SlideShare a Scribd company logo

CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security mechanisms

PROIDEA, profile picture
PROIDEA

The document provides an overview and analysis of several industrial control system protocols including MODBUS, DNP3, PROFINET DCP, IEC 61850-8-1, IEC 61870-5-101/104, FTE, and Siemens protocols. It discusses the functionality of each protocol, security issues like the lack of authentication and encryption, and tools for analyzing and interacting with the protocols. Live demonstrations are provided of scanning networks using some of the protocols.

TechnologyBusiness
1 of 75
Downloaded 23 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
SCADA deep inside: protocols and security mechanisms Aleksandr Timorin ! ! ! ! ! ! CONFIDENCE 2014 27-28 V 2014, Krakow
# whoami • penetration tester at Positive Technologies • SCADA security researcher, main specialisation - industrial protocols • SCADAStrangeLove team member • speaker at PHDays, Power Of Community, Chaos Communication Congress (workshop) • @atimorin • atimorin@ptsecurity.com 2SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# whoami 3SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# whoami 4SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
• intro to scada world • current situation in ICS network security • overview of industrial protocols • well-known protocols: profinet, modbus, dnp3 • go to particular: • IEC 61850-8-1 (MMS) • IEC 61870-5-101/104 • FTE • Siemens S7 • how to analyse protocols • releases • QA 5SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # agenda
ICS - Industrial Control System SCADA - Supervisory Control And Data Acquisition PLC - Programmable Logic Controller HMI - Human-Machine Interface RTU - Remote Telemetry Unit Sensor, Actuator ! … and much more 6SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # intro to scada world
many many vendors in the world: • siemens • advantech • citectscada • codesys • moxa • schneider electric • rslogics • general electric • wellintech • sielco sistemi • emerson • abb • advanced micro controls • …. 7SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # intro to scada world problems in security: ! • each vendor - own protocol, technology etc. • out-of-date: don’t touch if it works! wild wild industrial world
! ! ! ! 8SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # current situation in ICS network security ICS NETWORK absolutely unbreakable ???
NO, because of: ! ➡ typical network devices with default/crappy settings ➡ unpatched, old as dirt, full of junk software [malware] engineering workstations ➡ wireless AP with WEP (if the best happend) ➡ low physical security ➡ … and ➡ industrial protocols 9SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # current situation in ICS network security
! ! ➡ typical network devices with default/crappy settings ➡ unpatched, old as dirt, full of junk software [malware] engineering workstations ➡ wireless AP with WER (if the best happend) ➡ low physical security ➡ … and ➡ industrial protocols 10SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # current situation in ICS network security
How protocols live in the network ? ! • full expanse • not blocked by firewalls/switches • accessible between LAN segments • works from data link layer to application layer • easy to detect • easy to intercept, analyze, reproduce and reply (but not all ! ) 11SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # current situation in ICS network security
• modbus • profibus • profinet • dnp3 • ethernet/ip • s5/s7 (siemens protocols family) • CIP (rockwell automation) • cc-link (mitsubishi electric factory automation) • bacnet • iec 60870, iec 61850, iec 61107 • m-bus • zigbee • … iec - international electrotechnical commission 12SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # overview of industrial protocols
• published by Modicon (now Schneider Electric) in 1979 • widely used for connecting industrial electronic devices • in XX: through rs-232/rs-485 • in XXI: modbus tcp • standard port 502/tcp 13SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # modbus
functions: ! • data access: read/write coils, registers, file records • diagnostics: device identification • user defined functions ! ! ! tools: ! • wireshark dissector • plcscan ( https://code.google.com/p/plcscan/ ) • modbus-discover nse (by Alexander Rudakov) • modbus simulators () ! 14SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # modbus
security ? • no authentication • no encryption • no security ! transaction id: 2 bytes protocol id: 2 bytes (always 0) length: 2 bytes unit id: 1 byte function code: 1 byte data … 15SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # modbus
# dnp3 DNP3 Distributed Network Protocol • first version in 1990 • standartized by IEEE only on 2010 • mainly used in water and electric industry • master - outstation communication • tcp/udp standard port 20000 ! tools: wireshark dissector free implementation https://code.google.com/p/dnp3/ ! security ? DNP3 Secure Authentication v5. First version in 2007. Add device and user authentication Data protection 16SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# dnp3 dnp3 frame: • header - 10 bytes • data - max 282 bytes ! header: • sync - 2 bytes • length -1 byte • link control - 1 byte • destination addr - 2 bytes • source addr - 2 bytes • crc - 2 bytes ! each device in network has unique address 1..65520 crc for every 16 bytes of data -> max frame len = 292 bytes work on iso/osi layers: data link layer, transport layer, application layer 17SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# profinet dcp PROFINET family ! • Profinet CBA/IO/PTCP/DCP • iec 61158, iec 61784 in 2003 • Ethernet type 0x8892 • exchange data in real-time cycles • multicast discovery devices and stations ! security ? • no encryption • no authentication • no security 18SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# profinet dcp PROFINET DCP - Discovery and basic Configuration Protocol 19SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# profinet dcp frame types: • request 0xfefe • response 0xfeff • get/set 0xfefd ! multicast identify (scapy code): payload=‘fefe05000401000200800004ffff’.decode(‘hex’) srp(Ether(type=0x8892, src=smac, dst=’01:0e:cf:00:00:00’)/payload) ! fefe request 05 service id: identify 00 service type: request 04010002 xid (request id) 0080 delay 0004 data len ff option: all ff suboption: all 20SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# profinet dcp • main interesting fields for playing is option and suboption • for example, set/get network info: opt 0x01, subopt 0x02 • led flashing: opt 0x05, subopt 0x03 ! so we can: • scan profinet supported devices and stations • change name of station • change ip, netmask, gateway • request full network info • LED flashing: PLC, HMI (simulates that smth wrong with device) • and much more 21SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# profinet dcp profinet dcp scanner (raw sockets and scapy versions) ! ! ! ! ! ! ! ! ! discovering all devices (PC, PLC, HMI) in subnet ! live demo 22SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# profinet dcp profinet fuzzer: fuzz options and sub options on plc siemens s7-1200 ! CVE-2014-2252 “An attacker could cause the device to go into defect mode if specially crafted PROFINET packets are sent to the device. A cold restart is required to recover the system.” ! what is “specially crafted profinet packets” ? 23SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# profinet dcp CVE-2014-2252 ! just “set” request: set network info with all zero values. ! ip 0.0.0.0 mask 0.0.0.0 gw 0.0.0.0 ! ! ! ! live demo 24SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# iec 61850-8-1 IEC 61850-8-1 (MMS) ! ! ! ! ! MMS - Manufacturing Message Specification 25SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# iec 61850-8-1 • since 1980 • ISO 9501-1, 2003 • use ISO-TSAP as transport • standard tcp port 102 ! functions: • read/write tags, variables, domains (large unstructured data, i.e. program code) • start/stop/rewrite firmware on PLC • read/write/del files and directories ! security ? • simple methods whitelist • TLS (in theory, but in practice not supported by vendors and haven’t seen before in products) ! tools: • wireshark dissector • python and nmap identify scripts • emulator, open source libs 26SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# iec 61850-8-1 27SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# iec 61850-8-1 ~ nmap —script mms-identify.nse —script-args=‘mms- identify.timeout=500’ -p 102 <host> 28SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# iec 61870-5-101/104 IEC 61870-5-101/104 ! mainly for gathering telemetry in electricity distribution and power system automation ! huge list of functions, depends on vendors implementation: • read/write tags • upload/download files • broadcast connected devices discovery • time sync • reset process command • query log files • etc. ! security ? • no auth, no encryption • simple ip address whitelist (ip of master devices defined on slaves) 29SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# iec 61870-5-101/104 IEC 61870-5-101/104 ! standard tcp port 2404 ! toolkit: • simulators: sim104, mrts-ng etc. • wireshark dissector • python and nmap identify scripts 30SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# iec 61870-5-101/104 IEC 61870-5-101/104 ! 31SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# iec 61870-5-101/104 ~ nmap --script iec-identify.nse --script-args='iec-identify.timeout=500' -p 2404 <host> ! 32SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# FTE Fault Tolerant Ethernet by Honeywell ! Provides robust and low-cost technology for industrial networks. Each FTE-node connected twice to network, support actual route table and exchanges route table with other nodes through multicast request. ! UDP as a transport. ! Proprietary protocol. 33SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# FTE ! attack vectors: • flood udp ports • send multicast packets with fake routing table ! multicast packet ———> ! headers: 0x01000810 0x01a01001 sending each second 34SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# FTE 0x23 node index ! 0x433330302023303335 node name (C300 #5) ! 0x44 and 0xca bytes of some packets counter ! 0x32312032 part of firmware version full: EXP3 10.1-65.57 Sat Dec 06 20:22:33 2008 (Fri Nov 21 20:22:57 2008) 35SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# Siemens ! TIA Portal (Totally Intergated Automation Portal) ! ! TIA - intellectual kernel of more than 100000 products created last 15 years. ! ! What about users, passwords and permissions? 36SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# Siemens PLC read/write protection for main and critical operations: CPU start/stop/data change, project upload, firmware update, etc. 37SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# Siemens TIA Portal PEData.plf passwords history ! ! ! ! ! ! ! ! ! ! passwords in sha-1 but “helpful” redbox value: password_len * 2 + 1 srsly>? for what??? 38SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# Siemens After notification Siemens “strengthened” users passwords and switched to md5… ! ! ! ! TIA Portal V12 UPD 3 39SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# Siemens s7 password hashes extractor ! 40SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# Siemens Improve user rights ! ! ! ! ! ! ! ! ! User rights - 2 bytes after second md5 hash: 0x8001 —> 0xFFFF 41SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# Siemens SCADA <-> PLC auth scheme: ! scada -> plc: auth request scada <- plc: challenge scada -> plc: response = HMAC(SHA1(password), challenge) scada <- plc: auth result ! python scripts (for 1200 and 1500 Siemens S7 PLC) for extracting all challenge-responses, export to JtR format and simple bruteforce ! want to crack password? use john the ripper! 42SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# Siemens 43SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# Siemens Bruteforce PLC online! ! Use powerful THC-Hydra Tested on S7-300 PLC. Should work on S7-200, S7-400 ! ! ! ~ hydra -F -V -P ./wordlist/500-worst-passwords.txt s7-300://<host> ! ! ! 44SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# Siemens 45SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! CVE-2014-2250, CVE-2014-2251 ! SSA-654382, SSA-456423 Affected devices: Siemens S7-1200 PLC Siemens S7-1500 PLC ! CVSS Base Score: 8.3 46SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! Tested on S7-1200 CPU 1212C, firmware V 2.2.0 47SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! PmzR9733Q8rG3LpwjCGZT9N/ocMAAQABAAKK1woAqsgAAAAAAAAAAIrXIUM= ! uLiHXZUTy2GMgjr1KmgmcNN/ocMAAQACAAKK1woAqsgAAAAAAAAAAIrXIUM= ! Mu/vgiIgtrxq0LVp26nkMtN/ocMAAQADAAKK1woAqsgAAAAAAAAAAIrXIUM= ! tjH6vtNWCfa+QZHPDtCnKdN/ocMAAgADAAKK1woAqsgAAAAAAAAAAIrXIUM= ! ! ! ! 3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! b8b8875d9513cb618c823af52a682670d37fa1c30001000200028ad70a00aac800000000000000008ad72143 ! 32efef822220b6bc6ad0b569dba9e432d37fa1c30001000300028ad70a00aac800000000000000008ad72143 ! b631fabed35609f6be4191cf0ed0a729d37fa1c30002000300028ad70a00aac800000000000000008ad72143 48SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! 3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! ! 3e6cd1f7bdf743cac6dcba708c21994f + d37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! ! 3e6cd1f7bdf743cac6dcba708c21994f - ? d37fa1c3 - ? 0001 - ? 0001 - ? 00028ad7 - ? 0a00aac8 - ? 00000000000000008ad72143 - ? 49SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! 3e6cd1f7bdf743cac6dcba708c21994f MD5 of ? (16 bytes) d37fa1c3 CONST (4 bytes) 0001 user logout counter (2 bytes) 0001 counter of issued cookies for this user (2 bytes) 00028ad7 value that doesn’t matter (4 bytes) 0a00aac8 user IP address (10.0.170.200) (4 bytes) 00000000000000008ad72143 value that doesn’t matter (12 bytes) ! ! ! So, what about 3e6cd1f7bdf743cac6dcba708c21994f ??? 50SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! ! 3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! ! 3e6cd1f7bdf743cac6dcba708c21994f ! ! MD5( NEXT 26 BYTES OF COOKIE + 16BYTES OF SECRET + 2 NULL BYTES) ! ! What is SECRET ? 51SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! SECRET generates after PLC start by ~PRNG. ! PRNG is a little bit harder than standard C PRNG. ! SEED in {0x0000 , 0xFFFF} ! ! ! It’s too much for bruteforce (PLC so tender >_<) 52SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! What about SEED ? SEED very often depends on time value ! SEED = PLC START TIME + 320 ! 320 by practical way: secret generates after ~ 3-4 seconds of PLC start using current time ! ! How to obtain PLC START TIME ? ! ! ! PLC START TIME = CURRENT TIME – UPTIME 53SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! ! ! Current time via web interface ! ! ! ! Uptime via SNMP with hardcoded read community string “public” 54SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! ! ! ! * 100 - calculation lapse ! ! To generate cookie we should brute: • logout number (2 bytes, max 65535) • number of issued cookies (2 bytes, max 65535) • seed value (2 bytes, but max 100) ! ! Still too many values to bruteforce … 55SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! But if user (admin) not logged out properly then after 7 logins it is not possible to login again ! We should restart PLC or wait 30 minutes (cookie expire time) ! ! ! ! ! ! ! ! We can minimize logout and issued cookies counters to 7 To generate cookie we should brute: • logout number (2 bytes, max 7) • number of issued cookies (2 bytes, max 7) • seed value (2 bytes, but max 100) 56SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! 57SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# it’s a cookie time ! Exploitation dependences: ! • >= 1 success logins to PLC after last restart • SNMP enabled ! BUT IT DOES NOT NEED LOGIN AND PASSWORD !!! ! CVE Timeline: ! • End of July 2013 – vulnerability discovered • 5 August 2013 – vendor notified • 20 March 2014 – patch released, first public advisory 58SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# S7 protocol Standard port 102/TCP ! By Siemens terms it is ISO-on-TCP (RFC 1006) based communication protocol 59SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# S7 protocol Materials: ! • “Exploiting Siemens Simatic S7 PLCs” by Dillon Beresford • wireshark dissector • libnodave - free communication library • snap7 - open source communication suite • plcscan 60SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# S7 protocol • based on iso-tcp -> block oriented protocol ! • block - PDU (Protocol Data Unit) ! • functions and commands oriented -> each frame contains function request or reply to it ! S7 commands: • plc start/stop cpu • firmware update • read/write data (blocks, tags) • system info • authentication • etc… 61SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# S7 protocol History of S7: • S5 Communication (FETCH/WRITE, Sinec H1) • S7 Communication • “Another” S7 Communication ! Simply “another” S7 looks like: ! ! TCP : HEADER | ISO TCP ! ISO TCP: TPKT | COTP | S7 PDU 62SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# S7 protocol • For old versions: wireshark dissectors, libraries, simulators. ! • Because we know all about that versions of protocol. ! • But we know next to nothing about “another” S7. ! Challenge accepted ! 63SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# How to analyse protocols? ! ! 64SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# How to analyse protocols? How to analyze protocols ? ! this guy should now -> ! Rob Savoye, FOSDEM 2009 “Reverse engineering of proprietary protocols, tools and techniques” ! “Believe it or not, if you stare at the hex dumps long enough, you start to see the patterns” ! ! ! *demo 65SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# How to analyse protocols? ! ! 66SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# How to analyse protocols? show_byte_sequences.py ! 67SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# How to analyse protocols? s7-show-payloads.py 68SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# How to analyse protocols? s7-packet-structure.py 69SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# How to analyse protocols? Use your knowledge about protocols: ! • it’s a universal and complex approach • you can: • detect devices and their protocols • monitor state, commands, exchanging data • inject, modify, reply packets in real-time ! ! Because most of them INSECURE BY DESIGN ! real example? 70SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# How to analyse protocols? Energetic turbine ! ! ! ! ! ! ! ! ! Simple UDP packet that set “speed” of turbine to 57 (min=0, max=100) 71SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# How to analyse protocols? What will happen if you send another packet, another value? ! 72SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# How to analyse protocols? Yes, you’re right ! 73SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# outro all scripts, tools -> https://github.com/atimorin/scada-tools ! pcaps -> a little bit later after some cleaning ! ! ! ! QA ? 74SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
# outro Thank you! ! @atimorin atimorin@ptsecurity.com ! greetz to: @scadasl @repdet @GiftsUngiven Dmitry Sklyarov 75SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014

More Related Content

PPTX
Attacking SCADA systems: Story Of SCADASTRANGELOVE
Aleksandr Timorin
 
PPTX
Alexander Timorin, Dmitry Efanov. Industrial protocols for pentesters
Positive Hack Days
 
PDF
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
arnaudsoullie
 
PDF
Scada deep inside: protocols and security mechanisms
Aleksandr Timorin
 
PPTX
Industrial protocols for pentesters
Aleksandr Timorin
 
PPTX
Safety vs Security: How to Create Insecure Safety-Critical System
Aleksandr Timorin
 
PDF
Adventures in Femtoland: 350 Yuan for Invaluable Fun
arbitrarycode
 
PDF
D1 t1 t. yunusov k. nesterov - bootkit via sms
qqlan
 
Attacking SCADA systems: Story Of SCADASTRANGELOVE
Aleksandr Timorin
 
Alexander Timorin, Dmitry Efanov. Industrial protocols for pentesters
Positive Hack Days
 
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
arnaudsoullie
 
Scada deep inside: protocols and security mechanisms
Aleksandr Timorin
 
Industrial protocols for pentesters
Aleksandr Timorin
 
Safety vs Security: How to Create Insecure Safety-Critical System
Aleksandr Timorin
 
Adventures in Femtoland: 350 Yuan for Invaluable Fun
arbitrarycode
 
D1 t1 t. yunusov k. nesterov - bootkit via sms
qqlan
 

What's hot (20)

PPTX
Критически опасные уязвимости в популярных 3G- и 4G-модемах или как построить...
Positive Hack Days
 
PPTX
SCADA StrangeLove: Too Smart Grid in da Cloud [31c3]
qqlan
 
PDF
SCADA deep inside: protocols and security mechanisms
Aleksandr Timorin
 
PDF
Greater China Cyber Threat Landscape - ISC 2016
Sergey Gordeychik
 
PPTX
Industrial protocols for pentesters
Positive Hack Days
 
PDF
Techniques of attacking ICS systems
qqlan
 
PDF
ICS/SCADA/PLC Google/Shodanhq Cheat Sheet v2
qqlan
 
PDF
SCADA hacking industrial-scale fun
Jan Seidl
 
PDF
Security testing in critical systems
Peter Wood
 
PDF
Man in the middle attacks on IEC 60870-5-104
pgmaynard
 
PPTX
Blackhat USA 2016 - What's the DFIRence for ICS?
Chris Sistrunk
 
PDF
SCADA deep inside:protocols and software architecture
qqlan
 
PPTX
Master Serial Killer - DEF CON 22 - ICS Village
Chris Sistrunk
 
PPTX
Protecting Your DNP3 Networks
Chris Sistrunk
 
PDF
BruCON 2015 - Pentesting ICS 101
Wavestone
 
PPTX
OWASP Appsec USA 2014 Talk "Pwning the Pawns with Wihawk" Santhosh Kumar
Santhosh Kumar
 
ODP
Scada Security & Penetration Testing
Ahmed Sherif
 
PDF
Scada Strangelove - 29c3
qqlan
 
PDF
DEF CON 23 - NSM 101 for ICS
Chris Sistrunk
 
PDF
Improving SCADA Security
Narinrit Prem-apiwathanokul
 
Критически опасные уязвимости в популярных 3G- и 4G-модемах или как построить...
Positive Hack Days
 
SCADA StrangeLove: Too Smart Grid in da Cloud [31c3]
qqlan
 
SCADA deep inside: protocols and security mechanisms
Aleksandr Timorin
 
Greater China Cyber Threat Landscape - ISC 2016
Sergey Gordeychik
 
Industrial protocols for pentesters
Positive Hack Days
 
Techniques of attacking ICS systems
qqlan
 
ICS/SCADA/PLC Google/Shodanhq Cheat Sheet v2
qqlan
 
SCADA hacking industrial-scale fun
Jan Seidl
 
Security testing in critical systems
Peter Wood
 
Man in the middle attacks on IEC 60870-5-104
pgmaynard
 
Blackhat USA 2016 - What's the DFIRence for ICS?
Chris Sistrunk
 
SCADA deep inside:protocols and software architecture
qqlan
 
Master Serial Killer - DEF CON 22 - ICS Village
Chris Sistrunk
 
Protecting Your DNP3 Networks
Chris Sistrunk
 
BruCON 2015 - Pentesting ICS 101
Wavestone
 
OWASP Appsec USA 2014 Talk "Pwning the Pawns with Wihawk" Santhosh Kumar
Santhosh Kumar
 
Scada Security & Penetration Testing
Ahmed Sherif
 
Scada Strangelove - 29c3
qqlan
 
DEF CON 23 - NSM 101 for ICS
Chris Sistrunk
 
Improving SCADA Security
Narinrit Prem-apiwathanokul
 
Ad

Viewers also liked (20)

PPTX
JDD2015: Migrating to continuous delivery in the world of financial trading -...
PROIDEA
 
PDF
Atmosphere 2014: JUnit: beyond the basics - Adam Dudczak
PROIDEA
 
PDF
JDD2015: Ratpack: core of your micro-services - Andrey Adamovich
PROIDEA
 
PDF
JDD2015: Trudne Rozmowy [WORKSHOP] - Mariusz Sieraczkiewicz
PROIDEA
 
PPTX
JDD2015: Don’t Panic – Hitchhiker’s guide to the JVM monitoring - Wojciech Oc...
PROIDEA
 
ODP
JDD2015: Towards the Fastest (J)VM on the Planet! - Jaroslav Tulach
PROIDEA
 
PDF
Atmosphere 2014: Helping the Internet to scale since 1998 - Paweł Kuśmierski
PROIDEA
 
PDF
Atmosphere 2014: RE:SPONSIBILITY - Matt Harasymczuk
PROIDEA
 
PDF
CONFidence 2014: Dimitriy Chastuhin: All your sap p@$$w0яd z belong to us
PROIDEA
 
PDF
Atmosphere 2014: Scaling and securing node.js apps - Maciej Lasyk
PROIDEA
 
PDF
Atmosphere 2014: Centralized log management based on Logstash and Kibana - ca...
PROIDEA
 
ODP
CONFidence 2014: Vlatko Kosturjak: Exploring treasures of 77FEh
PROIDEA
 
PDF
JDD2015: DDD w praktyce, czyli jak wdrażamy i uczymy się DDD w Allegro - Krzy...
PROIDEA
 
PPTX
PLNOG15 :Contagious SDN - consequences of dealing with it, Paweł Korzec
PROIDEA
 
PDF
PLNOG14: Ceph w praktyce - Paweł Stefański
PROIDEA
 
PDF
Top Sale Pretty Dresses
Lucy Smith
 
PDF
4Developers 2015: Wnioski wyciągnięte z powiększania zespołu - Bartek Nowa...
PROIDEA
 
PDF
PLNOG 13: Krzysztof Konkowski: Cisco Access Architectures: GPON, Ethernet, Ac...
PROIDEA
 
PDF
4Developers 2015: Frameworki jee vs cross-site scripting (xss) - Piotr Bucki
PROIDEA
 
ODP
CONFidence 2014: Kiss, Zagon, Sseller: Scaling security
PROIDEA
 
JDD2015: Migrating to continuous delivery in the world of financial trading -...
PROIDEA
 
Atmosphere 2014: JUnit: beyond the basics - Adam Dudczak
PROIDEA
 
JDD2015: Ratpack: core of your micro-services - Andrey Adamovich
PROIDEA
 
JDD2015: Trudne Rozmowy [WORKSHOP] - Mariusz Sieraczkiewicz
PROIDEA
 
JDD2015: Don’t Panic – Hitchhiker’s guide to the JVM monitoring - Wojciech Oc...
PROIDEA
 
JDD2015: Towards the Fastest (J)VM on the Planet! - Jaroslav Tulach
PROIDEA
 
Atmosphere 2014: Helping the Internet to scale since 1998 - Paweł Kuśmierski
PROIDEA
 
Atmosphere 2014: RE:SPONSIBILITY - Matt Harasymczuk
PROIDEA
 
CONFidence 2014: Dimitriy Chastuhin: All your sap p@$$w0яd z belong to us
PROIDEA
 
Atmosphere 2014: Scaling and securing node.js apps - Maciej Lasyk
PROIDEA
 
Atmosphere 2014: Centralized log management based on Logstash and Kibana - ca...
PROIDEA
 
CONFidence 2014: Vlatko Kosturjak: Exploring treasures of 77FEh
PROIDEA
 
JDD2015: DDD w praktyce, czyli jak wdrażamy i uczymy się DDD w Allegro - Krzy...
PROIDEA
 
PLNOG15 :Contagious SDN - consequences of dealing with it, Paweł Korzec
PROIDEA
 
PLNOG14: Ceph w praktyce - Paweł Stefański
PROIDEA
 
Top Sale Pretty Dresses
Lucy Smith
 
4Developers 2015: Wnioski wyciągnięte z powiększania zespołu - Bartek Nowa...
PROIDEA
 
PLNOG 13: Krzysztof Konkowski: Cisco Access Architectures: GPON, Ethernet, Ac...
PROIDEA
 
4Developers 2015: Frameworki jee vs cross-site scripting (xss) - Piotr Bucki
PROIDEA
 
CONFidence 2014: Kiss, Zagon, Sseller: Scaling security
PROIDEA
 
Ad

Similar to CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security mechanisms (20)

PPTX
BSidesAugusta ICS SCADA Defense
Chris Sistrunk
 
PDF
SCADA StrangeLove 2: We already know
qqlan
 
PPTX
ICS Security 101 by Sandeep Singh
OWASP Delhi
 
PPTX
Penetrationtestingascadaindustrialcontrolsystems 141229233134-conversion-gate02
NiMa Bagheriasl
 
PPTX
Scada Industrial Control Systems Penetration Testing
Yehia Elghaly
 
PPTX
SCADA Strangelove: Hacking in the Name
Positive Hack Days
 
PPTX
SCADA Strangelove: взлом во имя
Ekaterina Melnik
 
PDF
Tech f43
SelectedPresentations
 
PDF
Alexander Timorin, Alexander Tlyapov - SCADA deep inside protocols, security ...
DefconRussia
 
PPTX
Avoiding Cyberterrorism Threats Inside Hydraulic Power Generation Plants
Manuel Santander
 
PDF
SCADA Cyber Sec | ISACA 2013 | Patricia Watson
Patricia M Watson
 
PDF
Industrial Control Systems Security - A Perspective on Product Design (Sequi,...
sequi_inc
 
PPTX
chile-2015 (2)
Massimiliano Falcinelli
 
PDF
Practical DNP3 and Modern SCADA Systems
Living Online
 
PDF
ICS_protocols_Cheat_Sheet_1749276661.pdf
ndeyeadamadrame
 
PPTX
Scada strange love.
Positive Hack Days
 
PPTX
Scada strange love uwn-stuxnet
Positive Hack Days
 
PDF
Cryptography and Authentication Placement to Provide Secure Channel for SCADA...
CSCJournals
 
PPTX
Security Issues in SCADA based Industrial Control Systems
aswanthmrajeev112
 
PPTX
Training manual on scada
bhavuksharma10
 
BSidesAugusta ICS SCADA Defense
Chris Sistrunk
 
SCADA StrangeLove 2: We already know
qqlan
 
ICS Security 101 by Sandeep Singh
OWASP Delhi
 
Penetrationtestingascadaindustrialcontrolsystems 141229233134-conversion-gate02
NiMa Bagheriasl
 
Scada Industrial Control Systems Penetration Testing
Yehia Elghaly
 
SCADA Strangelove: Hacking in the Name
Positive Hack Days
 
SCADA Strangelove: взлом во имя
Ekaterina Melnik
 
Tech f43
SelectedPresentations
 
Alexander Timorin, Alexander Tlyapov - SCADA deep inside protocols, security ...
DefconRussia
 
Avoiding Cyberterrorism Threats Inside Hydraulic Power Generation Plants
Manuel Santander
 
SCADA Cyber Sec | ISACA 2013 | Patricia Watson
Patricia M Watson
 
Industrial Control Systems Security - A Perspective on Product Design (Sequi,...
sequi_inc
 
chile-2015 (2)
Massimiliano Falcinelli
 
Practical DNP3 and Modern SCADA Systems
Living Online
 
ICS_protocols_Cheat_Sheet_1749276661.pdf
ndeyeadamadrame
 
Scada strange love.
Positive Hack Days
 
Scada strange love uwn-stuxnet
Positive Hack Days
 
Cryptography and Authentication Placement to Provide Secure Channel for SCADA...
CSCJournals
 
Security Issues in SCADA based Industrial Control Systems
aswanthmrajeev112
 
Training manual on scada
bhavuksharma10
 

Recently uploaded (20)

PDF
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
PDF
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
PPT
Teaching material agriculture food technology
LiaRayya
 
PDF
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
PDF
Spectral efficient network and resource selection model in 5G networks
IAESIJAI
 
PDF
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
PPTX
ACSFv1EN-58255 AWS Academy Cloud Security Foundations.pptx
23bcla24
 
DOCX
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
PPTX
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
PDF
Encapsulation theory and applications.pdf
gurumoop
 
PPT
“AI and Expert System Decision Support & Business Intelligence Systems”
ZubinRadhakrishnan
 
PPTX
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
ReZa AdineH
 
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PPTX
Cloud computing and distributed systems.
kkkkkhan
 
PDF
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PDF
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
PDF
Dropbox Q2 2025 Financial Results & Investor Presentation
Dropbox
 
PDF
Optimiser vos workloads AI/ML sur Amazon EC2 et AWS Graviton
Julien SIMON
 
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
Teaching material agriculture food technology
LiaRayya
 
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
Spectral efficient network and resource selection model in 5G networks
IAESIJAI
 
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
ACSFv1EN-58255 AWS Academy Cloud Security Foundations.pptx
23bcla24
 
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
Encapsulation theory and applications.pdf
gurumoop
 
“AI and Expert System Decision Support & Business Intelligence Systems”
ZubinRadhakrishnan
 
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
ReZa AdineH
 
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
Cloud computing and distributed systems.
kkkkkhan
 
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
Dropbox Q2 2025 Financial Results & Investor Presentation
Dropbox
 
Optimiser vos workloads AI/ML sur Amazon EC2 et AWS Graviton
Julien SIMON
 

CONFidence 2014: Alexander Timorin: SCADA deep inside: protocols and security mechanisms

  • 1. SCADA deep inside: protocols and security mechanisms Aleksandr Timorin ! ! ! ! ! ! CONFIDENCE 2014 27-28 V 2014, Krakow
  • 2. # whoami • penetration tester at Positive Technologies • SCADA security researcher, main specialisation - industrial protocols • SCADAStrangeLove team member • speaker at PHDays, Power Of Community, Chaos Communication Congress (workshop) • @atimorin • atimorin@ptsecurity.com 2SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 3. # whoami 3SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 4. # whoami 4SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 5. • intro to scada world • current situation in ICS network security • overview of industrial protocols • well-known protocols: profinet, modbus, dnp3 • go to particular: • IEC 61850-8-1 (MMS) • IEC 61870-5-101/104 • FTE • Siemens S7 • how to analyse protocols • releases • QA 5SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # agenda
  • 6. ICS - Industrial Control System SCADA - Supervisory Control And Data Acquisition PLC - Programmable Logic Controller HMI - Human-Machine Interface RTU - Remote Telemetry Unit Sensor, Actuator ! … and much more 6SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # intro to scada world
  • 7. many many vendors in the world: • siemens • advantech • citectscada • codesys • moxa • schneider electric • rslogics • general electric • wellintech • sielco sistemi • emerson • abb • advanced micro controls • …. 7SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # intro to scada world problems in security: ! • each vendor - own protocol, technology etc. • out-of-date: don’t touch if it works! wild wild industrial world
  • 8. ! ! ! ! 8SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # current situation in ICS network security ICS NETWORK absolutely unbreakable ???
  • 9. NO, because of: ! ➡ typical network devices with default/crappy settings ➡ unpatched, old as dirt, full of junk software [malware] engineering workstations ➡ wireless AP with WEP (if the best happend) ➡ low physical security ➡ … and ➡ industrial protocols 9SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # current situation in ICS network security
  • 10. ! ! ➡ typical network devices with default/crappy settings ➡ unpatched, old as dirt, full of junk software [malware] engineering workstations ➡ wireless AP with WER (if the best happend) ➡ low physical security ➡ … and ➡ industrial protocols 10SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # current situation in ICS network security
  • 11. How protocols live in the network ? ! • full expanse • not blocked by firewalls/switches • accessible between LAN segments • works from data link layer to application layer • easy to detect • easy to intercept, analyze, reproduce and reply (but not all ! ) 11SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # current situation in ICS network security
  • 12. • modbus • profibus • profinet • dnp3 • ethernet/ip • s5/s7 (siemens protocols family) • CIP (rockwell automation) • cc-link (mitsubishi electric factory automation) • bacnet • iec 60870, iec 61850, iec 61107 • m-bus • zigbee • … iec - international electrotechnical commission 12SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # overview of industrial protocols
  • 13. • published by Modicon (now Schneider Electric) in 1979 • widely used for connecting industrial electronic devices • in XX: through rs-232/rs-485 • in XXI: modbus tcp • standard port 502/tcp 13SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # modbus
  • 14. functions: ! • data access: read/write coils, registers, file records • diagnostics: device identification • user defined functions ! ! ! tools: ! • wireshark dissector • plcscan ( https://code.google.com/p/plcscan/ ) • modbus-discover nse (by Alexander Rudakov) • modbus simulators () ! 14SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # modbus
  • 15. security ? • no authentication • no encryption • no security ! transaction id: 2 bytes protocol id: 2 bytes (always 0) length: 2 bytes unit id: 1 byte function code: 1 byte data … 15SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014 # modbus
  • 16. # dnp3 DNP3 Distributed Network Protocol • first version in 1990 • standartized by IEEE only on 2010 • mainly used in water and electric industry • master - outstation communication • tcp/udp standard port 20000 ! tools: wireshark dissector free implementation https://code.google.com/p/dnp3/ ! security ? DNP3 Secure Authentication v5. First version in 2007. Add device and user authentication Data protection 16SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 17. # dnp3 dnp3 frame: • header - 10 bytes • data - max 282 bytes ! header: • sync - 2 bytes • length -1 byte • link control - 1 byte • destination addr - 2 bytes • source addr - 2 bytes • crc - 2 bytes ! each device in network has unique address 1..65520 crc for every 16 bytes of data -> max frame len = 292 bytes work on iso/osi layers: data link layer, transport layer, application layer 17SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 18. # profinet dcp PROFINET family ! • Profinet CBA/IO/PTCP/DCP • iec 61158, iec 61784 in 2003 • Ethernet type 0x8892 • exchange data in real-time cycles • multicast discovery devices and stations ! security ? • no encryption • no authentication • no security 18SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 19. # profinet dcp PROFINET DCP - Discovery and basic Configuration Protocol 19SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 20. # profinet dcp frame types: • request 0xfefe • response 0xfeff • get/set 0xfefd ! multicast identify (scapy code): payload=‘fefe05000401000200800004ffff’.decode(‘hex’) srp(Ether(type=0x8892, src=smac, dst=’01:0e:cf:00:00:00’)/payload) ! fefe request 05 service id: identify 00 service type: request 04010002 xid (request id) 0080 delay 0004 data len ff option: all ff suboption: all 20SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 21. # profinet dcp • main interesting fields for playing is option and suboption • for example, set/get network info: opt 0x01, subopt 0x02 • led flashing: opt 0x05, subopt 0x03 ! so we can: • scan profinet supported devices and stations • change name of station • change ip, netmask, gateway • request full network info • LED flashing: PLC, HMI (simulates that smth wrong with device) • and much more 21SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 22. # profinet dcp profinet dcp scanner (raw sockets and scapy versions) ! ! ! ! ! ! ! ! ! discovering all devices (PC, PLC, HMI) in subnet ! live demo 22SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 23. # profinet dcp profinet fuzzer: fuzz options and sub options on plc siemens s7-1200 ! CVE-2014-2252 “An attacker could cause the device to go into defect mode if specially crafted PROFINET packets are sent to the device. A cold restart is required to recover the system.” ! what is “specially crafted profinet packets” ? 23SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 24. # profinet dcp CVE-2014-2252 ! just “set” request: set network info with all zero values. ! ip 0.0.0.0 mask 0.0.0.0 gw 0.0.0.0 ! ! ! ! live demo 24SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 25. # iec 61850-8-1 IEC 61850-8-1 (MMS) ! ! ! ! ! MMS - Manufacturing Message Specification 25SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 26. # iec 61850-8-1 • since 1980 • ISO 9501-1, 2003 • use ISO-TSAP as transport • standard tcp port 102 ! functions: • read/write tags, variables, domains (large unstructured data, i.e. program code) • start/stop/rewrite firmware on PLC • read/write/del files and directories ! security ? • simple methods whitelist • TLS (in theory, but in practice not supported by vendors and haven’t seen before in products) ! tools: • wireshark dissector • python and nmap identify scripts • emulator, open source libs 26SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 27. # iec 61850-8-1 27SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 28. # iec 61850-8-1 ~ nmap —script mms-identify.nse —script-args=‘mms- identify.timeout=500’ -p 102 <host> 28SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 29. # iec 61870-5-101/104 IEC 61870-5-101/104 ! mainly for gathering telemetry in electricity distribution and power system automation ! huge list of functions, depends on vendors implementation: • read/write tags • upload/download files • broadcast connected devices discovery • time sync • reset process command • query log files • etc. ! security ? • no auth, no encryption • simple ip address whitelist (ip of master devices defined on slaves) 29SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 30. # iec 61870-5-101/104 IEC 61870-5-101/104 ! standard tcp port 2404 ! toolkit: • simulators: sim104, mrts-ng etc. • wireshark dissector • python and nmap identify scripts 30SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 31. # iec 61870-5-101/104 IEC 61870-5-101/104 ! 31SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 32. # iec 61870-5-101/104 ~ nmap --script iec-identify.nse --script-args='iec-identify.timeout=500' -p 2404 <host> ! 32SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 33. # FTE Fault Tolerant Ethernet by Honeywell ! Provides robust and low-cost technology for industrial networks. Each FTE-node connected twice to network, support actual route table and exchanges route table with other nodes through multicast request. ! UDP as a transport. ! Proprietary protocol. 33SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 34. # FTE ! attack vectors: • flood udp ports • send multicast packets with fake routing table ! multicast packet ———> ! headers: 0x01000810 0x01a01001 sending each second 34SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 35. # FTE 0x23 node index ! 0x433330302023303335 node name (C300 #5) ! 0x44 and 0xca bytes of some packets counter ! 0x32312032 part of firmware version full: EXP3 10.1-65.57 Sat Dec 06 20:22:33 2008 (Fri Nov 21 20:22:57 2008) 35SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 36. # Siemens ! TIA Portal (Totally Intergated Automation Portal) ! ! TIA - intellectual kernel of more than 100000 products created last 15 years. ! ! What about users, passwords and permissions? 36SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 37. # Siemens PLC read/write protection for main and critical operations: CPU start/stop/data change, project upload, firmware update, etc. 37SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 38. # Siemens TIA Portal PEData.plf passwords history ! ! ! ! ! ! ! ! ! ! passwords in sha-1 but “helpful” redbox value: password_len * 2 + 1 srsly>? for what??? 38SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 39. # Siemens After notification Siemens “strengthened” users passwords and switched to md5… ! ! ! ! TIA Portal V12 UPD 3 39SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 40. # Siemens s7 password hashes extractor ! 40SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 41. # Siemens Improve user rights ! ! ! ! ! ! ! ! ! User rights - 2 bytes after second md5 hash: 0x8001 —> 0xFFFF 41SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 42. # Siemens SCADA <-> PLC auth scheme: ! scada -> plc: auth request scada <- plc: challenge scada -> plc: response = HMAC(SHA1(password), challenge) scada <- plc: auth result ! python scripts (for 1200 and 1500 Siemens S7 PLC) for extracting all challenge-responses, export to JtR format and simple bruteforce ! want to crack password? use john the ripper! 42SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 43. # Siemens 43SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 44. # Siemens Bruteforce PLC online! ! Use powerful THC-Hydra Tested on S7-300 PLC. Should work on S7-200, S7-400 ! ! ! ~ hydra -F -V -P ./wordlist/500-worst-passwords.txt s7-300://<host> ! ! ! 44SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 45. # Siemens 45SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 46. # it’s a cookie time ! CVE-2014-2250, CVE-2014-2251 ! SSA-654382, SSA-456423 Affected devices: Siemens S7-1200 PLC Siemens S7-1500 PLC ! CVSS Base Score: 8.3 46SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 47. # it’s a cookie time ! Tested on S7-1200 CPU 1212C, firmware V 2.2.0 47SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 48. # it’s a cookie time ! PmzR9733Q8rG3LpwjCGZT9N/ocMAAQABAAKK1woAqsgAAAAAAAAAAIrXIUM= ! uLiHXZUTy2GMgjr1KmgmcNN/ocMAAQACAAKK1woAqsgAAAAAAAAAAIrXIUM= ! Mu/vgiIgtrxq0LVp26nkMtN/ocMAAQADAAKK1woAqsgAAAAAAAAAAIrXIUM= ! tjH6vtNWCfa+QZHPDtCnKdN/ocMAAgADAAKK1woAqsgAAAAAAAAAAIrXIUM= ! ! ! ! 3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! b8b8875d9513cb618c823af52a682670d37fa1c30001000200028ad70a00aac800000000000000008ad72143 ! 32efef822220b6bc6ad0b569dba9e432d37fa1c30001000300028ad70a00aac800000000000000008ad72143 ! b631fabed35609f6be4191cf0ed0a729d37fa1c30002000300028ad70a00aac800000000000000008ad72143 48SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 49. # it’s a cookie time ! 3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! ! 3e6cd1f7bdf743cac6dcba708c21994f + d37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! ! 3e6cd1f7bdf743cac6dcba708c21994f - ? d37fa1c3 - ? 0001 - ? 0001 - ? 00028ad7 - ? 0a00aac8 - ? 00000000000000008ad72143 - ? 49SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 50. # it’s a cookie time ! 3e6cd1f7bdf743cac6dcba708c21994f MD5 of ? (16 bytes) d37fa1c3 CONST (4 bytes) 0001 user logout counter (2 bytes) 0001 counter of issued cookies for this user (2 bytes) 00028ad7 value that doesn’t matter (4 bytes) 0a00aac8 user IP address (10.0.170.200) (4 bytes) 00000000000000008ad72143 value that doesn’t matter (12 bytes) ! ! ! So, what about 3e6cd1f7bdf743cac6dcba708c21994f ??? 50SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 51. # it’s a cookie time ! ! 3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143 ! ! 3e6cd1f7bdf743cac6dcba708c21994f ! ! MD5( NEXT 26 BYTES OF COOKIE + 16BYTES OF SECRET + 2 NULL BYTES) ! ! What is SECRET ? 51SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 52. # it’s a cookie time ! SECRET generates after PLC start by ~PRNG. ! PRNG is a little bit harder than standard C PRNG. ! SEED in {0x0000 , 0xFFFF} ! ! ! It’s too much for bruteforce (PLC so tender >_<) 52SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 53. # it’s a cookie time ! What about SEED ? SEED very often depends on time value ! SEED = PLC START TIME + 320 ! 320 by practical way: secret generates after ~ 3-4 seconds of PLC start using current time ! ! How to obtain PLC START TIME ? ! ! ! PLC START TIME = CURRENT TIME – UPTIME 53SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 54. # it’s a cookie time ! ! ! Current time via web interface ! ! ! ! Uptime via SNMP with hardcoded read community string “public” 54SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 55. # it’s a cookie time ! ! ! ! * 100 - calculation lapse ! ! To generate cookie we should brute: • logout number (2 bytes, max 65535) • number of issued cookies (2 bytes, max 65535) • seed value (2 bytes, but max 100) ! ! Still too many values to bruteforce … 55SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 56. # it’s a cookie time ! But if user (admin) not logged out properly then after 7 logins it is not possible to login again ! We should restart PLC or wait 30 minutes (cookie expire time) ! ! ! ! ! ! ! ! We can minimize logout and issued cookies counters to 7 To generate cookie we should brute: • logout number (2 bytes, max 7) • number of issued cookies (2 bytes, max 7) • seed value (2 bytes, but max 100) 56SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 57. # it’s a cookie time ! 57SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 58. # it’s a cookie time ! Exploitation dependences: ! • >= 1 success logins to PLC after last restart • SNMP enabled ! BUT IT DOES NOT NEED LOGIN AND PASSWORD !!! ! CVE Timeline: ! • End of July 2013 – vulnerability discovered • 5 August 2013 – vendor notified • 20 March 2014 – patch released, first public advisory 58SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 59. # S7 protocol Standard port 102/TCP ! By Siemens terms it is ISO-on-TCP (RFC 1006) based communication protocol 59SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 60. # S7 protocol Materials: ! • “Exploiting Siemens Simatic S7 PLCs” by Dillon Beresford • wireshark dissector • libnodave - free communication library • snap7 - open source communication suite • plcscan 60SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 61. # S7 protocol • based on iso-tcp -> block oriented protocol ! • block - PDU (Protocol Data Unit) ! • functions and commands oriented -> each frame contains function request or reply to it ! S7 commands: • plc start/stop cpu • firmware update • read/write data (blocks, tags) • system info • authentication • etc… 61SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 62. # S7 protocol History of S7: • S5 Communication (FETCH/WRITE, Sinec H1) • S7 Communication • “Another” S7 Communication ! Simply “another” S7 looks like: ! ! TCP : HEADER | ISO TCP ! ISO TCP: TPKT | COTP | S7 PDU 62SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 63. # S7 protocol • For old versions: wireshark dissectors, libraries, simulators. ! • Because we know all about that versions of protocol. ! • But we know next to nothing about “another” S7. ! Challenge accepted ! 63SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 64. # How to analyse protocols? ! ! 64SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 65. # How to analyse protocols? How to analyze protocols ? ! this guy should now -> ! Rob Savoye, FOSDEM 2009 “Reverse engineering of proprietary protocols, tools and techniques” ! “Believe it or not, if you stare at the hex dumps long enough, you start to see the patterns” ! ! ! *demo 65SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 66. # How to analyse protocols? ! ! 66SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 67. # How to analyse protocols? show_byte_sequences.py ! 67SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 68. # How to analyse protocols? s7-show-payloads.py 68SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 69. # How to analyse protocols? s7-packet-structure.py 69SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 70. # How to analyse protocols? Use your knowledge about protocols: ! • it’s a universal and complex approach • you can: • detect devices and their protocols • monitor state, commands, exchanging data • inject, modify, reply packets in real-time ! ! Because most of them INSECURE BY DESIGN ! real example? 70SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 71. # How to analyse protocols? Energetic turbine ! ! ! ! ! ! ! ! ! Simple UDP packet that set “speed” of turbine to 57 (min=0, max=100) 71SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 72. # How to analyse protocols? What will happen if you send another packet, another value? ! 72SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 73. # How to analyse protocols? Yes, you’re right ! 73SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 74. # outro all scripts, tools -> https://github.com/atimorin/scada-tools ! pcaps -> a little bit later after some cleaning ! ! ! ! QA ? 74SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014
  • 75. # outro Thank you! ! @atimorin atimorin@ptsecurity.com ! greetz to: @scadasl @repdet @GiftsUngiven Dmitry Sklyarov 75SCADA deep inside: protocols and security mechanisms CONFIDENCE 2014