Out of Control: Demonstrating SCADA Exploitation Brian Meixell - - PowerPoint PPT Presentation

▶
out of control demonstrating scada exploitation brian
SMART_READER_LITE
LIVE PREVIEW

Out of Control: Demonstrating SCADA Exploitation Brian Meixell - - PowerPoint PPT Presentation

Jul 31, 2023 162 likes •627 views

Out of Control: Demonstrating SCADA Exploitation Brian Meixell Eric Forner Black Hat 2013 Agenda SCADA 101 Attack Scenarios Common Vulnerabilities Remediation Exploit Demo SCADA 101 SCADA DCS Supervisory Distributed

slide-1
SLIDE 1

Out of Control: Demonstrating SCADA Exploitation

Brian Meixell Eric Forner Black Hat 2013

slide-2
SLIDE 2

Agenda

  • SCADA 101
  • Attack Scenarios
  • Common Vulnerabilities
  • Remediation
  • Exploit Demo
slide-3
SLIDE 3

SCADA 101

SCADA

Supervisory Control And Data Acquisition

DCS

Distributed Control System

slide-4
SLIDE 4

Standard DCS Network

SAP ERP EPA Database Alarm Aggregation Plant Bus CCTV Server Historian OPC Server Domain Controller HMI HMI EWS Control Bus

Application Server

INTERNET

Corporate Firewall Plant Firewall Control Firewall

PLC PLC PLC PLC

Field Bus to Instrumentation Field Bus to Instrumentation

Terminal Bus Enterprise Network

Hardwired Instrumentation Hardwired Instrumentation

slide-5
SLIDE 5

Standard SCADA Network

SAP ERP EPA Database Alarm Aggregation ACN Historian OPC Server Domain Controller HMI HMI EWS

Application Server

INTERNET

Corporate Firewall Central Facilities Firewall Control Firewall

PLC PLC PLC PLC

Field Bus to Instrumentation Field Bus to Instrumentation

Terminal Bus Enterprise Network

Hardwired Instrumentation Hardwired Instrumentation

slide-6
SLIDE 6

Standard Typical SCADA Network

My Favorite Firewall Rule ANY <---> ANY

SAP ERP EPA Database Alarm Aggregation ACN Historian OPC Server Domain Controller HMI HMI EWS

Application Server

INTERNET

Corporate Firewall Central Facilities Firewall Control Firewall

PLC PLC PLC PLC

Field Bus to Instrumentation Field Bus to Instrumentation

Terminal Bus Enterprise Network

Hardwired Instrumentation Hardwired Instrumentation

slide-7
SLIDE 7

Or this...

SAP ERP EPA Database Alarm Aggregation Historian OPC Server Domain Controller HMI HMI EWS

Application Server

INTERNET

Corporate Firewall

PLC PLC PLC PLC

Field Bus to Instrumentation Field Bus to Instrumentation

Terminal Bus Enterprise Network

Hardwired Instrumentation Hardwired Instrumentation

slide-8
SLIDE 8

Components

Historian

slide-9
SLIDE 9

Components

Human Machine Interface

slide-10
SLIDE 10

Components

Application Server

slide-11
SLIDE 11

Components

Engineering Workstation

slide-12
SLIDE 12

Components

Programmable Logic Controller

slide-13
SLIDE 13

Components

Remote Terminal Unit

slide-14
SLIDE 14

Components

Instrumentation

slide-15
SLIDE 15

Attack Vectors

SAP ERP EPA Database Alarm Aggregation Plant Bus CCTV Server Historian OPC Server Domain Controller HMI HMI EWS Control Bus

Application Server

INTERNET

Corporate Firewall Plant Firewall Control Firewall

PLC PLC PLC PLC

Field Bus to Instrumentation Field Bus to Instrumentation

Terminal Bus Enterprise Network

Hardwired Instrumentation Hardwired Instrumentation

It’s all about the pivot

Typical Communications

  • Historical Data
  • Daily product totals
  • New product orders
  • Demand Calculations
slide-16
SLIDE 16

So I’ve just owned a Historian...

  • Windows Server Class Machine
  • Cover up past poorly executed attacks
  • Destroy a company’s Health/Safety record
  • Modify view of plant state to corporation
  • Pivot to juicier targets

10 20 30 40 50 60

NOx Flared

NOx Flared

slide-17
SLIDE 17

Attack Vectors

SAP ERP EPA Database Alarm Aggregation Plant Bus CCTV Server Historian OPC Server Domain Controller HMI HMI EWS Control Bus

Application Server

INTERNET

Corporate Firewall Plant Firewall Control Firewall

PLC PLC PLC PLC

Field Bus to Instrumentation Field Bus to Instrumentation

Terminal Bus Enterprise Network

Hardwired Instrumentation Hardwired Instrumentation

It’s all about the pivot

Typical Communications

  • Historical Data
  • Network Statistics
  • OPC
  • Domain Services
slide-18
SLIDE 18

So I’ve just owned an HMI

  • Windows Workstation Class Machine
  • Write setpoints
  • Spoof operator’s view of process
  • CAUTION
  • Each HMI spoof process must be synchronized
  • Required IPC of some kind
  • Pivot to juicier targets
slide-19
SLIDE 19

Attack Vectors

SAP ERP EPA Database Alarm Aggregation Plant Bus CCTV Server Historian OPC Server Domain Controller HMI HMI EWS Control Bus

Application Server

INTERNET

Corporate Firewall Plant Firewall Control Firewall

PLC PLC PLC PLC

Field Bus to Instrumentation Field Bus to Instrumentation

Terminal Bus Enterprise Network

Hardwired Instrumentation Hardwired Instrumentation

It’s all about the pivot

Typical Communications

  • Setpoint writes
  • I/O Value Reads
  • Alarm Notifications
  • Control Bus Diagnostics
slide-20
SLIDE 20

So I’ve just owned an Application Server

  • Windows Server Class Machine
  • Spoof view of process to all downstream components
  • Real-time and Historical Data
  • No synchronization across components necessary
  • Simply modify the backend database values
  • Pivot to Juicier targets
slide-21
SLIDE 21

Attack Vectors

SAP ERP EPA Database Alarm Aggregation Plant Bus CCTV Server Historian OPC Server Domain Controller HMI HMI EWS Control Bus

Application Server

INTERNET

Corporate Firewall Plant Firewall Control Firewall

PLC PLC PLC PLC

Field Bus to Instrumentation Field Bus to Instrumentation

Terminal Bus Enterprise Network

Hardwired Instrumentation Hardwired Instrumentation

It’s all about the pivot

Typical Communications

  • Doesn’t matter!
  • The benefits of dual homing boxes
slide-22
SLIDE 22

So I’ve just owned an Engineering Workstation

  • Windows Server/Workstation Class Machine
  • Modify actual logic of controllers
  • Download online updates to controllers
  • Does not take down process but can subtly change it
  • Remove engineered safety logic
  • Steal PLC source code
  • Pivot to embedded hardware
slide-23
SLIDE 23

Attack Vectors

SAP ERP EPA Database Alarm Aggregation Plant Bus CCTV Server Historian OPC Server Domain Controller HMI HMI EWS Control Bus

Application Server

INTERNET

Corporate Firewall Plant Firewall Control Firewall

PLC PLC PLC PLC

Field Bus to Instrumentation Field Bus to Instrumentation

Terminal Bus Enterprise Network

Hardwired Instrumentation Hardwired Instrumentation

It’s all about the pivot

Ownage Imminent

  • Logic updates to controllers
  • Reconfigure network
  • Reconfigure controllers
  • Full visibility into process
slide-24
SLIDE 24

So I’ve just destroyed the process...

  • Embedded Hardware
  • VxWorks
  • Linux (Usually BusyBox)
  • Old crusty RTOS
  • Modify logic while online
  • Write arbitrary memory
  • Input Table
  • Output Table
slide-25
SLIDE 25

You’d think it would take a Nation State

  • It doesn’t!
  • Most Windows based machines are woefully out of date
  • Vendors must approve all patches
  • Any change in a system requires a complicated MOC processes
  • If it ain’t broke, don’t fix it mentality
  • Many Controllers are laughably insecure
  • Designed for availability and ease of troubleshooting
slide-26
SLIDE 26

That was exhausting Let’s make life easy

SAP ERP EPA Database Alarm Aggregation ACN Historian OPC Server Domain Controller HMI HMI EWS

Application Server

INTERNET

Corporate Firewall Central Facilities Firewall Control Firewall

PLC PLC PLC PLC

Field Bus to Instrumentation Field Bus to Instrumentation

Terminal Bus Enterprise Network

Hardwired Instrumentation Hardwired Instrumentation

slide-27
SLIDE 27

But they seem patched and I have no 0-day

  • Industrial protocols
  • Not encrypted by design
  • Hardware too weak to support encryption
  • Many are little more than encapsulated serial frames
  • Controllers now have many services
  • FTP
  • HTTP
  • Debug
  • CVE-2005-3715, CVE-2005-3804, CVE-2006-0374

Legacy Serial Protocol IP Header

slide-28
SLIDE 28

Industrial Protocols

  • Modbus/TCP
  • TCP port 502
  • Minor changes from Modbus/RTU developed in 1970s
  • Ethernet/IP
  • TCP port 44818
  • Similar to SNMP
  • Fully compatible with serial brethren
  • ControlNet, DeviceNet
  • IP encapsulated serial
  • Encryption never a concern
slide-29
SLIDE 29

At the end of the day, it’s all just bits

Source Port (16 bits)

Modbus 502/tcp

Sequence Number (32 bits)

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

Bit Octet 0 1 2 3 Acknowledgement Number (32 bits)

Data Offset (4 bits)

Reserve d

N S C W R E C E U R G A C K P S H R S T S Y N F I N

Window Size (16 bits) TCP Checksum (16 bits) Urgent Pointer (16 bits) Options

Modbus Data

Padding

slide-30
SLIDE 30

At the end of the day, it’s all just bits

A look at Modbus over TCP

Transaction ID MSB LSB Protocol ID 0x00 0x00 Data Length

# of bytes

Unit ID

0xFF (Typ)

Function Code Data

DATA See Table

Function Code Function 0x01 Read Coil 0x02 Read Discrete Input 0x03 Read Holding Register 0x04 Read Input Register 0x05 Write Single Coil 0x06 Write Single Register

slide-31
SLIDE 31

Just ask nicely

  • How to turn on a pump

Trans ID 0xFF 0xFF Protocol ID 0x00 0x00 Data Length

0x00 0x06

Unit ID

0xFF (Typ)

Function Code Data

0x00 0x00 0xFF 0x00 0x05

Data Byte Meaning 1: 0x00 MSB of Reference Number 2: 0x00 LSB of Reference Number 3: 0xFF ON (0x00 for OFF) 4: 0x00 Always zero CAUTION: The reference number mapping to the pump must be known Nuke Button Approach: Just write every output ON

slide-32
SLIDE 32

Complications

  • Control Engineers implement safety logic
  • Interlocks
  • Permissives
slide-33
SLIDE 33

Solutions

  • Remove safety logic!
  • Modify logic on the fly
  • Required feature of most Controllers
  • Updates can be made from EWS
  • Logic source is also on EWS
slide-34
SLIDE 34

Spoofing

  • Windows
  • Send/Recv hooking
  • Spoof process must be synced across all HMIs in peer to peer
  • IPC of some sort required
  • Preferable to hook on the Application Server
  • All data from the controllers funnels through it
  • Non-spoofed external laptop can still see actual process

Caller Callee jmp Hook Function

slide-35
SLIDE 35

Spoofing

  • Embedded Hardware hooking
  • Ethernet Module send/recv hooking
  • Man-in-the-middle at embedded level
  • Ethernet Module internals are usually:
  • Old stripped down/broken Linux TCP stack
  • Custom made TCP stack

Spoofed

slide-36
SLIDE 36

Direct Memory Access

  • Some vendors leave debug processes listening for troubleshooting
  • Direct access to physical memory
  • Controllers have very specific (and interesting) memory regions

Output Table

Input Table

Logic

slide-37
SLIDE 37

I’m a PLC and I’m OK

Scan Inputs  Perform Logic  Write Outputs

Output Table Input Table

Logic

0011101011110110101 1101101010101010101 1010101011110101010 0000010101111101011 0000111101010101011 0110101010101010001 0101111010100101010 0001010100001001000 0101010010111111100 0010101001010011010 1010100101010101101 1100101010101000000 0011101011110110101 1101101010101010101 1010101011110101010 0000010101111101011 0000111101010101011 0110101010101010001 0101111010100101010 0001010100001001000 0101010010111111100 0010101001010011010 1010100101010101101 1100101010101000000

slide-38
SLIDE 38

The world is your oyster

Output Table Input Table

Logic

0011101011110110101 1101101010101010101 1010101011110101010 0000010101111101011 0000111101010101011 0110101010101010001 0101111010100101010 0001010100001001000 0101010010111111100 0010101001010011010 1010100101010101101 1100101010101000000 0011101011110110101 1101101010101010101 1010101011110101010 0000010101111101011 0000111101010101011 0110101010101010001 0101111010100101010 0001010100001001000 0101010010111111100 0010101001010011010 1010100101010101101 1100101010101000000

Controller’s view

  • f the world

Controller acting

  • n the world

Writes Outputs based on logic

slide-39
SLIDE 39

Remediation

Network Level

slide-40
SLIDE 40

Remediation

Host Level

slide-41
SLIDE 41

Remediation

Device Level

slide-42
SLIDE 42

Exploit Demo

slide-43
SLIDE 43

Exploit Demo

Pressure Release Valve* Pump Valve Tank Manual Drain Valve* PLC Reservoir Level Sensor *Only present for demo purposes

slide-44
SLIDE 44

Thanks

Cimation Dillon Beresford - Research Ryan Moos - Fabrication

slide-45
SLIDE 45