SCADA Hacking Clear and Present Danger ITAC 2014 02 Oct 2014 - - PowerPoint PPT Presentation

▶
scada hacking
SMART_READER_LITE
LIVE PREVIEW

SCADA Hacking Clear and Present Danger ITAC 2014 02 Oct 2014 - - PowerPoint PPT Presentation

Jan 31, 2024 242 likes •892 views

SCADA Hacking Clear and Present Danger ITAC 2014 02 Oct 2014 Presen sented ed b by: Francis Brown Bishop Fox, LLC www.bishopfox.com Agenda O V E R V I E W Introd oduction on/B /Bac ackgr grou ound Target eting ng S

slide-1
SLIDE 1

SCADA Hacking

Clear and Present Danger

ITAC 2014 – 02 Oct 2014 Presen sented ed b by: Francis Brown Bishop Fox, LLC www.bishopfox.com

slide-2
SLIDE 2

Agenda

2

  • Introd
  • duction
  • n/B

/Bac ackgr grou

  • und
  • Target

eting ng S SCADA S System ems

  • Google/Bing/SHODAN Hacking
  • Port, SNMP, and Other Active Scanning
  • Metasploit SCADA Scanning Modules
  • Internet Census 2012 – data mining NEW-Mar2013
  • Attack

cking ng S SCADA S System ems

  • Attacking admin interfaces: telnet, SSH, web, etc.
  • Metasploit and SCADA exploitation
  • Password attack against SCADA
  • Wireless and Bluetooth attacks
  • Physical attacks on SCADA networks (EXCLUSIVE FIRST LOOK)
  • Def

efens enses es

O V E R V I E W

slide-3
SLIDE 3

Introduction/Background

3

GETTING UP TO SPEED

slide-4
SLIDE 4

Stuxnet Virus

4

B O R N I N T H E U . S . A . Jun 2010

slide-5
SLIDE 5

SCADA Vulnerabilities

5

E X P L O I T R E L E A S E S Jan 2012

slide-6
SLIDE 6

SCADA Vulnerabilities

6

M A J O R S C A D A V E N D O R S Jan 2012

slide-7
SLIDE 7

SCADA Vulnerabilities

7

E X P L O I T R E L E A S E S Jan 2012

slide-8
SLIDE 8

Project Basecamp

8

S C A D A V U L N E R A B I L I T I E S Jan 2012

slide-9
SLIDE 9

9

SCADA Vulnerabilities

M A S S T A R G E T I N G Jan 2012 PhD Student connects 29 29 S SHO HODAN qu queries to Goog

  • ogle m

maps

slide-10
SLIDE 10

San Diego Blackout

10

P H Y S I C A L S A F E G U A R D S F A I L “Once this line went

  • ut, it cascaded and
  • verloaded other lines,”

Cordaro said. “It’s not supposed to happen.”

slide-11
SLIDE 11

Electric Grid Blues

11

W H E N T H E L I G H T S G O O U T May 2013

slide-12
SLIDE 12

Electric Grid Blues

12

W H E N T H E L I G H T S G O O U T May 2013

slide-13
SLIDE 13

Iran Hacker Threat

13

R E T U R N F I R E May 2013

slide-14
SLIDE 14

Targeting SCADA Systems

14

TRY NOT TO TRIP OVER ALL THE SYSTEMS

slide-15
SLIDE 15

Diggity Tools

15

S E A R C H E N G I N E H A C K I N G

slide-16
SLIDE 16

Google Diggity

16

D I G G I T Y C O R E T O O L S

slide-17
SLIDE 17

SCADA and Google

17

G O O G L E H A C K I N G

  • Targeting SCADA systems via Google, Bing, etc.
slide-18
SLIDE 18

SCADA and Google

18

G O O G L E H A C K I N G

  • Targeting SCADA systems via Google, Bing, etc.
slide-19
SLIDE 19

Bing Diggity

19

D I G G I T Y C O R E T O O L S

slide-20
SLIDE 20

SCADA and Bing

20

B I N G H A C K I N G

  • Targeting SCADA systems via Google, Bing, etc.
slide-21
SLIDE 21

N E W G O O G L E H A C K I N G T O O L S

21

SHODAN Diggity

slide-22
SLIDE 22

SHODAN Popularity

22

M A S S T A R G E T I N G O F S C A D A

slide-23
SLIDE 23

SHODAN

23

H A C K E R S E A R C H E N G I N E

  • Indexed service banners for whole Internet for HTTP (Port 80), as well

as some FTP (21), SSH (22) and Telnet (23) services

slide-24
SLIDE 24

SHODAN

24

F I N D I N G S C A D A S Y S T E M S

slide-25
SLIDE 25

SHODAN Diggity

25

F I N D I N G S C A D A S Y S T E M S

slide-26
SLIDE 26

Target SCADA

26

C R I T I C A L I N F R A S T R U C T U R E S E C U R I T Y

  • Supervisory control and data acquisition
slide-27
SLIDE 27

Target SCADA

27

C R I T I C A L I N F R A S T R U C T U R E S E C U R I T Y

  • SHODAN: Target Aquired!
slide-28
SLIDE 28

A D V A N C E D D E F E N S E T O O L S

28

SHODAN Alerts

slide-29
SLIDE 29

SHODAN Alerts

29

S H O D A N R S S F E E D S

slide-30
SLIDE 30

Internet Census 2012

30

N M A P O F E N T I R E I N T E R N E T

  • ~420k botnet used to perform NMAP against entire IPv4 addr space!
  • ICMP sweeps, SYN scans, Reverse DNS, and Service probes of 662 ports
  • Free torrent of 568GB of NMAP results (9TB decompressed NMAP results)
slide-31
SLIDE 31

HD’s Serial Offenders

31

D A T A M I N I N G C E N S U S

slide-32
SLIDE 32

HD’s Serial Offenders

32

D A T A M I N I N G C E N S U S

slide-33
SLIDE 33

SNMP Scan for SCADA

33

S C A N N I N G F O R S C A D A

Serial Port Device Exposure: SNMP

  • SNMP “public” System Description
  • Over 114,000 Digi and Lantronix devices expose SNMP
  • Over 95,000 Digi devices connected via GPRS, EDGE, & 3G
slide-34
SLIDE 34

Internet Census 2012

34

S N M P R E S U L T S

slide-35
SLIDE 35

Internet Census 2012

35

S N M P R E S U L T S

slide-36
SLIDE 36

Internet Census 2012

36

S N M P R E S U L T S

slide-37
SLIDE 37

Port Scanning for SCADA

37

S C A N N I N G F O R S C A D A

  • Port range depends on the vendor
  • Lant

ntroni nix uses 2001-2032 and 3001-3032

  • Digi uses 2001-2099
  • Connect and immediately access the port
  • Linux root shells sitting on ports 2001/3001
slide-38
SLIDE 38

Port Scanning for SCADA

38

S C A N N I N G F O R S C A D A

  • Digi

igi uses the RealPort protocol on port 771

  • The encrypted (SSL) version is on port 1027
  • 9,043 unique IPs expose RealPort (IC2012)
  • Digi can expose up to 64 ports this way
slide-39
SLIDE 39

Metasploit’n Scada

39

P O I N T N C L I C K S C A R Y

Serial Port TCP Multiplexed Services

  • Scanning for RealPort services via Metasploit
slide-40
SLIDE 40

Metasploit’n Scada

40

P O I N T N C L I C K S C A R Y

Serial Port TCP Multiplexed Services

  • Scanning for RealPort shells via Metasploit
slide-41
SLIDE 41

Metasploit’n Scada

41

P O I N T N C L I C K S C A R Y

slide-42
SLIDE 42

Metasploit’n Scada

42

P O I N T N C L I C K S C A R Y

Serial Port Device Exposure: ADDP

  • ADDP: Advanced Device Discovery Protocol
  • Obtain the IP settings of a remote Digidevice
  • Metasploitscanner module implemented
slide-43
SLIDE 43

Metasploit’n Scada

43

P O I N T N C L I C K S C A R Y

Serial Port Device Exposure: ADDP .. continued

  • Third-party products are often hardcoded for ADDP
  • No configuration interface to disable the ADDP protocol
  • Often no way to change the “dbps” password
  • Metasploit includes an ADDP reboot module
slide-44
SLIDE 44

Metasploit’n Scada

44

P O I N T N C L I C K S C A R Y

slide-45
SLIDE 45

Metasploit’n Scada

45

P O I N T N C L I C K S C A R Y

slide-46
SLIDE 46

Metasploit’n Scada

46

P O I N T N C L I C K S C A R Y

slide-47
SLIDE 47

47

Default Passwords

S C A D A P A S S W O R D A T T A C K S

  • Digi equipment defaults to root:dbps for authentication
  • Digi-based products often have their own defaults (“faster”)
  • Lantronix varies based on hardware model and access
  • root:root, root:PASS, root:lantronix, access:systemn
  • Passwords were “dbps”, “digi”, & “faster”
slide-48
SLIDE 48

48

Hard Coded Passwds

S C A D A P A S S W O R D A T T A C K S

slide-49
SLIDE 49

49

Passwd Bruteforcing

S C A D A P A S S W O R D A T T A C K S

slide-50
SLIDE 50

Passwd Bruteforcing

50

S C A D A P A S S W O R D A T T A C K S

slide-51
SLIDE 51

51

Password Cracking

S C A D A P A S S W O R D A T T A C K S

slide-52
SLIDE 52

52

Password Cracking

S C A D A P A S S W O R D A T T A C K S

slide-53
SLIDE 53

Wireless Attacks

53

S C A D A W I R E L E S S A T T A C K S

slide-54
SLIDE 54

T O O L S

54

RFID Hacking Tools

slide-55
SLIDE 55

Badge Basics

55

Name Frequency Distance

Low Fequency (LF) 120kHz – 140kHz <3ft (Commonly under 1.5ft) High Frequency (HF) 13.56MHz 3-10 ft Ultra-High-Frequency (UHF) 860-960MHz (Regional) ~30ft

slide-56
SLIDE 56

Typical Attack

56

A $ $ G R A B B I N G M E T H O D

Existing RFID hacking tools only work when a few centimeters away from badge

slide-57
SLIDE 57

Programmable Cards

57

Cloning to T55x7 Card using Proxmark 3

  • HID Prox Cloning – example:
  • Indala Prox Cloning – example:
slide-58
SLIDE 58

Pwn Plug

M A I N T A I N I N G A C C E S S

slide-59
SLIDE 59

Defenses

59

PROTECT YO NECK

slide-60
SLIDE 60

Defenses

60

S C A D A P R O T E C T I O N From HD Moores “Serial Offenders” recommendations:

slide-61
SLIDE 61

Defenses

61

S C A D A P R O T E C T I O N

Snort and SCADA

slide-62
SLIDE 62

Defenses

62

S C A D A P R O T E C T I O N

slide-63
SLIDE 63

Defenses

63

S C A D A P R O T E C T I O N

NIST and other guidance docs:

slide-64
SLIDE 64

Thank You

64

Bi Bisho hop F Fox

www.bishopfox.com