scada deep inside: protocols and security mechanisms
TRANSCRIPT
![Page 1: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/1.jpg)
SCADA deep inside: protocols and security mechanisms
Aleksandr Timorin
!!!!!!!! HACK.LU 2014, 21-24 October 2014, Luxembourg
![Page 2: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/2.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 20142
# whoami
!
• SCADA security researcher, main specialisation - industrial protocols • penetration tester • SCADAStrangeLove team member -> scadasl.org • speaker at PHDays, Power Of Community, Chaos Communication
Congress (workshop), CONFidence etc. • @atimorin • [email protected]
![Page 3: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/3.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 20143
# whoami
![Page 4: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/4.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 20144
# agenda
• intro to scada world • current situation in ICS network security • overview of industrial protocols • well-known protocols: profinet, modbus, dnp3, goose • go to particular:
• IEC 61850-8-1 (MMS) • IEC 61870-5-101/104 • FTE • Siemens S7
• how to analyse protocols • real case • outro: releases, QA
![Page 5: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/5.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 20145
# intro to scada world
ICS - Industrial Control System SCADA - Supervisory Control And Data Acquisition PLC - Programmable Logic Controller HMI - Human-Machine Interface RTU - Remote Telemetry Unit Sensor, Actuator !… and much more !
!
!
![Page 6: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/6.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 20146
# intro to scada world
many many vendors in the world: • siemens • advantech • citectscada • codesys • moxa • schneider electric • rslogics • general electric • wellintech • sielco sistemi • emerson • abb • advanced micro controls • ….
problems in security: !• each vendor - own
protocol, technology etc.
• out-of-date: don’t touch if it works!
• patch management cycle
!!wild wild industrial world
![Page 7: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/7.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 20147
# current situation in ICS network security
ICS NETWORKabsolutely unbreakable
???
![Page 8: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/8.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 20148
# current situation in ICS network security
NO, because of: !➡ typical network devices with default/crappy settings ➡ unpatched, old as dirt, full of junk software [malware] engineering
workstations ➡ wireless AP with WEP (if the best happend) ➡ low physical security ➡ … and ➡ industrial protocols
![Page 9: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/9.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 20149
# current situation in ICS network security
!!➡ typical network devices with default/crappy settings ➡ unpatched, old as dirt, full of junk software [malware] engineering
workstations ➡ wireless AP with WER (if the best happend) ➡ low physical security ➡ … and ➡ industrial protocols
![Page 10: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/10.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201410
# current situation in ICS network security
How protocols live in the network ? !• full expanse • not blocked by firewalls/switches • accessible between LAN segments • works from data link layer to application layer • easy to detect • easy to intercept, analyse, reproduce and reply (but not all ! )
![Page 11: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/11.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201411
# overview of industrial protocols
• modbus • profibus • profinet • dnp3 • ethernet/ip • s5/s7 (siemens protocols family) • CIP (rockwell automation) • cc-link (mitsubishi electric factory automation) • bacnet • iec 60870, iec 61850, iec 61107 • m-bus • zigbee • goose …
iec - international electrotechnical commission
![Page 12: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/12.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201412
# overview of industrial protocols
![Page 13: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/13.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201413
# modbus
• published by Modicon (now Schneider Electric) in 1979 • widely used for connecting industrial electronic devices • in XX: through rs-232/rs-485 • in XXI: modbus tcp • standard port 502/tcp !
!
!
![Page 14: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/14.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201414
# modbus
functions:
!• data access: read/write coils, registers, file records • diagnostics: device identification • user defined functions
!!!tools:
!• wireshark dissector • plcscan ( https://code.google.com/p/plcscan/ ) • modbus-discover nse (by Alexander Rudakov) • modbus simulators ()
![Page 15: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/15.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201415
# modbus
security ? • no authentication • no encryption • no security !transaction id: 2 bytes protocol id: 2 bytes (always 0) length: 2 bytes unit id: 1 byte function code: 1 byte data …
![Page 16: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/16.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201416
# dnp3
DNP3 Distributed Network Protocol • first version in 1990 • standartized by IEEE only on 2010 • mainly used in water and electric industry • master - outstation communication • tcp/udp standard port 20000
!tools:
• wireshark dissector • free implementation https://code.google.com/p/dnp3/
!security ?
DNP3 Secure Authentication v5. First version in 2007.
Add device and user authentication
Data protection
![Page 17: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/17.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201417
# dnp3
dnp3 frame: • header - 10 bytes • data - max 282 bytes
!header:
• sync - 2 bytes • length -1 byte • link control - 1 byte • destination addr - 2 bytes • source addr - 2 bytes • crc - 2 bytes
!each device in network has unique address 1..65520 crc for every 16 bytes of data -> max frame len = 292 bytes work on iso/osi layers: data link layer, transport layer, application layer
![Page 18: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/18.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201418
# profinet dcp
PROFINET family !• Profinet CBA/IO/PTCP/DCP • iec 61158, iec 61784 in 2003 • Ethernet type 0x8892 • exchange data in real-time cycles • multicast discovery devices and stations !security ? • no encryption • no authentication • no security
![Page 19: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/19.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201419
# profinet dcp
PROFINET DCP - Discovery and basic Configuration Protocol !
!
!
!
!
!
!
!
!
![Page 20: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/20.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201420
# profinet dcp
frame types: • request 0xfefe • response 0xfeff • get/set 0xfefd !multicast identify (scapy code): payload=‘fefe05000401000200800004ffff’.decode(‘hex’) srp(Ether(type=0x8892, src=smac, dst=’01:0e:cf:00:00:00’)/payload) !fefe request 05 service id: identify 00 service type: request 04010002 xid (request id) 0080 delay 0004 data len ff option: all ff suboption: all
![Page 21: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/21.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201421
# profinet dcp
• main interesting fields for playing is option and suboption • for example, set/get network info: opt 0x01, subopt 0x02 • led flashing: opt 0x05, subopt 0x03 !so we can:
• scan profinet supported devices and stations • change name of station • change ip, netmask, gateway • request full network info • LED flashing: PLC, HMI (simulates that smth wrong with
device) • and much more
![Page 22: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/22.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201422
# profinet dcp
profinet dcp scanner (raw sockets and scapy versions)
!
!
!
!
!
!
!
discover all devices (PC, PLC, HMI) in subnet
!
![Page 23: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/23.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201423
# profinet dcp
profinet fuzzer: fuzz options and sub options on plc siemens s7-1200 !CVE-2014-2252 “An attacker could cause the device to go into defect mode if specially crafted PROFINET packets are sent to the device. A cold restart is required to recover the system.” !what is “specially crafted profinet packets” ?
![Page 24: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/24.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201424
# profinet dcp
CVE-2014-2252 !just “set” request: set network info with all zero values. ! ip 0.0.0.0 mask 0.0.0.0 gw 0.0.0.0 !!!!
![Page 25: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/25.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201425
# profinet dcp
DEMO: CVE-2014-2252
![Page 26: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/26.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201426
# goose
GSE - Generic Substation Events - fast and reliable mechanism for transfer events data over entire substation networks:
• IEC 61850 • multicast, broadcast mechanism
!GSE:
• GOOSE: Generic Object Oriented Substations Events • GSSE: Generic Substation State Events
![Page 27: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/27.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201427
# goose
• data as grouped dataset • transmitted within 4 ms • works on second layer (Ethernet) of ISO/OSI model • using publisher-subscriber mechanism -> broadcast, multicast MAC
addresses (publisher ~ sender, subscriber ~ receiver) • use VLAN (IEEE 802.1Q standard) • message priority level (by VLAN PCP - Priority Code Point - in TCI field of
packet) • retransmission mechanism and a message state number (new or
retransmitted) • brand independent (i.e., IDE - intelligent electronic devices by some
vendors doesn’t require specific cables)
![Page 28: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/28.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201428
# goose
Attack scenarios: • easy to receive multicast or broadcast packets • easy to analyse, modify and reply packets • DDoS • by manipulating the state number in packet we can control the data set
which transmitted in entire network (hijacking of communication channel) • VLAN hopping
!Tools:
• wireshark dissector • easy to create your own scanner or injection tool • scapy based tool https://github.com/mdehus/goose-IEC61850-scapy
![Page 29: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/29.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201429
# IEC 61850-8-1
IEC 61850-8-1 (MMS) !!!!!MMS - Manufacturing Message Specification
![Page 30: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/30.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201430
# IEC 61850-8-1
• since 1980 • ISO 9501-1, 2003 • use ISO-TSAP as transport • standard tcp port 102 !functions:
• read/write tags, variables, domains (large unstructured data, i.e. program code) • start/stop/rewrite firmware on PLC • read/write/del files and directories
!security ?
• simple methods whitelist • TLS (in theory, but in practice not supported by vendors and haven’t seen before in products)
!tools:
• wireshark dissector • python and nmap identify scripts • emulator, open source libs
![Page 31: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/31.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201431
# IEC 61850-8-1
![Page 32: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/32.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201432
# IEC 61850-8-1
~ nmap —script mms-identify.nse —script-args=‘mms-identify.timeout=500’ -p 102 <host> !!!!!!!!!!!
![Page 33: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/33.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201433
# IEC 61870-5-101/104
IEC 61870-5-101/104
!mainly for gathering telemetry in electricity distribution and power system automation
!huge list of functions, depends on vendors implementation:
• read/write tags • upload/download files • broadcast connected devices discovery • time sync • reset process command • query log files • etc.
!security ?
• no auth, no encryption • simple ip address whitelist (ip of master devices defined on slaves)
![Page 34: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/34.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201434
# IEC 61870-5-101/104
IEC 61870-5-101/104 !standard tcp port 2404 !tools: • simulators: sim104, mrts-ng etc. • wireshark dissector • python and nmap identify scripts
![Page 35: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/35.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201435
# IEC 61870-5-101/104
![Page 36: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/36.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201436
# IEC 61870-5-101/104
~ nmap --script iec-identify.nse --script-args='iec-identify.timeout=500' -p 2404 <host> !!!!!!!!!!!
![Page 37: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/37.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201437
# FTE
Fault Tolerant Ethernet by Honeywell !Provides robust and low-cost technology for industrial networks. Each FTE-node connected twice to network, support actual route table and exchanges route table with other nodes through multicast request. !UDP as a transport. !Proprietary protocol.
![Page 38: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/38.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201438
# FTE
!attack vectors:
• flood udp ports • send multicast packets with fake routing table
!! multicast packet —> !headers: 0x01000810 0x01a01001 send each second
![Page 39: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/39.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201439
# FTE0x23 node index !
0x433330302023303335 node name (C300 #5) !
0x44 and 0xca bytes of packets counter !
0x32312032 part of firmware version full: EXP3 10.1-65.57 Sat Dec 06 20:22:33 2008 (Fri Nov 21 20:22:57 2008)
![Page 40: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/40.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201440
# Siemens
!TIA Portal (Totally Intergated Automation Portal) !!TIA - intellectual kernel of more than 100000 products created last 15 years. !!What about users, passwords and permissions?
![Page 41: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/41.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201441
# Siemens
PLC read/write protection for main and critical operations: CPU start/stop/data change, project upload, firmware update, etc. !
!
!
!
!
!
![Page 42: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/42.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201442
# Siemens
TIA Portal PEData.plf passwords history
!
!
!
!
!
!
!
!
!
!
passwords in sha-1
but “helpful” redbox value: password_len * 2 + 1 srsly>? for what???
![Page 43: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/43.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201443
# Siemens
After notification Siemens “strengthened” users passwords and switched to md5… !
!
!
!
!!!!!TIA Portal V12 UPD 3
![Page 44: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/44.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201444
# Siemens
s7 password hashes extractor !
!
!
!
!
!
!
!
![Page 45: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/45.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201445
# Siemens
Improve user rights !
!
!
!
!
!
!!!!!!!!!!User rights - 2 bytes after second md5 hash:0x8001 —> 0xFFFF
![Page 46: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/46.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201446
# Siemens
SCADA <-> PLC auth scheme: ! scada -> plc: auth request scada <- plc: challenge scada -> plc: response = HMAC(SHA1(password), challenge) scada <- plc: auth result !python scripts (for 1200 and 1500 Siemens S7 PLC) for extracting all challenge-responses, export to JtR format and simple bruteforce !want to crack password? use john the ripper!
![Page 47: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/47.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201447
# Siemens
![Page 48: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/48.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201448
# Siemens
Bruteforce PLC online!
!
Use powerful THC-Hydra
Tested on S7-300 PLC.
Should work on S7-200, S7-400
!
!
!
~ hydra -F -V -P ./wordlist/500-worst-passwords.txt s7-300://<host>
![Page 49: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/49.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201449
# Siemens
![Page 50: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/50.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201450
# it’s a cookie time!
PRE-DEMO: plc-ownage
![Page 51: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/51.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201451
# it’s a cookie time!
• CVE-2014-2250, CVE-2014-2251 • SSA-654382, SSA-456423 • Affected devices:
• Siemens S7-1200 PLC • Siemens S7-1500 PLC
• CVSS Base Score: 8.3 !
!
!
![Page 52: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/52.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201452
# it’s a cookie time!
Tested on S7-1200 CPU 1212C, firmware V 2.2.0 !
!
!
!
!
!
!
!
!
![Page 53: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/53.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201453
# it’s a cookie time!
PmzR9733Q8rG3LpwjCGZT9N/ocMAAQABAAKK1woAqsgAAAAAAAAAAIrXIUM=
!uLiHXZUTy2GMgjr1KmgmcNN/ocMAAQACAAKK1woAqsgAAAAAAAAAAIrXIUM=
!Mu/vgiIgtrxq0LVp26nkMtN/ocMAAQADAAKK1woAqsgAAAAAAAAAAIrXIUM=
!tjH6vtNWCfa+QZHPDtCnKdN/ocMAAgADAAKK1woAqsgAAAAAAAAAAIrXIUM=
!!!!
3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143
!b8b8875d9513cb618c823af52a682670d37fa1c30001000200028ad70a00aac800000000000000008ad72143
!32efef822220b6bc6ad0b569dba9e432d37fa1c30001000300028ad70a00aac800000000000000008ad72143
!b631fabed35609f6be4191cf0ed0a729d37fa1c30002000300028ad70a00aac800000000000000008ad72143
![Page 54: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/54.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201454
# it’s a cookie time!
3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143
!
!3e6cd1f7bdf743cac6dcba708c21994f
+
d37fa1c30001000100028ad70a00aac800000000000000008ad72143
!!
3e6cd1f7bdf743cac6dcba708c21994f - ?
d37fa1c3 - ?
0001 - ?
0001 - ?
00028ad7 - ?
0a00aac8 - ?
00000000000000008ad72143 - ?
![Page 55: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/55.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201455
# it’s a cookie time!
3e6cd1f7bdf743cac6dcba708c21994f MD5 of ? (16 bytes)
d37fa1c3 CONST (4 bytes)
0001 user logout counter (2 bytes)
0001 counter of issued cookies for this user (2 bytes)
00028ad7 value that doesn’t matter (4 bytes)
0a00aac8 user IP address (10.0.170.200) (4 bytes)
00000000000000008ad72143 value that doesn’t matter (12 bytes)
!
!
!So, what about 3e6cd1f7bdf743cac6dcba708c21994f ???
![Page 56: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/56.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201456
# it’s a cookie time!
!3e6cd1f7bdf743cac6dcba708c21994fd37fa1c30001000100028ad70a00aac800000000000000008ad72143
!!
3e6cd1f7bdf743cac6dcba708c21994f
!
!
MD5( NEXT 26 BYTES OF COOKIE + 16BYTES OF SECRET + 2 NULL BYTES)
!
!
What is SECRET ?
![Page 57: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/57.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201457
# it’s a cookie time!
SECRET generates after PLC start by ~PRNG.
!
PRNG is a little bit harder than standard C PRNG.
!
SEED in {0x0000 , 0xFFFF}
!
!
!
!
!
!
!
!
It’s too much for bruteforce (PLC so tender >_<)
![Page 58: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/58.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201458
# it’s a cookie time!
What about SEED ?
SEED very often depends on time value
!
SEED = PLC START TIME + 320
!
320 by practical way: secret generates after ~ 3-4 seconds of PLC start using current time
!
!
How to obtain PLC START TIME ?!!!
PLC START TIME = CURRENT TIME – UPTIME
![Page 59: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/59.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201459
# it’s a cookie time!
Current time via web interface
!
!
!
!
!
!
!
!
Uptime via SNMP with hardcoded read
community string “public”
![Page 60: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/60.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201460
# it’s a cookie time!
!!!* 100 - calculation lapse!!!!To generate cookie we should brute:
• logout number (2 bytes, max 65535)
• number of issued cookies (2 bytes, max 65535)
• seed value (2 bytes, but max 100)
!
!
Still too many values to bruteforce …
![Page 61: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/61.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201461
# it’s a cookie time!
But if user (admin) not logged out properly then after 7 logins it is not possible to login again
!
We should restart PLC or wait 30 minutes (cookie expire time)!!!!!!!!We can minimize logout and issued cookies counters to 7
To generate cookie we should brute:
• logout number (2 bytes, max 7)
• number of issued cookies (2 bytes, max 7)
• seed value (2 bytes, but max 100)
![Page 62: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/62.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201462
# it’s a cookie time!
![Page 63: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/63.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201463
# it’s a cookie time!
Exploitation dependences:
!• >= 1 success logins to PLC after last restart
• SNMP enabled
!
BUT IT DOES NOT NEED LOGIN AND PASSWORD !!!
!
CVE Timeline:
!• End of July 2013 – vulnerability discovered
• 5 August 2013 – vendor notified
• 20 March 2014 – patch released, first public advisory
![Page 64: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/64.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201464
# heartbleed
• a lot of software, devices etc. of popular vendors affected • it’ll be long long story (because of patch management and devices with
lifecycle ~10-15 yers) • check https://ics-cert.us-cert.gov/advisories for openssl vulns
!Siemens also vulnerable (ICSA-14-105-03B):
• eLAN-8.2 eLAN prior to 8.3.3 • WinCC OA only V3.12 • S7-1500 V1.5 • CP1543-1 V1.1 • APE 2.0
!!!DEMO: winccoa-heartbleed
![Page 65: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/65.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201465
# S7 protocol
!
!
!
!
!
!
!
!
!
Standard port 102/TCP !By Siemens terms it is ISO-on-TCP (RFC 1006) based communication protocol
![Page 66: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/66.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201466
# S7 protocol
Materials: !• “Exploiting Siemens Simatic S7 PLCs” by Dillon Beresford • wireshark dissector • libnodave - free communication library • snap7 - open source communication suite • plcscan
![Page 67: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/67.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201467
# S7 protocol
• based on iso-tcp -> block oriented protocol • block - PDU (Protocol Data Unit) • functions and commands oriented -> each frame contains function request
or reply to it
!
S7 commands: • plc start/stop cpu • firmware update • read/write data (blocks, tags) • system info • authentication • etc…
![Page 68: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/68.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201468
# S7 protocol
History of S7: • S5 Communication
(FETCH/WRITE, Sinec H1) • S7 Communication • “Another” S7 Communication
!Simply “another” S7 looks like: !!TCP : HEADER | ISO TCP !ISO TCP: TPKT | COTP | S7 PDU
![Page 69: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/69.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201469
# S7 protocol
• For old versions: wireshark dissectors, libraries, simulators. !• Because we know all about that versions of protocol. !• But we know next to nothing about “another” S7. !
![Page 70: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/70.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201470
# S7 protocol
Find your target: • S7 200/300/400 family
!
!
!
!
!
!
!
!
!
![Page 71: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/71.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201471
# S7 protocol
Find your target: • S7 1200/1500 family
!
!
!
!
!
!
!
!
!
![Page 72: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/72.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201472
# How to analyse protocols
![Page 73: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/73.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201473
# How to analyse protocols
How to analyse protocols ? ! !Rob Savoye, FOSDEM 2009 “Reverse engineering of proprietary protocols, tools and techniques” !
“Believe it or not, if you stare at the hex dumps long enough, you
start to see the patterns” !!!
![Page 74: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/74.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201474
# How to analyse protocols
![Page 75: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/75.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201475
# How to analyse protocols
show_byte_sequences.py
!!!!!!!!!!!!!!
![Page 76: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/76.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201476
# How to analyse protocolss7-show-payloads.py
!!!!!!!!!!!!!!!
![Page 77: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/77.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201477
# How to analyse protocolss7-packet-structure.py
!!!!!!!!!!!!!!!
![Page 78: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/78.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201478
# tools recommendations!
!
Protocol analysing involves: !
• tcpdump, wireshark/tshark + dissectors (keep them up to date from original source)
• hex editor • python, perl, etc. • scapy framework • tools like ncat, socat, strings, xxd • sysinternals suite • fuzzers (your own or for example Zulu fuzzer by NCC Group) • disassembler (not so often)
!
!
!
![Page 79: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/79.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201479
# How to analyse protocols
Use your knowledge about protocols: !
• it’s a universal and complex approach • you can:
• detect devices and their protocols • monitor state, commands, exchanging data • inject, modify, reply packets in real-time
!!Because most of them INSECURE BY DESIGN
! real example?
![Page 80: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/80.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201480
# real case
Energetic turbine !
!
!
!
!
!
!!!!!!!!!!Simple UDP packet that set “speed” of turbine to 57 (min=0, max=100)
![Page 81: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/81.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201481
# real case
What will happen if you send another packet, another value? !
!
!
!
!
!
!
!
!
!
![Page 82: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/82.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201482
# real case
Yes, you’re right !
!
!
!
!
!
!
!
!
!
![Page 83: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/83.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201483
# outro
all scripts, tools -> https://github.com/atimorin/scada-tools
!!greetz to: @scadasl @repdet @GiftsUngiven Dmitry Sklyarov !!!!QA ?
![Page 84: Scada deep inside: protocols and security mechanisms](https://reader030.vdocument.in/reader030/viewer/2022012306/558fcfb21a28ab451b8b45fe/html5/thumbnails/84.jpg)
SCADA deep inside: protocols and security mechanisms HACK.LU 201484
# Thank you!
!
SCADASTRANGELOVE !
PEACE IS OUR PROFESSION !!!!!!!!!!@atimorin [email protected] !