No Need to Marry to Change your Name! Attacking Profinet IO - - PowerPoint PPT Presentation
20.06.2019 No Need to Marry to Change your Name! Attacking Profinet IO Automation Networks Using DCP S tefan Mehner, Hartmut Knig Brandenburg University of Technology Cottbus - S enftenberg Evolution in Industrial Control Systems
20.06.2019 S tefan Mehner, Hartmut König Brandenburg University of Technology Cottbus - S enftenberg
2
https:/ / www.indu-sol.com/ produkte/ profibus/ ueberwachung/ profibus-inspektorr-nt/ http:/ / wiki.hmkdirect.com/ mediawiki/ index.php/ File:ProfinetIOTopology.j pg
3
Ethernet IP TCP/UDP
HTTP SNMP DHCP …
Profinet Application NRT Real-time data RT IRT
4
IO Supervisor IO Controller IO Device
1) 8)
Data exchange
7)
Connection establishment
6)
Assignment of IP address
5)
Checking the device name
4)
Engineering
3)
Assignment of device name
2)
Assignment of IP address Engineering of Profinet system
5
Data exchange Connection establishment Assignment of IP address Checking the device name Engineering Assignment of device name Assignment of IP address Engineering of Profinet system
IO Controller IO Device
name="device1"? name="device1" who has "192.168.0.10"? ARP Timeout set ip="192.168.0.10"
IO Device IO Supervisor
name="device1"? DCP Timeout set name="device1"
IO Supervisor IO Controller IO Device
1) 8)
Data exchange
7)
Connection establishment
6)
Assignment of IP address
5)
Checking the device name
4)
Engineering
3)
Assignment of device name
2)
Assignment of IP address Engineering of Profinet system
6
Data exchange Connection establishment Assignment of IP address Checking the device name Engineering Assignment of device name Assignment of IP address Engineering of Profinet system
7
1) Topology Discovery
name=“device1“ name=“controller“
2) Port Stealing
name=“device1“? name=“mallory“
3) Reconfiguration
IO Controller Attacker IO Device
x = not successful ! = successful; AR restored after attack !! = successful; AR permanently broken
8
!! (. . . ) = attacker connected to CPU NA = not applicable
Topology Controller Device Port Stealing Reconfiguration Sequence (PS) (R) PS + R Star CPU1516 ET200SP ! !! !! ET200S ! x !! Pepperl+Fuchs ! !! !! ifm ! !! !! CPU315 ET200S ! x !! Line CPU1516 ET200SP (!) !! !! ET200S (!) x (!!) Pepperl+Fuchs (!) !! !! ifm (!) !! !! CPU315 ET200S NA NA NA
IO Supervisor IO Controller IO Device
1) 8)
Data exchange
7)
Connection establishment
6)
Assignment of IP address
5)
Checking the device name
4)
Engineering
3)
Assignment of device name
2)
Assignment of IP address Engineering of Profinet system
10 Paul, A., Schuster, F., König, H.: Towards the Protection of Industrial Control Systems – Conclusions of a Vulnerability Analysis of Profinet IO. (DIMVA 2013)
Data exchange Connection establishment Assignment of IP address Checking the device name Engineering Assignment of device name Assignment of IP address Engineering of Profinet system
11
IO Supervisor Attacker IO Device
name="device1"? DCP Timeout name="device1"? name="device1"? DCP Timeout
Data exchange Connection establishment Assignment of IP address Checking the device name Engineering Assignment of device name Assignment of IP address Engineering of Profinet system
12
IO Controller Attacker IO Device
name="device1"? name="device1" DCP Timeout name="device1" Ip=" " who has "192.168.0.10"? ARP Timeout Is at "de:fe:07:20:ab:cd" name="device1"? name="device1" who has "192.168.0.10"? set ip="192.168.0.10" DCP Timeout ARP Timeout
13
14
15
16
17
18