Scada Industrial Control Systems Penetration Testing
•Download as PPTX, PDF•
52 likes•18,841 views
Scada Industrial Control Systems Penetration Testing Start from Types of Scada Networks, then Penetration testing, finally what Security should be follow
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Scada Industrial Control Systems Penetration Testing
Similar to Scada Industrial Control Systems Penetration Testing (20)
Recently uploaded
Recently uploaded (20)
Scada Industrial Control Systems Penetration Testing
- 1. PENETRATION TESTING A SCADA INDUSTRIAL CONTROL SYSTEMS By : Yehia Mamdouh
- 2. THIS PRESENTATION WILL LET US KNOW: What is SCADA? What is used For? What the benefits behind using SCADA? SCADA system concept How SCADA Communication Works? SCADA Protocols SCADA Cyber security Types of SCADA Networks Attack Vectors Penetration testing methodology Conclusion
- 3. WHAT IS SCADA CONTROL SYSTEM? * SCADA : Supervisory Control and Data Acquisition. A type of control system can be used to monitor many different kinds of equipment in many different kinds of environments * In General Refers to an industrial control system (ICS)
- 4. WHERE YOU CAN LOCATE SCADA? * Electric power generation, transmission, and distribution * Water and sewage * Buildings, facilities, and environments * Manufacturing * Mass transit * Traffic signals.
- 5. BENEFITS OF SCADA Used For 1-Trasmits individual device status 2- Manages energy consumption by controlling the devices 3- Allowing directly control power system equipment 4- Control chemical plant processes, oil and gas pipelines, electrical generation and transmission equipment, manufacturing facilities...etc. EX: Motors, valves, pumps, relayes, etc. Benefits: 1- Identify and solve problems before they even start. 2- Keep your eye on long-term trends and threats 3- Identify and attack bottlenecks and inefficiencies throughout the enterprise 4- Effectively manage bigger and more complicated processes with a smaller staff.
- 6. SCADA SYSTEM CONCEPT SCADA WorkStation : Human operator it’s a device to issue a command central SCADA console, receiving raw data in human form, also monitor and control HMI: (Human-Machine Interface) It’s Software & Hardware that allows human operator to monitor state of process under control, modify control settings, manually override auto-control operations The interface locate between the human operator and the commands relevant to the SCADA system. (Windows, Linux or Unix)
- 7. SCADA SYSTEM CONCEPT Data Historian: Collect and store information from your mission critical systems, extract and perform accurate analyses (SQL) SCADA Server MTU: (Master terminal unit) is a device that issues the commands to the Remote Terminal Unit (RTUs) which are located at remote places from the control, gathers the required data, stores the information, and process the information and display the information RTU: Connecting to sensors on the process, converting sensors signals and sending digital data to the supervisory systems PLC: Programmable Logic Controller (PLC) automatically performers the main site control process which controls the operation of industrial equipment's. such as control of machinery
- 8. WHO SCADA COMMUNICATIONS WORKS? * The Control Operator or workstation monitor the data and initiates control commands to HMI * HMI which is machines, traditional applications installed on workstations running Windows or Linux and recently use web applications These HMIs speak to the SCADA controlling server *SCADA controlling server collected data from Data historian which is basically a database that the SCADA server pushes data to and in some cases pulls data from * SCADA server sends the appropriate signal to the correct RTU or PLC. * The RTU or PLC consults its pre-programmed logic to determine what it should do with this control signal controls the operation of industrial equipment's *Equipment's EX: Relays, Capacitor banks, Feeder Switches, Actuators
- 9. Temperature Level Pressure Level Oil Level Alarm Radioactivity level HMI (Web Interface) Work Station Data Historian SCADA Server Communication Router Wide Area Network RTU/PLC RTU/PLC ModBus TCP/IP– DNP3 protocols communicate between SCADA server and RTU/PLC System Concept of SCADA
- 10. SCADA PROTOCOL * We have mention that SCADA server send signals to RTU or PLC and vice versa How Can Central SCADA console to receive information from sensors, which are very simple devices? Here is comes SCADA Protocols ! * RTU collects data from sensors and converts the readings into a protocol, such as MODBUS or DNP3, that can be transported across your communications network and back to you DNP3(Distributed Network Protocol) used for communications between master station and RTUs Port 20000 TCP/UDP Modbus is typically used for Supervisory Control and Data Acquisition (SCADA)-style network communication between devices implementations over serial, TCP/IP Standard port 502 TCP DNP3 ModBus
- 12. WHY SECURITY IS IMPORTANT IN CONTROL SYSTEMS? Why? *The ability of cyber intruders to gain access to networked control systems might be easy *More efficient methods of communication = more new risks cause disaster *Control systems share the common vulnerabilities with the traditional information technology *Control systems Recently adopting web technology , Which is interesting target for cyber attacks *Non secure protocols that transmitted data some of them = TCP/IP *Control systems turn on to use Windows , Linux which have known vulnerabilities
- 13. WHY SECURITY IS IMPORTANT IN CONTROL SYSTEMS? * New protocols and communication standards that are providing increased are the same technologies that have been exploited and compromised in the Internet and networking domains Modbus TCP Modbus request packet No authentication no encryption no security Attacks on Field Devices Database Attacks Communications hijacking and ‘Man-in-the-middle’ attacks Vulnerabilities in Common Protocols
- 14. REAL ATTACKS For last years, security risks have been reported in control systems
- 15. Types of SCADA Networks
- 16. TYPES OF SCADA NETWORKS Early or Monolithic SCADA systems *First SCADA systems held all operations in one *Usually a mainframe, computer. There was little control exercised, and most early SCADA functions were limited to monitoring sensors and flagging any operations *Limited to a single plant or facility. Like the software, SCADA hardware from one vendor was rarely usable in another vendor's SCADA system.
- 17. TYPES OF SCADA NETWORKS Distributed SCADA Systems *Shared control functions across multiple smaller (usually PC) computers connected by Local Area Networks (LAN) *Shared Real Time information and often performed small control tasks in addition to alerting operators of possible problems
- 18. TYPES OF SCADA NETWORKS Networked SCADA systems * Current SCADA systems are usually networked * Communicate through Wide Area Networks (WAN) systems, over phone or data lines and often transmit data between nodes through Ethernet or Fiber Optic connections. * Make heavy use of Programmable Logic Controllers (PLC) to monitor and make routine process adjustments, *The hardware tends to be more interchangeable as PLC and other sub-unit vendors have standardized communications and other protocols to allow the user to choose the best component for their needs
- 19. TYPES OF SCADA NETWORKS Internet of Things (IoT) *A data model allows to define the types of data that will be monitored, allows for new types to be added quickly and easily as new smart objects are added to the process *Allows combinations of smart things/objects, sensor network technologies * Communication will bring physical business benefits like high-resolution management of resources and products, better collaboration between enterprises, and improved life-cycle management
- 21. ATTACK VECTORS *SCADA systems are vulnerable to the same threats as any TCP/IP-based system. *SCADA Administrators and Industrial Systems Analysts deceived into thinking that since their industrial networks are on separate systems ,they are safe form outside attacks. *PLCs and RTUs are usually polled by other 3rd party vendor-specific networks and protocols MODBUS4, and DNP, and are usually done over phone lines, leased private frame relay circuits, satellite systems *Security in an industrial network can be compromised in many places along the system and is most easily compromised at the SCADA host or control room level SCADA Attacks How Far?
- 22. ATTACK VECTORS *Denial of Service (DoS) attack to crash the SCADA server leading to shut down condition *Delete system files on the SCADA server (System Downtime and Loss of Operations) *Plant a Trojan and take complete control of system *Log any company-sensitive operational data for personal or competition usage There is Attack Vectors Should be addressed 1- Backdoors and holes in network perimeter 2- Vulnerabilities in common protocols 3- Attacks on Field Devices 4- Database Attacks 5- Communications hijacking and ‘Man-in-the-middle’ attacks ++ Once the corporate network compromised, then any IP-based device or computer system can be accessed. ++ 24/7 provides an opportunity to attack the SCADA host system can cause :
- 23. ATTACK VECTORS 1-Modern networks in the control system arena, often have inherent capabilities that are deployed without sufficient security analysis and can provide access to attackers once they are discovered. 2- Network components, have technologies These technologies often include firewalls, public-facing services, and wireless access. each of these components often does have associated security vulnerabilities 3-Remotely located control system elements that can be accessed via remotely connected communications if systems are based on commercial operating systems, the attacks can be via DDOS, escalated privilege exploits, Trojan horse Backdoors and holes in network perimeter
- 24. ATTACK VECTORS 4- Organizations in many CI/KR sectors provide data to customers, providers, through publicly accessible services. Such as calculating load expectations, billing futures information. As these services are in the public domain, they are often accessible from the Internet with little or no user access limitations 5- Relationship between the firewall and the web server if not deployed right this allows unauthorized, data to flow from the external side to the internal domain. If the attacker compromised the trusted web server, the attacker has a channel to access internal services (or control systems) LAN. Backdoors and holes in network perimeter
- 25. ATTACK VECTORS 1- Microsoft XP, a platform commonly used in control systems, mitigates the security issues 2- Control systems and modern networking technologies comes some inherited security vulnerabilities. Even though many of these vulnerabilities have solutions and available workarounds, the deployment of these mitigations in control systems architectures is not always feasible. Attacks Using Common Protocols
- 26. ATTACK VECTORS 1-Control systems architectures usually have a capability for remote access to terminal end points and devices in number of ways including by telephonic or dedicated means. To provide for the collection of operational and maintenance data 2-Modern equipment has embedded file servers and web servers to facilitate robust communications these devices are part of an internal and trusted domain, and thus access into these devices can provide an attacker with an unauthorized vector into the control system architecture. 3-RTUs, are an extension of the control domain, attackers can add these field devices to their list of viable targets to be investigated during reconnaissance and scanning phases of the attack. 3-If a device is compromised, and the attacker can leverage control over the device and escalate privileges Attack into control system via field devices
- 27. ATTACK VECTORS 1-Database applications have become core application components of control systems and their associated record keeping utilities 2-Databases used by control systems are often connected to databases located on the business network and most use (SQL). The information contained in databases makes them high-value targets for any attacker 3-Attackers can exploit the communications channel between the two networks and bypass the security mechanisms used to protect the control system environment 4-The effect of corrupted database content can impact data acquisition servers, historians, and even the operator HMI console. Control systems databases because they are so reliant on data accuracy and integrity. Database and SQL data injection attacks
- 28. ATTACK VECTORS 1- The ability for an attacker to re-route data that is in transit on a network, the ability to capture and analyze critical traffic that is in plaintext format, and the ability toreverse engineer any unique protocols to gain command over control communications 2- By combining all of these MITM, attack is executed 3- As the attack is on the control domain, this plaintext traffic can be harvested (sniffed) and taken offline for analysis and review 4-Using ARP poisoning and collecting traffic, the attacker can establish and maintain complete control over the communications in the network , preventing the HMI from issuing alarms 5- MTM can be between HMI and RTU due to week protocol that are used like Modbus Man-in-the-middle attacks
- 30. PENETRATION TESTING METHODOLOGY Penetration Testing Methodology we use in Control systems it like Normal Network Penetration Testing How? * We are dealing With Devices - Operating systems (windows , Linux ) – Protocols over TCP –Application and SQL Databases – Firewalls Audit identification Devices and networks: Router configs, router tables, switch tables, physical cable checks, packet sniffing Services Local Port verification (nestate) Vulnerabilities Local banner grabbing Perimeter Identify all external connections *Review firewall rules *Review remote access methods *Check for wireless networks *Check physical access
- 31. PENETRATION TESTING METHODOLOGY Penetration Testing Methodology we use in Control systems it like Normal Network Penetration Testing How? Network Infrastructure Review router configs Review switch tables Conduct physical cable checks Conduct packet sniffing and analysis Host operating systems Review patch level Review password quality Review share and directory permissions Review remote access Applications Review ports and services Review OS credentials Revives remote access Consider code review PLCs, RTU,s ..etc. Review patch levels Review password quality Conduct packet sniffing
- 32. PENETRATION TESTING METHODOLOGY Scanning / Discovery Some tools are Available Like plcscan - Scans Modbus device Modescan - Scans Modbus devices Nmap ( Be carful single Nmap scan can crush system) Metasploit Modules for Modbus detection *Most PLCs (Communication Modules) have no ability to filter based on source IP address So we Can Use python scripts or John the Ripper for crack Bruteforce PLC online Scan supported devices and stations change name of stations change IP, Netmask, gateway request full network info
- 33. PENETRATION TESTING METHODOLOGY Analyze protocols How protocols live in the network? Not blocked by firewalls/switches Accessible between Lan segments Works form data link layer to application layer Easy to detect Easy to analyze So we Can Available Tools detect devices and their protocols monitor state, commands inject, modify reply packets in real times Sniffing Traffic Wireshark tcpdump python hex viewer
- 34. PENETRATION TESTING METHODOLOGY Analyze protocols Modbus Using the web is the often the easiest way 80% of Modbus/TCP devices have web interfaces Other research shows most devices run Windows 2k DNP3 *Has source and destination addresses that can be useful in Man-in the-Middle attacks Such as 1-Turn off unsolicited reporting to stifle alarms 2- Issue unauthorized stops, restart, or other functions that could disrupt specific operations *Implementations typically do not employ encryption, authentication and authorization; DNP3 devices simply assume that all messages are valid
- 35. PENETRATION TESTING METHODOLOGY Analyze protocols DNP3 Passive Network Reconnaissance With appropriate access captures and analyzes DNP3 messages. This provides the information about network topology, device functionality, Rogue Test Installs a “man-in-the-middle” device between the master and outstations that can read, modify and fabricate DNP3 messages and/or network traffic memory addresses and other data Other attacks on Data Link and Application Layer
- 36. PENETRATION TESTING METHODOLOGY Data Manipulation Available Tools Web Application Test and SQL Injection *As Scada Use Web application On HMI and SQL in Database we can test them for possible Vulnerabilities Modlib - Scapy extention [python] OpenDNP3 - Library [C++] Metasploit Modules
- 37. Conclusion
- 38. SCADA SECURITY Creating Demilitarized Zones (DMZs) Multiple DMZs could also be created for separate functionalities and access privileges, such as peer connections, the data historian, the Inter Control Center Communications Protocol (ICCP) server in SCADA systems Firewalls properly configured and coordinated, can protect passwords, IP addresses, files and more Proxy Servers Proxy server is an internet server that acts as a firewall, mediating traffic between a protected network and the internet The Security Policy Effective security policies and procedures are the first step to a secure control systems network. Many of the same policies Security Training Provide The staff that work in the facility Security Tanning very essential for preventing Physical and Social Engineering Attacks
- 39. SCADA SECURITY 1- Identify all connections to SCADA networks 2- Disconnect unnecessary connections to the SCADA network 3- Removing or Disable unnecessary services 4- Implement internal and external IDS and establish 24-hour incident monitoring 5- Conduct Physical security surveys and assess all remote sites connected to the SCADA network to evaluate their security 6- Clearly define cyber security roles, responsibilities and authorities for managers, system administrators and users 7- Document network architecture and identify systems that serve critical function that require additional levels of protection