API Cybersecurity Conference Industrial Control Systems Workshop Sponsored by Alpine Security
www.alpinesecurity.com
Intro Incidents ICS Overview Lab Environment ICS Discovery ICS Vulnerability Scanning ICS System Exploitation ICS Protocol Exploitation
Objectives Learn how to perform a safe security assessment on an ICS environment Hands-on experience with tools and methods used to test/exploit ICS systems and protocols Provide a valuable and fun experience
Expectations Hands-on Environment vs Reality Not a race - don t just blindly go through exercises If you get stuck, ask an ICS Workshop Team member for help Not a Hacking workshop Don t hack into anything other than your own Virtual Machines Foundation building workshop
Aaron Dellamano Dave Jones Myles Kellerman Rich Norton Daniel Sewell Chris White Paul Wojciechowski Christian Espinosa ICS Team Members
Logistics Cell Phones Breaks Snacks Restrooms Emergencies Questions Timing
ICS Incidents
Stats 43% of global mining, oil, and gas companies were victims of at least one cyber attack in 2014 Symantec Energy companies lose $13.2 million on average annually due to cyber incidents, higher than any other industry - Ponemon Institute $1.9 Billion cost to Oil and Gas by 2018 - Reuters
Why ICS? ICS networks now connected to Internet Belief that standalone systems are secure Greater damage can be achieved with tangible consequences Hoover Dam
Targeted energy sector Compromised 100s of organizations globally Aimed at disrupting energy supplies Targeted petroleum pipeline operators Malicious Attack Energetic Bear
Malicious Attack Energetic Bear Attack Vectors Havex Trojan well-known malware Metasploit free well-known tool Spear-phishing Watering Hole Attacks Compromised SCADA/ICS software updates
Malicious Attack Saudi Aramco Saudi Aramco world s largest oil producer was attacked in August 2012 Shamoon malware erased data on over 30k computers Forced company offline for 10 days
Malicious Attack Turkish Oil Pipeline Explosion In 2008 an explosion of a Turkish oil pipeline was originally thought a malfunction Dec 2014 - confirmed Russian hackers performed a cyber attack that over-pressurized crude oil in the pipeline
Non-Malicious Attack Discovery Scanning Incident Ping sweep was performed on network that controlled 9- foot robotic arms One arm became active - swung 180 degrees The person in the room was outside the reach of the arm
Non-Malicious Attack Vulnerability Scanning Incident A vulnerability scan was performed on a food manufacturer s network Some traffic made it onto the control network Caused all PLCs controlling manufacturing to hang Resulted in $1M worth of damage
Non-Malicious Attack Penetration Testing Incident A gas utility hired a security company to conduct penetration testing on the corporate IT network The security company ventured out of scope into the ICS network, locking up the ICS system Gas utility was not able to send gas through its pipelines for 4 hours
ICS Security Overview
Source: https://ics-cert.us-cert.gov/content/overview-cyber-vulnerabilities
Common ICS Vulnerabilities Out-of-date technologies Out-of-date Operating Systems Out-of-date applications Unsecure network connectivity Unsecure interfaces Virus protection weak or nonexistent Lack of monitoring War-dialing vulnerabilities Software overflow weaknesses Etc.
Known Vulnerabilities Search for scada
Known Vulnerabilities Search for hmi
Known Vulnerabilities Search for plc
Source: https://ics-cert.us-cert.gov/sites/default/files/documents/cyber_security_assessments_of_industrial_control_systems.pdf
Source: http://energy.sandia.gov/wp-content/gallery/uploads/sand_2005_2846p.pdf
Exercise Caution Scan test network or non-production systems Backup systems prior to scanning Don t scan critical systems or scan during critical operations timeframes If the system truly is critical, there should be a redundant pair Scan one IP at a time or a small range Scan one IP of a failover pair
Risk Discovery Scanning Vulnerability Scanning Penetration Testing Non-intrusive Assessment
ICS Workshop Lab Setup
Lab Setup Overview Thumb Drive Manuals VMware All VMs expire Friday at 6pm,Central
Virtual Machines 1. Kali 2. Master PLC / HMI 3. Slave PLC 4. Targets
Exercises ICS Discovery ICS Vulnerability Scanning ICS System Exploitation ICS Protocol Exploitation
Kali Metasploit Armitage John the Ripper Wireshark Nmap Nessus Netcat Etc. Tools Used
Methodology Review Target Discovery Vulnerability Identification Penetration / Exploitation Discovery Vulnerability Identification Exploitation
ICS Workshop Setup and Configuration 25 Minutes
ICS Discovery
Discovery Vulnerability Identification Exploitation
Discovery Scanning Discovery Scanning involves finding live targets Examples: HMI PLCs Engineering Workstation Historian
What are we looking for? HMIs typically run on Windows, often XP Slave PLCs
Nmap Scripting Engine (NSE)
Nmap for ICS NSE Nmap Scripting Engine Has scripts designed to help discover and enumerates ICS systems: bacnet-info modbus-discover stuxnet-detect https://github.com/drainware/nmap-scada Siemens-CommunicationsProcessors.nse Siemens-SCALANCE-module.nse Siemens-WINCC.nse
Risk Discovery Scanning Vulnerability Scanning Penetration Testing Non-intrusive Assessment
ICS Target Discovery Exercise 25 Minutes
ICS Target Discovery Exercise Recap
ICS Vulnerability Scanning
Vulnerability DiscoveryICS System Exploitation Identification Exploitation
Vulnerability Scanners More intrusive than discovery tools like Nmap Dramatically increase likelihood of creating a DOS or undesired event Use with Extreme Caution or not at all on Production networks
Nessus SCADA Plugins
Risk Discovery Scanning Vulnerability Scanning Penetration Testing Non-intrusive Assessment
ICS Vulnerability Scanning Exercise 45 Minutes
ICS Target Discovery Exercise Recap
ICS System Exploitation
Vulnerability DiscoveryICS System Exploitation Identification Exploitation
Risk Discovery Scanning Vulnerability Scanning Penetration Testing Non-intrusive Assessment
ICS System Exploitation Exercise 45 Minutes
ICS Target Discovery Exercise Recap
ICS Protocol Exploitation
Vulnerability DiscoveryICS System Exploitation Identification Exploitation
00 00 00 00 00 06 7B 08 00 04 00 00
Risk Discovery Scanning Vulnerability Scanning Penetration Testing Non-intrusive Assessment
ICS Protocol Exploitation Exercise 35 Minutes
ICS Target Discovery Exercise Recap
ICS Workshop Survey https://www.surveymonkey.com/r/api-ics Contact Information christian.espinosa@alpinesecurity.com www.alpinesecurity.com (844) 9-ALPINE