cyber-physicalproductionsystems & security edgar … weippl, sba... · 09.05.17 9 examples...
TRANSCRIPT
09.05.17
1
CYBER-PHYSICAL PRODUCTION SYSTEMS&SECURITYEdgarWeippl,SBAResearch
09.05.17
2
WeakSoftware?
• FlipFengShui• Drammer (Android)
https://www.vusec.net/projects/flip-feng-shui/
2016- SBAResearchgGmbH
Cyber-PhysicalSystems
“...areintegrationsofcomputationwithphysical
processes.Embeddedcomputersandnetworks
monitorandcontrolthephysicalprocesses,usually
withfeedbackloopswherephysicalprocessesaffect
computationsandvice versa.”
(Lee, 2008)
09.05.17
3
Internet-of-Things“umbrellakeywordforcoveringvariousaspectsrelatedtothe
extensionoftheInternetandtheWebintothephysical realm,
bymeansofthewidespreaddeploymentofspatially
distributeddeviceswithembeddedidentification,sensing
and/oractuation capabilities."
(Miorandi, 2012)
Examples
09.05.17
4
Reality
Problem:Security
09.05.17
5
SecurityIssuesbeyondtheObvious
• EffectsonPhysicalPartsandHuman Integrity• DevicesAsPartofAnAttack (DDoS)• GovernmentalInvestigations(“Fearofgoing black”)• BringYourOwnDevice(BYOD) Policies
SecurityGoals:theCIATriad
Confidentiality Integrity
Availability
09.05.17
6
SecurityGoals
Confidentiality Integrity
Availability
IndustrialEngineering
InformationTechnology
Management
ApproachesfromInformationTechnology
09.05.17
7
DistinctCPS Characteristics
• ResourceConstraints(Computing,Memory,etc.)
• KnowledgeonSystem Dynamics
• PowerSavingBehaviorandSleepModes
• ImpossibilityofRegular Patching
• Life Cycles
• Safety Evaluation
AttacksontheControlLoop
09.05.17
8
Approachesfrom Engineering
• Fault Tolerance• RedundantSensorsand Encryption• Robust Control• NetworkedControl Systems
09.05.17
9
Examples– BMW
“Furthermore,afterdumpingandinspectingthefirmwareofthemodeminthedevice,theresearcherfoundthatBMWusedthesamesymmetriccryptographykeys tocommunicatewiththeback-endserverforallcarsandthattheprivatekeyswereeasilyextractedfromthefirmware.”
RemySpaan,Secureupdatesinautomotivesystems,Masterthesis,Radboud University,2016http://www.ru.nl/publish/pages/769526/z_remy_spaan.pdf
2016- SBAResearchgGmbH
Examples– VWAudi:A1,Q3,R8,S3,TT,othertypesofAudicars(e.g.remotecontrol4D0837231)VW:Amarok,(New)Beetle,Bora,Caddy,Craver,e-Up,Eos,Fox,Golf4,Golf5,Golf6,GolfPlus,Jetta,Lupo,Passat,Polo,T4,T5,Scirocco,Sharan,Tiguan,Touran,UpSeat:Alhambra,Altea,Arosa,Cordoba,Ibiza,Leon,MII,ToledoSkoda:CityGo,Roomster,Fabia1,Fabia2,Octavia,Superb,YeG
Insummary:probablymostVWgroupvehiclesbetween2000andtodaynotusingGolf7(MQB)plattform
FlavioD.Garciaetal.,LockItandStillLoseIt-Onthe(In)SecurityofAutomotiveRemoteKeylessEntrySystems.UsenixSecurity2016.https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/garcia
2016- SBAResearchgGmbH
09.05.17
10
Stakeholder Goals
AccessControlPerimeterProtectionIntrusionDetection
EconomicOptimizationIPProtection
RiskAssessment
ProcessControlProcessOptimizationProcessStability
InformationTechnology Management IndustrialEngineering
Security Goals
Confidentiality Integrity
IndustrialEngineering
InformationTechnology
Management
Availability
09.05.17
11
Stakeholder Goals
Confidentiality Integrity
IndustrialEngineering
InformationTechnology
Management
Availability
IntegratingSecurityintoCPPS Engineering
Interoperability SystemDesign Self-Protection
09.05.17
12
Interoperability
• Cyber-physicalproduction systemscompriseofheterogeneouscomponentsmiddlewareasintermediary
• hardtoimplement correctly• consideredtobe isolated• Integrationofsecurity tests• Gainrobustnessagainstmalicious inputs
Self-Protection
• Cyber-physicalproductionsystemsarecomplex
• robustcontrolagainstaccidental/random events
• failingsafe:adenial-of-service?• Simulation environmentandtest
bedsheavilyconstrained• higherdegreeofrealism needed
extendmodelsforcontrolalgorithms Cyber-Physical System
Internet
Cyber-LaunchedAttacks
Cyber-PhysicalAttacks
Physical System
Network
Software
Control
Hardware
09.05.17
13
MovingTarget Defense
Source: desfinafionsuddefrance.com
JointResearch
• Industrialandcomputerengineersareworkingtowardsthesameaims,butfromdifferentperspectives.
• Thereispotentialforcollaborationofmutualbenefit• securitytestingininteroperabilitytesting
Improvementoftestbeds• Layeredandmovingtargetdefense
2016- SBAResearchgGmbH
09.05.17
14
Ransomware
2016- SBAResearchgGmbH
SpamE-Mail
2016- SBAResearchgGmbH
09.05.17
15
SpamE-Mail
2016- SBAResearchgGmbH
Quelle:Watchlist-Internet.at
SpamE-Mail
• ClickonLinkinEmail
• Website:
2016- SBAResearchgGmbH
Quelle:Watchlist-Internet.at
09.05.17
16
SpamE-Mail
• Clickonbutton leads to download of aZIPfile
• File„VERBUNG-rechnung.js”is Ransomware
2016- SBAResearchgGmbH
:Watchlist-Internet.at
Infection viaDriveBy-Download
Visit Website
• Normalnon-malicious website (butmalicious ad„Malvertising“)• Hacked website
Scanning• Vulnerabilities inthe browser?
Exploit isexecuted
• Browser• Browser-Plugins suchas Java,Flash,AdobeReader
Drive-ByDownload
• Unknown DownloadundInstallationof malware• Infection (e.g.encryption)commences
2016- SBAResearchgGmbH
09.05.17
17
Hackingis Business
• In2014Germansteelmill attacked
• Attackers gain access tocontrol network for theblastfurnance
• Physical damage
2017- SBAResearchgGmbH
Hackingis Business
2017- SBAResearchgGmbH
…einfacherDDoS Angrifffür60$proTag
…Mirai Botnet:3000bis4000DollarfüreinezweiwöchigeDDoS-Kampagnemit50.000Bots
Quelle:[18] ZDNet
