This document provides an overview and agenda for a presentation on SCADA hacking. It begins with definitions of SCADA and related terms, describes where SCADA systems are commonly used and why they are used for industrial control. It then addresses common misconceptions about SCADA security and realities, discusses some common industrial protocols, and outlines how the presenter will demonstrate pentesting SCADA systems and industrial malware. The document provides context and background information to set up the presentation.

1. SSCCAADDAA HHaacckkiinngg IInndduussttrriiaall SSccaallee FFuunn
JJaann SSeeiiddll

2. $$ wwhhooaammii
AAbboouutt
FFuullll NNaammee:: JJaann SSeeiiddll
OOrriiggiinn:: RRiioo ddee JJaanneeiirroo,, RRJJ –– BBrraazziill
WWoorrkk::
● CCTTOO @@ TTII SSaaffee
● OOppeennSSoouurrccee ccoonnttrriibbuuttoorr ffoorr:: PPEEVV,, LLooggssttaasshh
● CCooddeess aanndd ssnniippppeettss @@ ggiitthhuubb..ccoomm//jjsseeiiddll
FFeeaattuurreess::
● UUNNIIXX EEvvaannggeelliisstt//AAddddiicctt//FFrreeaakk ((bbuutt nnoo ffaannbbooyy!!))
● PPyytthhoonn aanndd CC lloovveerr
● CCooffffeeee ddeeppeennddeenntt
● HHaatteess pprriinntteerrss aanndd ssoocciiaall nneettwwoorrkkss
● PPrroouudd DDCC LLaabbss RReesseeaarrcchheerr SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

3. 00xx00 WWhhaatt iiss SSCCAADDAA??
00xx11 WWhheerree iiss SSCCAADDAA??
00xx22 WWhhyy SSCCAADDAA??
00xx33 MMiissccoonncceeppttiioonnss aanndd RReeaalliittyy
00xx44 IInndduussttrriiaall PPrroottooccoollss
00xx55 PPeenntteessttiinngg SSccaaddaa ssyysstteemmss
00xx66 IInndduussttrriiaall MMaallwwaarreess,, tthhee ccyybbeerrwweeaappoonnss
00xx77 SSoolluuttiioonnss ffoorr IInndduussttrriiaall CCoonnttrrooll SSyysstteemmss SSeeccuurriittyy
00xx88 RReesseeaarrcchhiinngg SSCCAADDAA
00xx99 MMooddbbuuss AAttttaacckkss DDeemmoonnssttrraattiioonn
00xxAA QQuueessttiioonnss??
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
AAggeennddaa

4. WWhhaatt iiss SSCCAADDAA??
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

5. WWhhaatt iiss NNOOTT SSCCAADDAA??
Programmable-Logic Controllers (PLCs)
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

6. WWhhaatt iiss NNOOTT SSCCAADDAA??
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Remote Terminal Units (RTUs)
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

7. WWhhaatt iiss NNOOTT SSCCAADDAA??
Supervisory Control and Data Acquisition
CCoonnttrrooll ddeevviicceess,, ssaaffeettyy ddeevviicceess,, eelleeccttrriicc//eelleeccttrroonniicc ddeevviicceess
SSiinnggllee--bbooxx ssoolluuttiioonn//aapppplliiccaattiioonn
NNoott jjuusstt aa uusseerr iinntteerrffaaccee
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

8. WWhhaatt iiss SSCCAADDAA??
Supervisory Control and Data Acquisition
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

9. WWhhaatt iiss SSCCAADDAA??
Supervisory Control and Data Acquisition
CCoolllleeccttss ddaattaa aanndd ccoonnttrrooll ffiieelldd eeqquuiippmmeenntt
SSaavveess hhiissttoorriiccaall ddaattaa
FFoorrwwaarrddss ddaattaa ttoo ootthheerr ddeevviicceess oorr ssyysstteemmss
PPrroovviiddeess sseeccoonnddss--pprreecciissiioonn mmeeaassuurreemmeennttss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

10. WWhheerree iiss SSCCAADDAA??
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

11. WWhheerree iiss SSCCAADDAA??
What kind of cool stuff do they control?
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

12. WWhheerree iiss SSCCAADDAA??
What kind of cool stuff do they control?
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

13. WWhheerree iiss SSCCAADDAA??
What kind of cool stuff do they control?
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

14. WWhheerree iiss SSCCAADDAA??
What kind of cool stuff do they control?
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

15. WWhheerree iiss SSCCAADDAA??
What kind of cool stuff do they control?
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

16. WWhheerree iiss SSCCAADDAA??
What kind of cool stuff do they control?
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

17. WWhhyy SSCCAADDAA??
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

18. WWhhyy SSCCAADDAA??
Do we really need computers for this?
EEqquuiippmmeennttss rreellyy oonn vveerryy qquuiicckk rreessppoonnssee ttiimmeess
HHuuggee aammoouunntt ooff ddaattaa nneeeeddss ttoo bbee ccoolllleecctteedd
HHuunnddrreeddss,, tthhoouussaannddss ooff ddeevviicceess nneeeedd ttoo bbee ccoonnttrroolllleedd aatt ssaammee ttiimmee
OOppeerraattiioonn iiss aallmmoosstt nneevveerr iinntteerrrruupptteedd
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

19. WWhhyy SSCCAADDAA??
Can you imagine if something goes... wrong?
Russian hydro plant accident kills 12
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

20. WWhhyy SSCCAADDAA??
Can you imagine if something goes... wrong?
Chemical plant explosion leaves 5 missing,
15 injured in China
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

21. WWhhyy SSCCAADDAA??
Can you imagine if something goes... wrong?
Hundreds of tons of toxic waste were dumped into one of the German rivers
after the serious accident at a local chemical plant.
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

22. MMiissccoonncceeppttiioonnss aanndd RReeaalliittyy
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

23. MMiissccoonncceeppttiioonnss aanndd RReeaalliittyy
Do automation guys think they are in danger?
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

24. MMiissccoonncceeppttiioonnss aanndd RReeaalliittyy
““SSCCAADDAA nneettwwoorrkkss aarree iissoollaatteedd aanndd ccaannnnoott bbee
aacccceesssseedd oovveerr tthhee IInntteerrnneett””
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
First, the misconceptions...
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

25. MMiissccoonncceeppttiioonnss aanndd RReeaalliittyy
““WWee uussee pprroopprriieettaarryy//ccuussttoomm ssyysstteemmss,, pprroottooccoollss
aanndd eeqquuiippmmeenntt,, tthhuuss wwee ccaannnnoott bbee hhaacckkeedd””
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
First, the misconceptions...
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

26. MMiissccoonncceeppttiioonnss aanndd RReeaalliittyy
““HHMMII//ssoommee--ccoonnttrrooll--ssooffttwwaarree hhaass lliimmiitteedd
ffuunnccttiioonnaalliittyy aanndd//oorr rreessttrriiccttiioonnss ssoo iitt ccaannnnoott bbee
aabbuusseedd””
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
First, the misconceptions...
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

27. MMiissccoonncceeppttiioonnss aanndd RReeaalliittyy
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
And my opinion on this...

28. MMiissccoonncceeppttiioonnss aanndd RReeaalliittyy
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
And now comes reality...
AAllll iinndduussttrriiaall nneettwwoorrkkss aarree ccoonnnneecctteedd ssoommeehhooww
ttoo tthhee IInntteerrnneett oorr ccoorrppoorraattee nneettwwoorrkk
Integration software (ERP/MES), Phone/Modem/3G abuse,
Equipment misconfiguration (switches, routers, firewalls),
removable media abuse, remote access (VPN, RDP, VNC)

29. MMiissccoonncceeppttiioonnss aanndd RReeaalliittyy
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
And now comes reality...
MMoosstt nneettwwoorrkkss aarree ooppeerraatteedd bbyy aauuttoommaattiioonn ssttaaffff
wwiitthh nnoo oorr llooww IITT kknnoowwlleeggddee
Commit security abuses/incidents, unsafe computer
operation posture [games, internet browsing, downloading
stuff], careless about infosec, just want the job done

30. MMiissccoonncceeppttiioonnss aanndd RReeaalliittyy
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
And now comes reality...
MMoosstt nneettwwoorrkkss aanndd sseerrvveerrss aarree
mmaannaaggeedd bbyy IITT ssttaaffff
Low to no knowledge about industrial protocols, attack
impacts, software operation, overall ICS security, commit
several mistakes configuring equipment

31. MMiissccoonncceeppttiioonnss aanndd RReeaalliittyy
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
And now comes reality...
9999,,99%% ooff ppllaannttss ccaann bbee eeaassiillyy hhaacckkeedd
Common OS (Windows, Linux...)
Common/open protocols (HTTP, Telnet, Modbus)
All the same common bugs from IT: weak/hardcoded
passwords, silly application vulns, unpatched stuff

32. MMiissccoonncceeppttiioonnss aanndd RReeaalliittyy
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
And now comes reality...

33. IInndduussttrriiaall PPrroottooccoollss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

34. IInndduussttrriiaall PPrroottooccoollss
Current common market protocols
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
CIP – Common
Industrial Protocol,
Ethernet/IP
Profinet, S3/5/7
CC-Link Modbus

35. IInndduussttrriiaall PPrroottooccoollss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Modbus
VVeerryy ssiimmppllee ppllaaiinntteexxtt pprroottooccooll
CCrreeaatteedd iinn tthhee 7700ss bbyy MMooddiiccoonn
UUsseedd bbyy mmaannyy vveennddoorrss

36. IInndduussttrriiaall PPrroottooccoollss
Modbus
NNoo aauutthheennttiiccaattiioonn ++ NNoo eennccrryyppttiioonn ++ NNoo vvaalliiddaattiioonn
==
HHAA--HHAA sseeccuurriittyy lleevveell
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

37. IInndduussttrriiaall PPrroottooccoollss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Modbus
CCoommmmoonn aarrcchhiitteeccttuurree

38. IInndduussttrriiaall PPrroottooccoollss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Modbus
PPrroottooccooll ssttrruuccuuttuurree
Standard port tcp/502

39. IInndduussttrriiaall PPrroottooccoollss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Modbus
PPrroottooccooll ssttrruuccuuttuurree

40. IInndduussttrriiaall PPrroottooccoollss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Modbus
FFuunnccttiioonn CCooddeess

41. IInndduussttrriiaall PPrroottooccoollss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Modbus
FFuunnccttiioonn CCooddeess ((tthhee oonneess wwee ccaarree))
Read/Write Coils and Registers (Mess up stuff) [lots]
Read/Write File records [20, 21]
Device Fingerprinting & Diagnostics [43,17,8]
+ modbus supports user-defined functions!

42. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

43. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
IImmppoorrttaanntt NNoottee
When you run tests against an industrial control system
unexpected things may happen.
And they happen almost every time.
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

44. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

45. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
IImmppoorrttaanntt NNoottee
Do not test LIVE systems.
Never. Ever.
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

46. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
SSccaannnniinngg // DDiissccoovveerryy
Some tools available:
plcscan – Scans s7comm & modbus devices
https://code.google.com/p/plcscan/
modscan – Scans modbus devices
https://code.google.com/p/modscan/
Nmap – Famous network scanner
http://nmap.org/
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

47. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
SSccaannnniinngg // DDiissccoovveerryy ((ccoonntt..))
Metasploit Modules
auxiliary/scanner/modbus/modbus_findunitid
auxiliary/scanner/modbus/modbusdetect
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

48. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
SSccaannnniinngg // DDiissccoovveerryy
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
PLCscan

49. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
SSccaannnniinngg // DDiissccoovveerryy
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Nmap – modbus-discover.nse

50. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
SSccaannnniinngg // DDiissccoovveerryy
Modbus Diagnostic Function code (0x2B, 43)
VendorName, ProductName, ModelName, ProductCode,
MajorMinorRevision
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

51. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
DDaattaa MMaanniippuullaattiioonn
Opensource ICS protocol libraries
Modlib – Scapy Extension [python]
https://www.scadaforce.com/modbus
Pymodbus – Module [python]
https://github.com/bashwork/pymodbus
Modbus-cli – Gem [ruby]
https://rubygems.org/gems/modbus-cli
S7comm – Library [C,C++,C#,Delphi,Pascal,Perl,VB(A)]
http://libnodave.sourceforge.net/
OpenDNP3 – Library [C++]
https://code.google.com/p/dnp3/
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

52. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
DDaattaa MMaanniippuullaattiioonn ((ccoonntt..))
Metasploit Modules
auxiliary/scanner/modbus/modbusclient
auxiliary/admin/scada/modicon_command
auxiliary/admin/scada/igss_exec_17
auxiliary/admin/scada/multi_cip_command
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

53. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
DDaattaa MMaanniippuullaattiioonn
Reading and Writing data
modbus-cli
<https://rubygems.org/gems/modbus-cli>
R: modbus read <IP> <ADDR> <QTY>
W: modbus write <IP> <ADDR> [<VAL1>,<VAL2>,<VAL3>]
pymodclient
<https://github.com/jseidl/pymodbuscli>
R: pymodbuscli -f read_register -h <IP> <ADDR> <QTY>
W: pymodbuscli -f write_register -h <IP> <ADDR>
[<VAL1>,<VAL2>,<VAL3>]
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Modbus

54. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
DDaattaa MMaanniippuullaattiioonn
Metasploit Modules (not on official tree yet)
simatic_s7_300_command.rb / simatic_s7_300_memory_view.rb /
simatic_s7_1200_command.rb
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
S7Comm
https://github.com/d1n/s7-metasploit-modules

55. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
SSnniiffffiinngg TTrraaffffiicc
Native Wireshark dissector
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Modbus

56. PPeenntteessttiinngg SSCCAADDAA ssyysstteemmss
SSnniiffffiinngg TTrraaffffiicc
Opensource Wireshark dissector plugin
<http://sourceforge.net/projects/s7commwireshark/>
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
SIEMENS S7comm

57. IInndduussttrriiaall MMaallwwaarreess
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

58. IInndduussttrriiaall MMaallwwaarreess
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
IInndduussttrriiaall SSaabboottaaggee
SSttuuxxnneett

59. IInndduussttrriiaall MMaallwwaarreess
SSttuuxxnneett
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Sabotage
Discovered July 2010
Targets Siemens WinCC systems
Targets specific PLC models
100KLOC (thousands of lines of code)

60. IInndduussttrriiaall MMaallwwaarreess
SSttuuxxnneett
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Sabotage
Sabotages centrifuges causing malfunction or destruction
Allegedly a sabotage plan from USA and Israel against
Iran's nuclear program

61. IInndduussttrriiaall MMaallwwaarreess
SSttuuxxnneett
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Sabotage
http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-
of-cyberattacks-against-iran.html?pagewanted=all&_r=2

62. IInndduussttrriiaall MMaallwwaarreess
SSttuuxxnneett
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Sabotage
http://www.cbsnews.com/8301-205_162-57592862/nsa-leaker-snowden-claimed-
u.s-and-israel-co-wrote-stuxnet-virus/

63. IInndduussttrriiaall MMaallwwaarreess
SSttuuxxnneett
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Sabotage
http://www.symantec.com/connect/blogs/w32stuxnet-dossier

64. IInndduussttrriiaall MMaallwwaarreess
SSttuuxxnneett
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Sabotage
Exploits five vulnerabilities (of which four are 0-day)...
LNK File Bug – Initial Infection via USB drives/removable media
http://www.microsoft.com/technet/security/bulletin/ms10-046.mspx
Printer Spooler – Spreading
http://www.microsoft.com/technet/security/bulletin/ms10-061.mspx
Server Service (SMB) – Spreading
http://www.microsoft.com/technet/security/bulletin/ms08-067.mspx
Keyboard layout file – Privilege escalation
Task Scheduler – Privilege escalation
… and then installs a rootkit :)

65. IInndduussttrriiaall MMaallwwaarreess
SSttuuxxnneett
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Sabotage
Which can only be installed because Stuxnet has stolen
valid digital certificates.
From Realtek and Jmicron.

66. IInndduussttrriiaall MMaallwwaarreess
SSttuuxxnneett
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Sabotage
As if this weren't enough, it creates a peer-to-peer network
of infected hosts, steals intelligence, and rootkits the PLC
+ project files so engineers and operators won't notice.

67. IInndduussttrriiaall MMaallwwaarreess
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Espionage
DDuuQQuu

68. IInndduussttrriiaall MMaallwwaarreess
DDuuQQuu
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Espionage
Discovered September 2011
Possibly derived from Stuxnet
Objective: backdooring and data collection
Targets ICS software and hardware vendors

69. IInndduussttrriiaall MMaallwwaarreess
DDuuQQuu
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Espionage
Uses one Microsoft vulnerability
Microsoft Windows 'Win32k.sys' TrueType Font Handling Remote Code
Execution Vulnerability (BID 50462)
Does not replicate on its own
Has also stolen signed certificates

70. IInndduussttrriiaall MMaallwwaarreess
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Espionage
FFllaammee // SSkkyywwiippeerr

71. IInndduussttrriiaall MMaallwwaarreess
FFllaammee
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Espionage
Discovered ~May 2012
Mostly seen in middle-east
About 20mb in size
Has LUA plugin support
Around 20 extension modules

72. IInndduussttrriiaall MMaallwwaarreess
FFllaammee
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Espionage
Fingerprints countermeasure software/adapts to evade it
Multiple encryption levels
SQLite databases for storing collected data
Propagates similar to Stuxnet (LNK+Spooler)

73. IInndduussttrriiaall MMaallwwaarreess
FFllaammee
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Espionage
Record Skype Conversations
Keylogging + Screenlogging
Network Sniffer
Bluetooth scanning and compromise
Most affected countries: Iran, Israel, Sudan, Syria, Lebanon,
Saudi Arabia and Egypt.

74. IInndduussttrriiaall MMaallwwaarreess
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Espionage
GGaauussss

75. IInndduussttrriiaall MMaallwwaarreess
GGaauussss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Espionage
Discovered ~August 2012
Flame+Banking+Nasty Stuff
Same infection schemes as Stuxnet & Flame
Has encrypted payload that is only run under certain
circumstances

76. IInndduussttrriiaall MMaallwwaarreess
GGaauussss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Espionage
Steals passwords and cookies from browser
Collects and reports system configuration
Infects other removable media
Enumerates files and directories

77. IInndduussttrriiaall MMaallwwaarreess
GGaauussss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Industrial Espionage
Steals banking credentials from middle-east banking
systems
Steals information from social networks, instant messaging
and email accounts

78. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

79. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
FFiirrsstt ooff AAllll
There is no single-box solution.
Sorry :(
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

80. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
FFiirrsstt ooff AAllll
Security is not only on your hosts but
also networks and personnel
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

81. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
FFiirrsstt ooff AAllll
You need the best solution for each area. Each vendor has
expertise in its own area and probably won't master all of
them at the same time.
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

82. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
ssoo......
Embrace good and old defense in depth model
Photo credit: Sentrillion
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

83. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
ssoo......
Embrace good and old defense in depth model
Locks, cameras etc Firewalls, IDPS,
Photo credit: Sentrillion
Data diodes
Segmentation, VLANs,
port-mirrored IDS
WAFs, strong
architechture
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Whitelisting
software, HIDPS,
central logging
Encryption and access
control

84. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
NNeettwwoorrkk SSeeggmmeennttaattiioonn
ISA/99 Zones and Conduits Model
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

85. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
NNeettwwoorrkk SSeeggmmeennttaattiioonn
Proper DMZ Model
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

86. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
IInndduussttrriiaall CCoonnttrrooll SSyysstteemmss FFiirreewwaallllss//IIDDSSss
Commercial Solutions
Tofino Security Appliance SIEMENS Scalance S
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

87. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
IInndduussttrriiaall CCoonnttrrooll SSyysstteemmss FFiirreewwaallllss//IIDDSSss
Commercial Solutions
Firewall
Industrial Protocol Enforcer
VPN
Centralized Management
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

88. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
IInndduussttrriiaall CCoonnttrrooll SSyysstteemmss FFiirreewwaallllss//IIDDSSss
OpenSource Solutions
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

89. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
SSNNOORRTT SSCCAADDAA IIDDSS RRuulleess
Initially compiled by Digital Bond
Many rules already on SNORT main repository
Additional rules are easy to write
http://www.digitalbond.com/tools/quickdraw/
http://blog.snort.org/2012/01/snort-292-scada-preprocessors.html
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

90. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
MMooddbbuuss
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Snort IDS rules

91. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
EEtthheerr//IIPP
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Snort IDS rules

92. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
DDNNPP33
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Snort IDS rules

93. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
DDaattaa DDiiooddeess
Allow traffic to flow only in one direction
Enforced by hardware
Photo-resistor on one end, Photo-transmitter on other
As it depends on hardware, no open-source solution yet :(
Can be enforced via firewall but not with same efficiency
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

94. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
DDaattaa DDiiooddeess
Commercial Solution
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

95. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
WWhhiittee--lliissttiinngg SSooffttwwaarree
Anti-virus, seriously?
CEBIT 2013 Workshop: Anti-virus are an efficient solution for
industrial network protection? (short answer: no)
http://slidesha.re/17AwTEd
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

96. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
MMoonniittoorriinngg
ICS networks and hosts generally operate in regular and
predictable manners.
Simple monitoring and plotting can help detect anomalies
when they happen
[White paper] Detecting problems in industrial networks though
continuous monitoring
http://slidesha.re/17JyVSu
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

97. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
MMoonniittoorriinngg
• Communications interception (ARP Poisoning)
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
• $ nmap –sV 192.168.1.1
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

98. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
MMoonniittoorriinngg • Denial of Service
•
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
• Malware infection

99. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
MMoonniittoorriinngg
• Unauthorized Modbus traffic
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

100. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
EEdduuccaattee yyoouurr uusseerrss
Your users don't really know the impact of using a 3G
modem to check their personal email or Facebook wall
Even less that they can ruin plant's processes by clicking
on a link sent by that hot girl he's chatting with for weeks
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

101. SSoolluuttiioonnss ffoorr IICCSS SSeeccuurriittyy
NNeevveerr ffoorrggeett wwhhaatt yyoouurr uusseerrss
mmeeaann ttoo yyoouurr sseeccuurriittyy
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

102. RReesseeaarrcchhiinngg SSCCAADDAA
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

103. RReesseeaarrcchhiinngg SSCCAADDAA
AALLWWAAYYSS RREEMMEEMMBBEERR!!!!!!!!
Do not test LIVE systems.
Never. Ever.
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

104. RReesseeaarrcchhiinngg SSCCAADDAA
GGaatthheerr ddooccuummeennttaattiioonn
Most protocols (even proprietary ones) have
documentation available on-line
Get it from manufacturer website or just freaking google it.
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

105. RReesseeaarrcchhiinngg SSCCAADDAA
GGaatthheerr ddooccuummeennttaattiioonn
DNP3 Primer
http://www.dnp.org/AboutUs/DNP3%20Primer%20Rev%20A.pdf
Modbus Specification
http://www.modbus.org/specs.php
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

106. RReesseeaarrcchhiinngg SSCCAADDAA
SSnniiffff mmaasstteerr--ssllaavvee ccoommmmuunniiccaattiioonn wwiitthh WWiirreesshhaarrkk
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

107. RReesseeaarrcchhiinngg SSCCAADDAA
GGeett aa tteesstt--bbeedd
Buy from manufacturer (expensive, sometimes impeditive)
Buy from e-bay (quite easy)
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Real, hardware-based

108. RReesseeaarrcchhiinngg SSCCAADDAA
GGeett aa tteesstt--bbeedd
http://www.ebay.com/sch/i.html?
_trksid=p2050601.m570.l1313.TR0.TRC0.Xs7-300&_nkw=s7-
300&_sacat=0&_from=R40
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Real, hardware-based

109. RReesseeaarrcchhiinngg SSCCAADDAA
GGeett aa tteesstt--bbeedd
http://www.ebay.com/sch/i.html?_odkw=s7-
300&_osacat=0&_from=R40&_trksid=p2045573.m570.l1313.TR3.TRC1.A0.Xwago+
750&_nkw=wago+750&_sacat=0
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Real, hardware-based

110. RReesseeaarrcchhiinngg SSCCAADDAA
GGeett aa tteesstt--bbeedd
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Emulated, software-based
Fully programmable
Available in many programming languages
Self-contained solutions available

111. RReesseeaarrcchhiinngg SSCCAADDAA
GGeett aa tteesstt--bbeedd
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Emulated, software-based
Pymodbus library
https://github.com/bashwork/pymodbus/blob/master/examples/common/synchro
nous-server.py
# initialize data
store = ModbusSlaveContext(
di = ModbusSequentialDataBlock(0, [17]*100),
co = ModbusSequentialDataBlock(0, [17]*100),
hr = ModbusSequentialDataBlock(0, [17]*100),
ir = ModbusSequentialDataBlock(0, [17]*100))
context = ModbusServerContext(slaves=store, single=True)
# initialize the server information
identity = ModbusDeviceIdentification()
identity.VendorName = 'Pymodbus'
identity.ProductCode = 'PM'
identity.VendorUrl = 'http://github.com/bashwork/pymodbus/'
identity.ProductName = 'Pymodbus Server'
identity.ModelName = 'Pymodbus Server'
identity.MajorMinorRevision = '1.0'
# run the server you want
StartTcpServer(context, identity=identity, address=("localhost", 5020))

112. RReesseeaarrcchhiinngg SSCCAADDAA
GGeett aa tteesstt--bbeedd
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Emulated, software-based
ModSak (commercial with free trial)
http://wingpath.co.uk/modbus/modsak.php

113. RReesseeaarrcchhiinngg SSCCAADDAA
GGeett ssoommee IICCSS ssooffttwwaarree ffrroomm vveennddoorrss
Vendors often have trial versions on their sites
You might have to ask them for a copy
They might not like it what you'll be using it for
Be brave. Don't desist.
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

114. RReesseeaarrcchhiinngg SSCCAADDAA
For both equipment and software
SSccaann tthhee ccrraapp oouutt ooff iitt
Use network and software vulnerabilities scanners heavily,
don't mind if sometimes devices go crazy
but do one at a time or you may DOS your device
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

115. RReesseeaarrcchhiinngg SSCCAADDAA
For both equipment and software
FFuuzzzz''eemm uunnttiill ssmmookkee ccoommeess oouutt
Create fuzz model files based on documentation
See how they handle malformed data
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

116. RReesseeaarrcchhiinngg SSCCAADDAA
For both equipment and software
FFuuzzzz''eemm uunnttiill ssmmookkee ccoommeess oouutt
Peach fuzzer
http://peachfuzzer.com/
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

117. RReesseeaarrcchhiinngg SSCCAADDAA
For both equipment and software
FFuuzzzz''eemm uunnttiill ssmmookkee ccoommeess oouutt
Modbus PIT file for Peach Fuzzer (WIP)
https://github.com/jseidl/peach-pit/blob/master/modbus/modbus.xml
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

118. RReesseeaarrcchhiinngg SSCCAADDAA
For both equipment and software
FFuuzzzz''eemm uunnttiill ssmmookkee ccoommeess oouutt
ROBUS & AEGIS Project
http://www.automatak.com/aegis/ & http://www.automatak.com/robus/
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

119. RReesseeaarrcchhiinngg SSCCAADDAA
SSeett uupp aa hhoonneeyyppoott
Put it faced over to the internet and learn from other
attackers (caution! risky!)
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

120. RReesseeaarrcchhiinngg SSCCAADDAA
Conpot – SCADA/ICS Honeypot
SSeett uupp aa hhoonneeyyppoott
“The default configuration of Conpot simulates a basic
Siemens SIMATIC S7-200 PLC with an input/output module
and a CP 443-1 which would be needed in a real setup to
provide network connectivity.”
https://github.com/glastopf/conpot
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

121. AAttttaacckk DDeemmoonnssttrraattiioonn
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil

122. QQuueessttiioonnss??
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Please, don't be shy!

123. TThhaannkkss ffoorr yyoouurr ttiimmee!!
SCADA Hacking – Industrial Scale Fun. SEIDL, Jan
Hackers 2 Hackers Conference/2013 – São Paulo, Brazil
Hope you enjoyed it!
@jseidl
jseidl@wroot.org
http://wroot.org
https://github.com/jseidl
http://www.slideshare.net/jseidl
http://www.linkedin.com/in/janseidl