components
2013 Vulnerability Analysis
Recommendations and Proposals
Hosted by OWASP & the NYC Chapter

SCADA
DCS
ICS
Hosted by OWASP & the NYC Chapter

Hosted by OWASP & the NYC Chapter

Accidents
liquid pipeline failures
http://www.ntsb.gov/doclib/safetystudies/SS0502.pdf
power failures
http://www.nerc.com/docs/docs/blackout/Status_Report_081104.pdf
other accidents
http://en.wikipedia.org/wiki/List_of_industrial_disasters
Hosted by OWASP & the NYC Chapter

Vandalism
vandals destroy insulators
http://www.bpa.gov/corporate/BPAnews/archive
/2002/NewsRelease.cfm?ReleaseNo=297
Hosted by OWASP & the NYC Chapter

Insider
disgruntle employee
http://www.theregister.co.uk/2001/10/31
/hacker_jailed_for_revenge_sewage/
Hosted by OWASP & the NYC Chapter

APT
terrorism or espionage
http://www.symantec.com/content/en/us/enterprise/
media/security_response/whitepapers/w32_duqu_
the_precursor_to_the_next_stuxnet.pdf
Hosted by OWASP & the NYC Chapter

2009 - 2013 SCADA Vulnerabilities
(estimate)
Hosted by OWASP & the NYC Chapter

Components
Field
Hosted by OWASP & the NYC Chapter
Control Center

Acquisition
Convert parameters like light, temperature, pressure or flow to analog signals
Hosted by OWASP & the NYC Chapter

Conversion
Converts analog and discrete measurements to digital information
Hosted by OWASP & the NYC Chapter

Communication
OPC
ICCP
ControlNet
BBC 7200
DCP 1
Gedac 7020
DeviceNet
DH+
ProfiBus
Tejas
Hosted by OWASP & the NYC Chapter
DNP 3
ANSI X3.28
Front end processors (FEP) and protocols
Wired or wireless communication
Modbus
TRE
UCA

Presentation & Control
Control, monitor and alarming using human machine interface (HMI)
Hosted by OWASP & the NYC Chapter

2013 Vulnerabilities by category
66%
22%
11%
0%
Acquisition
Hosted by OWASP & the NYC Chapter
Conversion
Communication
Presentation &
Control

Acquisition
–
–
–
–
Requires physical access
Field equipment does not contain process information
Information like valve 16 or breaker 9B
Without process knowledge leads to nuisance
disruption
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

Emerson ROC800 Vulnerabilities
–
–
–
–
–
CVE-2013-0693: Network beacon broadcasts allows detection
CVE-2013-0692: OSE Debug port service
CVE-2013-0694: Hardcode accounts with passwords
Access: AV:N, AC:L, Au:N
Impact: C:C, I:C, A:C
– Patch available from Emerson
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

Siemens CP 1604 / 1616 Interface
Card Vulnerability
–
–
–
–
–
Siemens security advisory: SSA-628113
CVE- 2013-0659: Open Debugging Port in CP 1604/1616
UDP port 17185
Access: AV:N, AC:L, Au:N
Impact: C:C, I:C, A:C
– Patch available from Siemens
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

Communication
24%
16%
12%
16%
12%
12%
4%
General
ModBus
0%
Hosted by OWASP & the NYC Chapter
DNP
C37.118
11%
4%
IGMP
SNMP
22%
FTP/TFTP
66%
SSH/SSL

ModBus Vulnerabilities
– CVE-2013-2784: Triangle Research Nano-10 PLC Crafted Packet Handling Remote DoS
– CVE-2013-0699: Galil RIO-47100 PLC Crafted Modbus Packet Handling Remote DoS
– RBS--2013--003: Schneider Electric Multiple Modbus MBAP DoS and RCE
Nano-10 PLC
RIO-47100 PLC
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

DNP Vulnerabilities
–
–
–
–
CVE-2013-2791: MatrikonOPC Server DNP3 Packet Handling buffer overflow
CVE-2013-2798: Schweitzer Real-Time Automation Controllers (RTAC) Local DoS
CVE-2013-2788: SUBNET SubSTATION Server DNP3 Outstation Slave Remote DoS
CVE-2013-2783: IOServer DNP3 Packet Handling Infinite Loop
Schweitzer RTAC
0%
Hosted by OWASP & the NYC Chapter
Matrikon OPC Server
11%
22%
IOServer
66%

Security Analysis of SCADA protocols
Modbus and DNP free tool:
http://code.google.com/p/scadascan/
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

SSH, FTP, TFTP, IGMP, SNMP
–
–
–
–
–
–
–
–
CVE-2013-0137: Monroe Electronics Default root SSH Key Remote Access
CVE-2012-4697: TURCK BL20 / BL67 FTP Service Hardcoded Admin Credentials
CVE-2013-2800: OSIsoft PI Interface for IEEE C37.118 Memory Corruption
CVE-2013-0689: Emerson RTU TFTP Server File Upload Arbitrary Code Execution
CVE-2013-3634: Siemens Scalance X200 IRT SNMP Command Execution
Korenix Multiple JetNet Switches TFTP Server Arbitrary File Creation
RuggedCom ROX-II IGMP Packet Saturation RSTP BPDU Prioritization Weakness
Korenix Multiple JetNet Switches SSL / SSH Hardcoded Private Keys
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

Presentation & Control
31%
26%
13%
9%
5%
Generic
XSS
3%
SQL
Injection
0%
Hosted by OWASP & the NYC Chapter
5%
Database
5%
4%
Generic
Web
11%
Directory &
File
Disclosure
22%
CSRF
66%
ActiveX
Crypto

Presentation & Control
–
–
–
–
–
–
CVE-2013-2299: Advantech WebAccess /broadWeb/include/gAddNew.asp XSS
CVE-2013-0684: Invensys Wonderware Information Server (WIS) SQL Injection
CVE-2013-3927: Siemens COMOS Client Library Local Database Object Manipulation
CVE-2013-0680: Cogent DataHub Crafted HTTP Request Header Parameter Stack Overflow
CVE-2013-0652: General Electric (GE) Intelligent Proficy Java Remote Method Invocation
CVE-2008-0760: SafeNet Sentinel Protection Server HTTP Request Directory Traversal and
Arbitrary File Access
– CVE-2012-3039: Moxa OnCell Gateway Predictable SSH / SSL Connection Key Generation
– Weidmüller WaveLine Router Web Interface config.cgi Configuration Manipulation CSRF
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

Real world issues
Control system network connected to
corporate network or internet
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

Real world issues
No authentication
No per user authentication
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

Real world issues
Delayed patching if any
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

Real world issues
Default passwords
Shared passwords
No password change policy
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

Real world issues
Systems not restarted in years
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

Real world issues
Off-the-shelf software
Operating system, Database, Browser, Web Server
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

Real world issues
Un-necessary services
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

Real world issues
Internal differences between IT and
SCADA engineers
0%
Hosted by OWASP & the NYC Chapter
11%
22%
66%

System Wide Challenges
SCADA system long life cycle
Long life cycle of a SCADA system
Hosted by OWASP & the NYC Chapter

System Wide Challenges
SCADA system long life cycle
Cost and difficulty of an upgrade
Hosted by OWASP & the NYC Chapter

Proposals
SCADA network auditing
Hosted by OWASP & the NYC Chapter

Proposals
Is you SCADA system exposed on
the internet?
Hosted by OWASP & the NYC Chapter

Proposals
Password policy, access control and
access roles
Hosted by OWASP & the NYC Chapter

Proposals
Are all services necessary?
Hosted by OWASP & the NYC Chapter

Proposals
Use secure protocols
Hosted by OWASP & the NYC Chapter

Proposals
Strategy for Software Update and
patching
Hosted by OWASP & the NYC Chapter

Proposals
SCADA test environment
Hosted by OWASP & the NYC Chapter

Proposals
Keep up-to-date with vulnerabilities
Hosted by OWASP & the NYC Chapter

Proposals
Apply experience from IT network
management
Hosted by OWASP & the NYC Chapter

ScadaScan
Current version
Scan network range
Works with TCP/IP
Identifies Modbus TCP slaves
Identifies DNP 3 TCP slaves
Beta version
SCADA master vulnerability scanning
SNMP support
HTTP support
1.0 Release
User configurable signature files
Authenticated support for Windows and *nix
Code cleanup
Hosted by OWASP & the NYC Chapter

Thank You
Twitter: @amolsarwate
http://code.google.com/p/scadascan/
https://community.qualys.com
Hosted by OWASP & the NYC Chapter