Security Testing in Critical Systems

Size: px

Start display at page:

Download "Security Testing in Critical Systems"

Charity Holland
8 years ago
Views:

1 Security Testing in Critical Systems An Ethical Hacker s View Peter Wood Chief Executive Officer First Base Technologies

2 Who is Peter Wood? Worked in computers & electronics since 1969 Founded First Base in 1989 (one of the first ethical hacking firms) CEO, First Base Technologies LLP Social engineer & penetration tester Conference speaker and security expert Vice Chair of BCS Information Risk Management and Audit Group Member of ISACA Security Advisory Group UK Programme Chair, Corporate Executive Programme FBCS, CITP, CISSP, MIEEE, M.Inst.ISP Registered BCS Security Consultant Member of ACM, ISACA, ISSA, Mensa Slide 2 First Base Technologies 2013

3 Agenda Scope of this Presentation Vulnerabilities and concerns Security testing Summary and conclusions Slide 3 First Base Technologies 2013

4 Scope of Presentation Supervisory Control And Data Acquisition (SCADA) - computer systems that monitor and control industrial, infrastructure, or facility-based processes Programmable Logic Controller (PLC) - a computer used for automation of electromechanical processes, such as control of machinery Programmable Automation Controller (PAC) - a compact controller that combines the features and capabilities of a PC-based control system with that of a typical PLC Remote Terminal Unit (RTU) or Intelligent Electronic Device (IED) - a microprocessor-controlled device that interfaces objects in the physical world to a distributed control system or SCADA Slide 4 First Base Technologies 2013

5 Network Architecture RTUs and IEDs are proprietary devices running embedded operating systems These originally used serial communications with field bus protocols such as Modbus, BITBUS, PROFIBUS etc. Field bus protocols are now frequently encapsulated in TCP/IP SCADA controllers manage communications, analyse data and display the alerts and events Industrial systems now use UNIX or Windows in controllers and embedded in some field devices This has exposed industrial systems to the same IT security challenges as commercial systems Slide 5 First Base Technologies 2013

6 Agenda Overview of critical systems Vulnerabilities and concerns Security testing Summary and conclusions Slide 6 First Base Technologies 2013

7 Authentication Problems Default (manufacturer) passwords Very poor quality passwords Passwords never changed Passwords common across many devices Shared credentials No passwords / anonymous logins Remote access via modem Systems replaced less often than commercial systems: no cleanup, more opportunity for information leakage Slide 7 First Base Technologies 2013

8 Systems not Patched or Hardened Many systems running on legacy (unsupported) operating systems Patching can break applications Patching can violate some vendors service contracts Systems never taken off-line, as downtime can cause massive problems Systems are rarely hardened as it is believed this may impact the application SCADA applications themselves often contain vulnerabilities Frequently no anti-malware software Slide 8 First Base Technologies 2013

9 Insecure Protocols Field bus protocols were not designed to be secure Most field devices use proprietary IP stacks that are prone to DoS attacks and buffer overflows Field bus protocols designed for serial comms, so no built in authentication all legitimate packets will be processed Most communication is in plain text Default SNMP strings Slide 9 First Base Technologies 2013

10 Lack of Segmentation Firewalls usually only between the corporate network and the industrial network (if at all) Firewalls may be badly configured, industrial protocols difficult to control - All field bus traffic may be on one port - Cannot risk blocking critical messages Wireless can bypass firewalls Traditionally SCADA systems were isolated not any more Systems therefore vulnerable to malware, especially worms Slide 10 First Base Technologies 2013

11 Stuxnet: classic exploit Self-replicated through removable drives (auto-execution vulnerability) Spread in a LAN through a Windows Print Spooler vulnerability Spread through SMB (Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability) Copied and executed itself through network shares Copied and executed itself on computers running a WinCC database server Automatically executed when the Step 7 project is loaded Updated itself through a peer-to-peer mechanism within a LAN Exploited a total of four unpatched Microsoft vulnerabilities Command and control to download and execute code, including updates Contained a Windows rootkit that hid its binaries Attempted to bypass security products Fingerprinted and targeted Siemens PLCs to sabotage the system Hid modified code on PLCs, essentially a rootkit for PLCs Symantec: W32.Stuxnet Dossier version 1.4 (February 2011) Slide 11 First Base Technologies 2013

12 Agenda Overview of critical systems Vulnerabilities and concerns Security testing Summary and conclusions Slide 12 First Base Technologies 2013

13 Problems with Testing - 1 While a ping sweep was being performed on an active SCADA network that controlled 9-foot robotic arms, it was noticed that one arm became active and swung around 180 degrees. The controller for the arm was in standby mode before the ping sweep was initiated. NIST Special Publication Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security Slide 13 First Base Technologies 2013

14 Problems with Testing - 2 A ping sweep was being performed on an ICS network to identify all hosts that were attached to the network, for inventory purposes. It caused a system controlling the creation of integrated circuits in the fabrication plant to hang. This test resulted in the destruction of $50,000 worth of wafers. NIST Special Publication Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security Slide 14 First Base Technologies 2013

15 Problems with Testing - 3 A gas utility hired an IT security consulting organization to conduct penetration testing on its corporate IT network. The consulting organization carelessly ventured into a part of the network that was directly connected to the SCADA system. The penetration test locked up the SCADA system and the utility was not able to send gas through its pipelines for four hours. The outcome was the loss of service to its customer base for those four hours. NIST Special Publication Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security Slide 15 First Base Technologies 2013

16 Areas for Review Perimeter Network infrastructure Active Directory etc. Host operating systems Applications PLCs, RTUs, IEDs, etc. Slide 16 First Base Technologies 2013

17 Perimeter Identify all external connections Review firewall rules Review remote access methods Check for wireless networks Check physical access If in doubt: test duplicate systems Slide 17 First Base Technologies 2013

18 Network Infrastructure Review router configs Review switch tables Conduct physical cable checks Conduct packet sniffing and analysis If in doubt: test duplicate systems Slide 18 First Base Technologies 2013

19 Active Directory Manual inspection Interviews Offline inspection Slide 19 First Base Technologies 2013

20 Host Operating Systems Review hardening Review patch levels Review password quality Review share and directory permissions Review remote access If in doubt: test duplicate systems Slide 20 First Base Technologies 2013

21 Applications Review ports and services Review OS credentials Review password quality Review remote access Consider code review If in doubt: test duplicate systems Slide 21 First Base Technologies 2013

22 PLCs, RTUs, IEDs, etc. Review hardening Review patch levels Review password quality (if any) Conduct packet sniffing If in doubt: test duplicate systems Slide 22 First Base Technologies 2013

23 Agenda Overview of critical systems Vulnerabilities and concerns Security testing Summary and conclusions Slide 23 First Base Technologies 2013

24 Summary and Conclusions Industrial systems now use UNIX or Windows exposing them to the same IT security challenges as commercial systems Systems still considered to be isolated, but they are not Systems not patched or hardened All devices will have authentication problems Systems replaced less often than commercial systems: no cleanup, more opportunity for information leakage Field bus protocols were not designed to be secure Poor segmentation and firewalling Conventional scanning and testing can cause serious problems Audit and careful manual inspection rather than pen test Slide 24 First Base Technologies 2013

25 Designing Security In Learn from the IT security challenges in commercial systems using UNIX or Windows Build firewalls with the understanding that industrial systems may not be isolated Work towards hardening and patching systems (thorough application testing required!) Segment systems that have authentication problems Perform regular cleanup of systems to minimise redundant accounts Replace field bus protocols wherever possible, otherwise segment them Segment and firewall thoroughly, then test the boundaries Slide 25 First Base Technologies 2013

26 Need more information? Peter Wood Chief Executive Officer First Base Technologies LLP Twitter: peterwoodx Slide 26 First Base Technologies 2013

Innovative Defense Strategies for Securing SCADA & Control Systems

1201 Louisiana Street Suite 400 Houston, Texas 77002 Phone: 877.302.DATA Fax: 800.864.6249 Email: info@plantdata.com Innovative Defense Strategies for Securing SCADA & Control Systems By: Jonathan Pollet