36C3 - On the insecure nature of turbine control systems in power generation

36C3 Preroll music

Herald: One of the obvious critical
infrastructures we have nowadays is power

generation. If there is no power, we're
pretty much screwed. Our next speakers

will take a very close look at common
industrial control systems used in power

turbines and their shortcomings. So please
give a warm round of applause to repdet,

moradek and cOrs.

Applause

repdet: Good morning, Congress. Thank you
for waking up in the morning. We will talk

about the security of power plants today,
specifically about automation systems,

that are used in the power plants up. You
might think that this is another talk

about how insecure the whole industrial
things around us are and more or less it

is. So for four years, we are we and our
colleagues speak about problems in

industrial security. We are happy to say
that things are getting better, but it's

just that the temper is a little bit
different and feels a little bit

uncomfortable though. Anyway, we will
speak about to like how a power plants are

built. What is the automation inside? What
are the vulnerabilities? And like the high

level overview of what you can do with
this. But up at first a little bit of

introduction. We are security consultants.
We work with a lot of industrial things

like PLC, RTuse, SCADAS, DCSs, LCS
whatever it is, we were doing this for too

long. We should have fought, for so long
that we have a huge map of contacts with a

lot of system integrators and vendors. And
from the time we are not just doing the

consultancy work for some asset owner, for
example, for a power plant. We also talk

to other entities and we try to fix
things altogether. We work at Kaspersky

and actually the whole research was done
not just by me, Rado and Alexander, who

are here, but also with the help of
Eugenia and two Sergeys. Yep. So things

that are very important to note is that
everything that we will discuss right now

is reported to our respective vendor.
Basically long time ago you can see like

vendors here, but more or less we will
speak only about one vendor today. It's

it's it is Siemens. But we would like you
to understand that a similar security

issues can be found in all other
industrial solutions from other vendors.

You would find some of the findings, not,
for example, that seller does not require

like weeks off work to find them out. And
this would be through specifically for all

other vendors which are not mentioned in
the talk. Jokes aside, we will share

security issues of real power plants out
there and it might look like we are we are

kind of irresponsible guys. But in fact,
this is the other way around. I mean that

to do some kind of research on with these
systems that are working in the power

plants, you need to get access to them.
You need time to do this research. You

need to have some knowledge to do this
research and all these resources, they are

limited for guys like us, for penetration
testers, for auditors, for power plant

operators and engineers, but for the bad
guys like the potential attacker or so

adversaries. This is actually their job.
They they have a lot of investments to do

some research. So we assume that bad guys
already know this. And we just we would

like to share some information with the
good guys so they would be able to act

upon this. So let's go to the talk itself.
Power plants, power plants is the most

common way how humans get their power,
their electricity, their every everywhere

around us. And there I believe the closest
one to Leipzig is called the Lippendorf

power station. And during this research
when we were preparing an introduction, we

were surprised how many information about
power plants you can get from the

Internet. It's not just, for example, a
picture of this of the same power station

on the Google Maps. It is actually a very
it's a very good scheme of what you can

see on the marketing materials from
vendors, because when they sell some

system that ultimate power plant
operations, they sometimes start with

building construction. And on their on
their websites, you can find the schematic

pictures of actually which building does
what and where you will find some

equipment, which versions of equipment are
used in these systems. But if you like, if

you don't have this experience, you can
just Google things and you will find out

which systems are used for automation in
power plants, for example, for Lippendorf

it's some system that is called Siemens
SPP T2000 and P3000, which is actually

have another Siemens system inside called
Siemens SPPA-T/P3000. So it's a little bit

confusing and it is. And we are still
confused. This is exactly the system that

would be that we will focus today. Siemens
SPPT 3000. And again, it could be any

other automation system, but it just
happened the way that we've seen this

system more and more often than others. Up
there is a way how you can actually see

older generation sites throughout the
world. Thanks to their carbon monitoring

communities, this is not just power
plants. This is also like nuclear sites,

wind generation, solar, solar plants, etc.
and etc. They are all here, marked by

different fuel types of generation. For
example, there is a coil and gas power

plants. Mark, marked there. So the topic
is really huge. And like what we will

focus today in our talk is mostly the
power plants which are work on coal and

gas, which is important to mention. The
heart of each power plant is actually a

turbine. We don't have a picture of a
turbine on the slides, but more or less, I

think everybody saw it on the airplane.
There are various that there are similar

specifically in terms of size and mostly
how they work up on different vendor's Web

sites. You can actually find a lot of
information where those turbines are used.

And this is, for example, the map of the
turbines from Siemens. Not all turbines

specifically are used in power plants. So
there have a lot of different applications

like chemical plants, oil and gas. A lot
of other things. But if you correlate this

information from previous slides, you
would be able to identify which systems

are used by which power plant. And if you
will, Google more information, you can

actually tell their versions and the
generations of the systems that are used

on these power plants. This is important
because of the vulnerabilities that we

will discuss later on on the slide. So
before we will speak about so what is the

automation on power plants, we should
understand a little bit how they work. So

we will go from right to left and it's
very easy. A little a little noticed. For

all the talk, we will simplify a lot of
things for two reasons. One of them to

make it more suitable for the audience.
And another thing. We don't really

understand everything by ourselves. So the
first thing you should get is a fuel. Fuel

could be, for example, a coil or coal or a
gas. And you will just put this inside the

combustion chamber where you would put it
to set it up on fire, actually. And it

will generate a lot of pressure which will
go to the turbine. And because of the

pressure, the turbine will begin to
rotate. The turbine, have a shaft which

will drive the electricity generator,
which is obviously will generate

electricity and put it on the power grid.
So it is important from now I want to

understand that when we generate some some
electricity on the power plant, we put

this this power not just for, for example,
for this Congress center or for some city.

We put it in a big thing called the power
grid, where other entities will sell this

electricity to different customers.
There is also very interesting point about

like, when we do generate this pressure
and the combustion chamber is on fire, we

have a lot of excessive heat. And we have
two options like one of them is to safely

put it in the air. We have condensing
towers. This is option number one. And

another option is we can do some form of
recuperation. For example, we would take

this heat. We will warm water. The water
will produce steam. And we will put this

steam in the steam turbine and produce
additional electricity. This is kind of

the optimization of some of some form. So
what is the automation in this process?

The automation systems that are used on
the power plants are usually called

distributed control systems or DCSs. And
everything that I just said that it just

described actually is automated inside
those systems. The vendor of the solution

want to simplify all things for the
operator, because we don't want like

hundreds of people working on the power
plant. We just want like maybe dozens of

people working there and they want to
simplify the whole the whole process of

length. They don't care about where they
get this ???, gas or coal how much they

need it. They just should be able to stop
the generation process started. And they

control one main thing, which is called
how much power we should produce to the

power grid. So like how many megawatts of
electricity we should produce. This is

this. This describes the actually the
complexity, complexity hidden inside these

solutions because there are a lot of small
things happening inside and we will

discuss it a little bit later. As I said,
this GCF says they're not exclusively used

on the power plants. There are a lot of
other sites that would use the same

solutions, the same software and hardware.
The DCS is not just like a software that

you can install. It's a set of hardware
and software, various inputs, output,

models, sensors, etc., etc.. As I said,
sometimes they start from building

construction of like there is a field.
Please build a super power station. So

it's a more complex projects. Most, most
of the time. There are a lot of vendors

that are doing it. As I said, we are
focusing on this stock, on the Siemens

one. Just a short little short description
of how simplified things are for operators

of this DCA software. So, for example, if
we would like to answer the question how

we would regulate the output and megabytes
of our power plant, we would need to

control basically three things. Again, we
are oversimplifying here. First of all,

you would control how many. This is an
example for there for the gas turbine. So

we would need to regulate how many? Guess,
we would put inside the combustion chamber

where would control the flame temperature.
And we will control the thing that gets

air inside the turbine that basically
three things that are controlled by simple

peel cease in the whole system. And you
would be able, for example, to change 100

megawatts to 150 megawatts based on these
settings. So the system itself that we are

going to discuss is called Siemens
SPPT3000. And actually, again, as allow

all other DCA systems or from other
vendors. This is a typical industrial

systems system. It has all these things
called plcs, RTUse, to use HMAS, servers,

OPEC traffic, et cetera, et cetera. The
only thing that has a difference

specifically for Siemens as SPPT3000 is
that they have two main things called

application server and automation server.
That's this software running on the

servers is not what you will find on other
installations. Despite the fact that there

are a lot of like if you will read the
manuals for for the systems from Siemens.

There would be a lot of different networks
and highways and a lot of things like

Siemens would state that there is no
connection between the application network

and external networks. In practice and in
reality, you will find things like spick

sensor network, like monitoring both
vibration, foreign objects and some noises

inside the turbine. You will find the
demilitarized zone because all in all,

like all power plant operators, they won't
have like onsite maintenance guys,

engineers. They would try to do a remote
support. They would need to install

updates for operating system, although for
their signatures of their anti viruses,

they would need to push some opposite
traffic. So like information about the

generation process outside either to
corporate network or to some regulator,

because the whole energy market is
regulated and there are different entities

who would monitor common electricity
generation or they basically will tell you

how many electricity you should generate.
Because this is common electricity was

sold on the energy market. Basically,
the whole talk is structured like this. We

will speak first about application server,
then automation server and then some

summary. It all started with the process
called Coordinated Vulnerability

Disclosure. We notified Siemens about some
issues almost a year ago and like a month

at the beginning of December, Siemens
published an advisory. It was it was not

an advisory just from from the issues,
just from us. A lot of other teams also

contributed to it. And this December, this
year, December, doesn't mean that Siemens

just released the patches. When they say
that this system, SPPT3000, is exclusively

supported. So the system integrator for
the system is Siemens itself. So

throughout the year after we notified them
about some security issues, they started

to roll out patches and install updates on
critical infrastructure they support and

hopefully they did it with all the
sensitive issues. There is a lot of things

to discuss here we will skip, because we
are a little bit in a hurry. Things like

not all vulnerabilities are the same. And
we use, for example, CVSS here to talk

about like how critical the vulnerability
is, but it's actually not very applicable

to the industrial sites. You should
understand what you can do with each

vulnerability, how you can impact the
process, and we will skip this part. There

is actually kind of a threat model in the
white paper that we will release later on,

like during January. We will hope. So,
application server, application server is

this main is is a main resource that you
would find in the SPPT3000 network. Like

if if someone will remotely connect to the
system, it would end up in application

server. If someone wants to start the
generation process or to change some

values, it would be the application
server. If there are other servers that

would, for example, try to communicate the
application server, they will actually

start their work by downloading their
software from application server and then

executing it. So the first thing you might
notice here is there are a lot of a lot of

network ports available on this on this
machine. And actually, this is the first

point. There is a, a huge attack surface
for that bursary??? to choose whether or

not he would like to compromise some
Siemens software or its Windows software

or its some another third party. Huge
attack surface starting from the fact that

there are, all of the installation of this
SPP systems are kind of different. So

depending on the version and other
generation, you can find different Windows

versions from 2003 to 2016. Hopefully they
are all updated right now, but because the

that the update process for such as for
such installations is is a hard thing to

do. I mean you should wait for maintenance
and it should be like maybe once in a

healthy year or once a year. You will
always find some window where you can use

some remotely exploitable vulnerabilities
like the eternal blue or blue keeper mark

mentioned on the slide. There is tons of
different additional software like all

signwin??? that will allow you to do
privilege escalation, badly configured

Tomcats and we have here this funny pie
charts that show how configuration of

different software is aligned with the
best practices from CIS benchmarks. Those

are those are basically security
configuration gardening guides. The most

important thing in the application server
is a lot of Java software and in a minute

repdet will tell you about this. Surprise,
surprise there, the one of the most

notable problems in this Siemens SPPT3000
is actually passwords. There, there are

three important ranges. The first the
first of them is like what's all the

installations before 2014 and maybe 2015.
All passwords for the for for all the

power stations were the same. And you can
easily Google them. We've also published

like the full world list in the white
paper. After this year's Siemens started

to generate the unique passwords for all
power plants. But until this year, it was

kind of hard to change this password. So
you need to be aware of how to do this.

You need to know the process. You maybe
need to contact to contact your system

integrator to do this. Starting up from
this December, it would be much easier

specifically to change passwords. So it's
in the past. Even if you know, you have

you have these issues, you were not able
to simply change or all these things.

Along with the passwords, passwords, you
can find the like the full diagrams and

the integrator documentation that can show
you how the system is built, how it's

operating, specific accounts, etc, etc. Of
course, this was not published by Siemens,

thouse some power plant operators who
thought that would be a good idea to share

this information. So as I said, the most
important thing the application server is

a bunch of Java applications and please
welcome moradek will share the details

about this.
Applause

moradek: Hi, everyone. Let's look at how
this perverse software works on aplication

server. The operator can communicate with
system through at Thin client and Fat client

and. A Thin client act as Java applet
inside Internet Explorer browser and

communicate with server through HTTPS, so
it can be outside of application of fork

and its communications can be constrained
by a firewall. In opposite in case of Fat

client, software should be installed on
operator machine and client directly

communicates with RMA registry to find
services. And after that directly

communicates with this myservices. So Fat
client should belong to application fork.

Illustration of where architecture was
kindly provided by SPPA throws a URL. Not

to be missed, let divided into spaces in
red zone. The items that brought this

request from Thin client and redirect them
to rmyservices. And in green zones there

are myservices which act as network
services on their name on TCP ports. SPP

consists of containers, each container can
encapsulate inside one or more or

myservices. All type of containers are
represented on illustration and all of

them have self explanatory names. Before
we going deep inside in tunnels office

PPA, let me introduce some tools which
used in this research. First of all, old

jars files inside this PPA are obfuscated
with commercial product. But these

security measures can be easily bypassed
by public available tool the Obfuscator.

Elswhere sometimes it is useful to see how
legit software communicates with system.

It helps to understand architecture of
system and workflow of clients. In case of

PPA it my district was written, it
represents a role TCP streams in human

readable format inside it. Use method read
object from jsdk. It is known that this

method is unsafe to insecure
diserealisation, so be careful not

to be exploited through remote pickup. The
first pillar of SPP it's apache webserver.

According it config folder or software
config can be accessed by unauthorized

user. In fact, this folder contains some
sensitive information of system. For

example, files PC system configuration,
datasmells and files inside. If C contain

startup options and configuration of all
containers either application work or

automation work. Else configuration of
Oracle and publication in Tomcat DLC can be

accessed using this vulnerability. And about
Tomcat. There are three web

applications registered, remote diagnostic
viewer, manager and orion. According to

configuration of Tomcat, it's apache
webserver. I've observed as a ordering

service can be accessed through HTTPS and
uh, in the file web dot xml there are list

of all servlets of orion application and the
list is really huge. So some of these

servlets have attractive name forTiger, for
example, brow seservlet. In fact it allows

a third of the user directory, and listing
directories of operation system. But in

case of exploitation another servlet is
more attractive. File upload servlet it

allows you allows on the file upload with
system parameters based you in touch with

me in full control the name of the file.
So this vulnerability can be easily

transformed to a remote code execution.
You can override some startups scripts

office PPA or simply inject a shel in the
application and get the remote code

execution with system rights. Also there
are some set alerts which contains good

service factory names. In fact, they
redirect http request to my services.

Inside they passed around to foreign http
requests and search desirable my servives.

According to parameter service url and
further invoke go to the public method of

security service. And the name of the
method defined in centralized object in

the data section of which to progress.
Else parameters, the parameters of these

goals are also defined in this object. So
now we have situation one Thin client and

Fat client can access my services, but in
case of Fat client, it, it can also

directly communicate with RMA registry. So
if application server missed some

important java security updates, it
contains insecure deserialization

vulnerability. And using public to use
serial we can simply exploit it and get a

code execution with system rights again.
The next task will be to list all

available rMyservices on this SPPA system.
At first step, we simply use class look at

triggers and Java SDK and get a big list
of services. All but one jmakes it to

myservices, I assume that they perform
some general interface for com, for

control and manage containers of SPPA. For
the further investigation we only choose

LookUp Service. In fact, this service
looks like some a collection of another

RMA services using its public method list
we get the name of all available services

and using the name and public method
lookup we get the reference of RMA

service. All RMA services in this tip
implement interface satisfactory. So

buttons as this. We can assume that and
that this is a game collection of another

RMA services. But in fact it doesn't have
public method to get the name of the

service. So we need to decompile. So we
need to decompile the class and find some

factory methods which create RMA service,
for example, create adminscript and

inside we can find as the name of the
created service. As it can be guessed,

it's admin service. So using public
method, get service in this name, we find

that I gets the reference to the next
level RMA service and in final step we get

the reference to RMA services which
perform real job SPPA. But it this RMA

service also contains a lot of public
methods for unauthorized user. So to sum

up which referes registry and at each
level we find a lot of RMA services. And

as the last item also contains a lot of
public methods. So the attack surface of

Supply C system is really huge. Now when
we list all available RMA services, the

next question is how does authentication
of client request performs on the system?

To answer this question, let's look how
client requests to security service

processed from system. First of all,
clients get the reference to security

service using some client ID. Further
PCServiceFactory tries to get valid

session. Using this clientID in
SessionManager. If SessionManager will

failed in his task, the exception will be
throat and client will be failed. But if

it succeeds, valid sessionID will return
to PCSfactory. And further in its turn

instance of SecurityService will be
created in factory method. While the

session Id will be stored in loginID inside
SecurityService. And finally client will

get the reference to Security Service.
Further he can call some public method of

it. But as this method can perform
privileged checks of user using loginId in

SecurityManager. So to sum up, we have two
security measures in this system. But as

is the question how user client can
perform login operation. If he doesn't

have any valid clientID. In this case,
it's start up of the system,

SessionManager will be added on anonymus
session with clientID that equals zero.

And client will use this clientID, and
perform login operation. But attacker can

also use this feature and simply bypass
those look. So to sum up, there is only

one security measure on the system ends
and each fully delegated to two method or

for RMA services. But amount of itemized
services is huge, amount of public methods

is really huge. And so it's become really
difficult to manage security service of

system. According to this information. So
we know we know all inputs of system. We

know all possible security measures or
systems. So it's time to find

vulnerabilities in the list of RMA
services. This one, which looks so

attractive, its admins service, it can be
accessed with a anonymus session inside.

If this public method transcript, this
method doesn't perform any privileged

checks, so we can call its resulting
Ternium credentials and so on. At first

step, these methods creates instance of
class loader using bytes from arguments

and in fact this step will allow to
arbitrary java class. This class should

implement interface admins screams and
defined method to execute and this method

to execute will be called by run script of
RMA services. For this case we create Java

class as a simply run os common from
arguments of run script. And we get code

execution on the system, we system, right?
Of course, there's a more powerful post

exploitation of this vulnerability than
simply run os command. You can. This

vulerability allows inject arbitrary java
class inside running its SPPA application

so you can use some Java reflection to to
patch some variables of system and and

have influence on technological properties
of SPPA. Else, privilege check inside

methods of RMA service can be bypassed
with SEC vulnerability in session service. This

service has public method
getloggingsessions(). In fact, this method

return all sessiondata of loginin users on
the system. This information includes user

names, IP and client Id. So if it this
amounts these clientId of user that has

some admin privileges, attacker can use
this clientId to get a reference to

security service and this reference will
be with some more privileged session.

Further further, attacker can goal public
method of security service, get all users

and get all private information about all
users of the system and password hashes

included in this private information. So
to sum up, we have to or both of these

vulnerabilities can be accessed through
https and federal rules can be bypassed.

In general, all communication with RMA
services are encrypted. So usernames and

password hashes are transfered in plain text.
This is this because, this is more critical for

for Fat client case. So more all passwort
hashes doesn't perform any doesn't have

any session protection mechanism. So if
attacker can perform when and zoom into a

key attack against some user office prior
and captures the traffic between this user

and application server, he can get valid
username and password hash of the system

and simply reuses this credentials and
perform login operation on the system.

More. over, he also can change the
password of this user. I talk a lot about

user names and password hashes, so it's
time to understand how these items

organized on the system. Alex.
Alex: Hello everyone. I will continue our

discussion about application server. On
the previous slide you can see how remote

authentification works. Now. Sorry, I
repeat. On the parent slide you could see

how remote authentification works. And
now I'm going to tell you about how it is

organized locally. After the system, after
system gets started, it begins to read two

files: user1.xml and pdata1.exm to get
user list and their password respectevly.

The user1 file is the simple xml while the
data1 has a slightly more difficult

structure. It is jzip archive encoded in
base64, so as java actualization object in

jzip archive contained in a specific xml.
The field of this xml presents on the

slide. They are used to calculate cash
value and check passport during their

authentification. On the buttom of the
slide you can see password check algorithm

in a pseudo code. It's a photographic scam is
the type of called crypted hashing scheme

like on Unix and Linux machine. It has a
number of iterations salts and only one

things is edited was, was edited that is
hardcore the salt, which is the same for

all user. The tool for password, as a tool
to extract password hashes and set

parameters from the data1-file had been
developed on this slide. You can see its

output as a tool. The tool can be used
during the password auditing, them to

check her password to check week or
dictionary password and their actual hash

collision parameters. A tool is available
at the link below. And draws the line,

draws a line on the application server
analysis first, as we have seen, attack

surface is really huge and includes a lot
of different components. Secondly, it's

about remote connections. What's that
about? Whether SPP has remote connection

or because no remote connection. I
couldn't I couldn't do end this or someone

else, who told you? You should check it
anyway. And the last thing is a attacker

has opportunity to impact power generation
process. For example, it can start stop

generation, change some output value. Or
get some additional information about

generation process and all this. Action
can be done from application server. It's

all about application server. And let's
start discussion about automation. Its

main goal of automation server is to
execute realtime real time automation

functions and tasks depending on a
depending on the power plant project

architecture and its features. They're all
over automation server can be different. We have

to distinguish three roles. The first one
is automation role. They may be a slight

confusion because the term is used was for
server and for it's role, but analyzing

uplink automation server configuration and
publicly available information we have

found that whatever the role is, almost
the same hardware and software are used

and we have decided to use these kind of
classifications. That seems less confusing

to us. At the same time, it's slightly
different from the Windows

classification anyway. I mean, in
automation role, automation role means

that the server is responsible for
interaction with input-output modules to

each control and monitor power plant
equipment such as turbine electric

generator or some some other. The second
role is communication in this role. This

role is used for connection the third
party software and system in other words

it's just a protocol converter supporting
such protocols as modbus, I see 101, 104

and some other. And the last roll is a
migration role. This role is used to

connect previous version or for SPPA-T2000
and as legacy systems such as SPPA- 80

2002, or tel per MI.. Automation role in
automation server in automation role can

be run on the semantic SLMPC and in an
industrial or industrial P.C.. Other roles

can be run only on industrial PCs. Now
let's talk a little more about each role

and let's start with automation role based
on PLC. PLC I will directly control field

devices like voles and turbine and access
to them in excess numbers. The game

over for any security discussion. They
usually represent low, the lowest level in

different reference models, such as do
model, for example. Any credential, any

configuration changes and updates for PLC
required to stop to stop technological

process. So these devices always have
security misconfiguration, firmware,

visible security updates and secure
industrial protocols. In case of SPPA they

are assembler ??? (Server???) protocols
LCT data. ??? Logic information about its

own protocols in the internet, but not so
much about PLC data protocol. So we had to

deal with it and analyze it ourselves.
It's not a special protocol for SPPA. When

you program your Symantec, PLC an need to
exchange some that some data between them

in real time. You use this protocol. It's
a quite simple protocol and maybe its

description is available somewhere in the
internet. But we couldn't find it. So just

the case show you need structure. In ways
that knows security mechanism in this

protocol, so, so, so only obstacle while
do remain in the middle attack to spool

data in the sequence number, which we can
get from a packet that just follows the

implementation. For practical analyses we
have developed the sector, which is

available at the link below. During the
security assessment of PLC configurations,

one of the main things, which we check, is
unauthorized access to the two reading and

writing PLC memory. Availability of
unauthorized access is determinate by

position of the mod selector of the PLC
and some other configuration parameters.

During the previous research conducted to
one of our colleg Daniel Parnischev???? is

a privilege matrix has been obtained. They
shows unsecure states and configurations

of PLC. The tool for gathering information
from the PLC. over the network and its

analysis has been developed by Danil and
also available in our repository. Now

let's talk about application server based
on industial PC. Its just a Linux box.

During the start it tries to download some
additional files from the application

server. This file includes to include jar
files, the bar scrapes, some configuration

protocols files and some other. You know,
to execute jar files PTC Perc virtual

machine is used. Is it a runtime java
machine widely spread in industrial IJ and

military area. PTC Perc contains a
completion mechanism. So that is all jar

files contains a bitecode transformation.
That's why regularly decompiles Fails

exam. To solve this problem, we have
written a php script to perform reverse

transformation. After that, regular
decompilers have been successful. Running

jars open RMI services on the automation
server and the sound ??? of their

extension. For example, in case of
migration server on PC services, which are

extension of classic Java RMA services are
used and on the slide you can see is the

list of of these services. Just the key
issues of automation. So based on

industrial PCM present represents just
light. Firstly, as you can see, it's there

is a possibility to spoof downloaded files
from application server files downloaded

over https and there are no security
security mechanisms during the process.

Secondly, it's about the default
credentials. You can get access over SSH

SSH to server vs user SAM admin and
password. See him next. It's

vulnerabilities in archives in our around
IPC services. This will not be allowed to

perform sensitive data explosion and
remote code execution. And finally, the

last group with vulnerabilities found in
the software used to feel an immigration

role for communication vs SB 82000, also
known as the DSP system has a number of

issues on the immigration server vs old
TXP. You are not. You are in magic

position. If you wrote about your own
obviously vulnerabilities as they are in

runtime as you need and service as this
service contains request runtime contain a

method where the first argument defines as
the action to be executed. Using the

action read file it is possible to get
content of any file from the system. Using

the right config file it's possible to
write information to the server. To the

server. And for example, it can be a jar
files, which execute shell comand on from

the command line and use in some SPPA
specific functions, you can execute these

jar files later. This is all about
automation server. To sum up, automated

automation server can based on PLC or
industrial PC. In case of PLC it says a

simple PLC is usual PLC with no security
issues. In case of industrial PLC.. it's

just a Linux box., which try to download
some additional files from the application

server and some of them execute with the
virtual machine. So far, we haven't

mentioned any network equipment using
distributed control system Using the

research we saw a wide variety of network
devices and network infrastructure,

including switches, firewalls and more
rare devices such as data diet, for

example. We tried to summarize all this
information and got it common SPPA on

network topology and scam. Lookup shown in
purple usual places for network devices.

By the same device it can be found in
other vendors distributed control system.

Network devices in industrial network
usually have a lot of security issues. The

reason for this is that most of them don't
require any configuration before start and

can be run out of the box. And that's why
the things like get NLP??? and then be

coming in to stream with credentials for
different services. Fill ware? with

publicly, publicly available, exploits and
just a lack of security configurations.

All the things are usual for usual for
network devices and they are usually usual

usual security issues for our industrial
network. I think that's all I know now

Gleb wil sum up our discussion.
repdet: Yep. Yep. So the topic of power

plants is huge. The system is huge and we
try to cover this and that's a lot of

small things in the talk. And in fact
everything can be summed up on this slide.

These those are just the vulnerabilities,
as you can see in the problems in Java, in

Web applications, in different simple
mechanisms that you can exploit actually

directly even not go into the PLC or field
level, field level. You can impact the

process itself. What we don't cover in
this talk, is actually what select

havoc???? or disaster could be caused by
attacking such systems because it's actually

not that bad. I mean they're talking about
things like blackouts of the series or

things like this. This is not what you can
do with as a consensus system, because the

like the distribution of the power power
in the grid is not there according to the

threat model is not the problem of the
power generation. There shouldn't be like

another regulator who should watch for
like enough capacity in the network to

fill this, to fill the electricity for the
customers. So what we're really speaking

here is like the is how we can impact
there. For example, the turbine, the

turbine is itself, for example, but we had
no access to the real turbine. They're

big, expensive, and we haven't found
anyone willing to provide us one. So we

will destroy it. But the point is, we have
an educated guess like PLCs, they control

a lot of parameters of this turbine. And
the turbine is like a big mechanical

monster that is actually self degrading by
working and putting it into different like

incomfortable operating modes will degrade
it even faster or it will break its end.

It's not easy. You can have a spare PLC or
some other device. You won't have a spare

turbine. So that the impact is there. But
it's not like a very huge. So what we

tried to do with this research mostly is
to understand, how we can help the power

plant, the apparatus out there. And we
have to fight in all the issues and

analysing this infrastructures and the
customer sites, we understood that all of

the installations actually did the same.
And we can write a very simple do it

yourself assessment. And hopefully even
like engineers on the power plants can

test themselves. It is very easy. A set of
steps on two or three pages. You connect

to application network, you connect to the
automation network, you run the tests, you

get the results. And afterwards you talk
with Siemens. Well, you can fix something

by yourselves. And basically you don't
have to hire like expensive consultants to

do the job. You should be. You should be
able to do it by yourself. We hope that

you will be able to do it. Of course. To
summarize the whole situation around

DCSSs, it is if you have seen other
industrial solutions like SCADAS, like

substations and if any actually, you would
find a lot of similarities and they the

whole like it will have the same pain
points as all other solutions. There is a

good documents from there. IAC 62443
which describes how like power plant

operator or asset owner should talk to the
system integrator and the vendor. With the

vendor in terms of what security they
should require and how they should control

it. We urge any power plant operator to
read this standards and to require

security from their vendors and system
integrators, because nowadays it depends

from vendor to vendor. Maybe vendor is
more interested in the security or the

plant or some regulator and the like.
Nobody knows how to act. This is the

document where a which describes how you
should talk with all other entities. Of

course, read the slides, read the white
paper in the January. Call Siemens updatal

systems, change your passwords and
configurations. This is actually very easy

to at least to shrink the attack surface.
A lot of things inside SPPS ??? network is

a modern windows boxes and it's kind of
easy to set up some form of monitoring, so

you should talk to your security
operations center. They would be able to

look for some locks, not most of the
impact that we showed, like it was their

input from the java application and
you won't be able to monitor all of these.

We have like security events in windows.
But at least it's still some form of

detection process inside your network. And
again, finally, to summarize, it is not

like a problem of one DCS from Siemens.
There are exactly the same issues for

other vendors not mentioned here. We will
release a lot of things today, tomorrow

and in January. Basically like the big
white paper about everything that we have

found out, we have recommendations, what
to do with the wordlists, with the do it

yourself security assessments with a lot
of tools up. One of the tools would help

you to do the research, another tools
would help you, for example, if you are

using intrusion detection detection
systems like IDSS, you would be able to

parse the protocols and maybe write some
signatures for them. We work closely with

Siemens. We want to say thank you for the
Siemens product search. They did a great

job in communications between us and the
product team that develops the products

that Siemens SPPA team for ??? in
itself. The main outlines from the vendor

response is, that if a power plant
operator, you should hurry and install a

new version 8.2 SP2. There are Siemens
is trying to like educate and raise

awareness outside their customers. That's
first of all, they should change passwords

that there are critical vulnerabilities
and they should do something with it. And

there is not all the problems are fixable by
Siemens themselves. There is an operator

is viable for some of the activities to do
the security by themselves. So that's

actually it. Thank you. Thank you very
much. Thank you, Congress. If you have any

questions, please welcome.

Applause

Herald: Thank all of you for this excellent
talk, we have a short three minutes for

questions. If you have questions, please
line up at the microphones in the hall. If

you're using hearing aids, there is an
induction loop at microphone number three.

Do we have questions from the Internets?
Yes. Question from our signal angel,

please.
Signal-Engel: So we've got a question with

the vulnerabilities found. Could you take
over those cans from the worldwide web cam

without the freedom and the minimum tax?
Herald: Can you please repeat.

repdet: A little bit louder, please?
Signal-Engel: Sorry. With your own

vulnerability found, could you take
control over those plants without worldwide

them from public Internet, without further
amending the ??? ?

repdet: Actually, no. This is and this is
some poor some form of the good news.

Those systems are exclusively supported by
one system integrator, by Siemens. They

are more or less protected from the
external access. Of course, there would be

external access, but it's not that easy to
reach it. And of course, it's we're not

talking about Internet. We're talking
about some corporate networks of things

like this.
Herald: Next question, microphone three,

please.
Mic. 3: Yes, hello. Uh, I also have a

power plant on my planet and, uh, it's
kind of bad for the atmosphere, I figured.

So, uh, my question is, can you skip back
to where the red button is to switch it

off? And I'm asking for a friend.
Laughter, Applause

repdet: As we never thought about that,
these materials can be used in this way.

But yeah. Specifically, if you have an
operator of engineers, friends on the

power plants, you can talk to them.
Herald: Do we have any more questions from

the Internets? No questions. Any questions
from the hall? I guess not. Well, then,

thank you very much for this talk and a
warm round of applause.

Applause

36c3 Postroll music

Subtitles created by c3subtitles.de
in the year 2020. Join, and help us!