Vu Vuln lnera rabil bility ity As Assessm ssment nts s on SC - - PowerPoint PPT Presentation

▶
vu vuln lnera rabil bility ity as assessm ssment nts s on
SMART_READER_LITE
LIVE PREVIEW

Vu Vuln lnera rabil bility ity As Assessm ssment nts s on SC - - PowerPoint PPT Presentation

Jan 11, 2023 333 likes •835 views

Vu Vuln lnera rabil bility ity As Assessm ssment nts s on SC SCAD ADA A Sy Systems: stems: Outsm tsmarting arting the Smart rt Grid id Fadli B. Sidek BSidesVienna 2014 Security Specialist @ Whoami SecureSingapore

slide-1
SLIDE 1

Vu Vuln lnera rabil bility ity As Assessm ssment nts s on SC SCAD ADA A Sy Systems: stems: Outsm tsmarting arting the Smart rt Grid id

Fadli B. Sidek Security Specialist @ BSidesVienna 2014

slide-2
SLIDE 2
  • HeartBleed Bug
  • Security Engineer
  • Software Security
  • 8 years in IT
  • S-O-E-C
  • VA/PT
  • Research
  • Write Articles
  • SecureSingapore
  • Defcon Kerala (India)
  • The Hackers Con (India)
  • BSidesLV (USA)
  • BSidesVienna

Whoami

SCADA Software Secure Source Code Review Binary Analysis Fuzzing VA/PT
slide-3
SLIDE 3

Legend

General Information Technical Information Something to refer to

slide-4
SLIDE 4

What is a Critical Infrastructure?

slide-5
SLIDE 5

What is SCADA?

slide-6
SLIDE 6

Typical SCADA Control Room

slide-7
SLIDE 7

A Typical SCADA Network Architecture

slide-8
SLIDE 8

What’s the Big Deal?

slide-9
SLIDE 9

Die Hard 4.0 – 4 real!!!

"I watched the movie for 20 minutes, then pressed pause, got a cigarette and a glass of Scotch. To me it was really scary: they were talking about real scenarios. It was like a user guide for cyber terrorists. I hated that movie," the flamboyant Russian entrepreneur says.

slide-10
SLIDE 10
slide-11
SLIDE 11

ATTACKS!!!

slide-12
SLIDE 12

And Despite All That...

slide-13
SLIDE 13

NSA finally admits!!!

slide-14
SLIDE 14

Security Professionals to the Rescue

slide-15
SLIDE 15

What this talk is not about

Hacking SCADA Applications Hacking SCADA Systems Hacking SCADA Networks

slide-16
SLIDE 16

How I performed the VA Share Assessment Findings Types of Attacks on SCADA Finding SCADA Systems Online Compromising a Critical Infrastructure

Cos this is about

slide-17
SLIDE 17

What I’ve Done

Architecture Review Network Devices Review VA on SCADA Systems

slide-18
SLIDE 18

SCADA vs Corporate Environment

slide-19
SLIDE 19

Automatic Tools used

slide-20
SLIDE 20

Day 1

Reached Site Collect the IP Addresses Run Nessus Relax 2 Hours Later

slide-21
SLIDE 21

Systems Hang Unable to collect data Application Hang Systems Sudden Reboot

The Impact

slide-22
SLIDE 22

Nessus Scanning Policies

slide-23
SLIDE 23

Nessus Plugins Selection

slide-24
SLIDE 24

Day 2 - 10

slide-25
SLIDE 25

Day 11

slide-26
SLIDE 26

Ancient & Unsupported OS & Hardware

slide-27
SLIDE 27

Techniques

slide-28
SLIDE 28

Information Gathering Groupings Policy & Plugins

  • Interviewing
  • Documentation
  • Live Hosts
  • OS fingerprinting
  • Systems Specification (HD size/Ram)

Segregate systems based on

  • Servers
  • Workstations
  • Network Devices
  • Operating Systems
  • Redundancy/failovers

Select plugins based on

  • Operating systems
  • Applications
  • Devices (Network)

Scan the systems by

  • Individual
  • Groups
  • Sites
  • Operating Systems
  • Active/Passive/Backups

Scanning Validation Reporting

Validate non intrusion vulnerabilities

Methodology

slide-29
SLIDE 29

SCADA Assessment Incidents

slide-30
SLIDE 30

Vulnerabilities Found

Additional Findings:

  • Default Admin Password
  • Default Cisco Password
  • Blank Passwords
  • Default Web Server Passwords
  • Anonymous FTP
  • Obsolete OS (NT4.0, XP)
  • 64MB/128MB RAM
  • Old Hardware
slide-31
SLIDE 31

Vulnerabilities Found

slide-32
SLIDE 32

SCADA Attack Matrix

slide-33
SLIDE 33

SCADA Attack Matrix

slide-34
SLIDE 34

Thank God SCADA systems are Isolated and not part of the Internet….. But hang on….

slide-35
SLIDE 35

Map of ICS/SCADA Systems on the Internet

slide-36
SLIDE 36

Searching for SCADA Systems in the Internet

slide-37
SLIDE 37

SCADA Login Console

slide-38
SLIDE 38

SCADA Login Console

slide-39
SLIDE 39

Reconnaissance on SCADA Application

slide-40
SLIDE 40

Anonymous FTP Access in SCADA Systems

slide-41
SLIDE 41

Finding Application Vulns in SCADA Systems

slide-42
SLIDE 42

Check Version Against CVEs

slide-43
SLIDE 43

Checking Application Exploits in Metasploit

slide-44
SLIDE 44

PWNED!

slide-45
SLIDE 45

Compromising a Critical Infra – Is it Possible?

slide-46
SLIDE 46

Owning a Critical Infra – Is it Possible?

slide-47
SLIDE 47

Think We are at Peace???

slide-48
SLIDE 48
  • Require Extra Precaution when performing VA on SCADAs
  • Information Gathering is very very Important!
  • Vulnerabilities Exist in Both Software & System
  • Critical Infrastructures a Favorite Amongst Hackers
  • Types of Attack are similar
  • But Impact of Attack Can be Deadly
  • Cyber Conflict is Never Ending
  • We need to guard our Critical Infrastructures

Takeaways

slide-49
SLIDE 49
  • Twitter: @hang5jebat
  • Blog: http://securityg33k.blogspot.sg
  • LinkedIn: Fadli B. Sidek
  • Website: www.codenomicon.com