Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 59 views

    US 13 Apa Compromising Industrial Facilities From 40 Miles Away Slides

    Uploaded by

    wifeharo
    This document summarizes a presentation on compromising industrial facilities from 40 miles away. It discusses how critical infrastructures have become targets and how industrial wireless devices are increasingly connected to the internet. It then examines the wireless standards, encryption methods, and key distribution processes used by three major vendors of industrial wireless devices. Specific exploits are described against the commissioning tools and encryption schemes of Vendors 1 and 2. The presenters were able to determine hardcoded encryption keys and extract keys from project files. While encryption was not able to be broken for Vendor 3's "perfect scheme" of using a per-site encryption key, weaknesses were still identified in other vendors' approaches.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    US 13 Apa Compromising Industrial Facilities From 40 Miles Away Slides

    Uploaded by

    wifeharo
    59 views53 pages
    This document summarizes a presentation on compromising industrial facilities from 40 miles away. It discusses how critical infrastructures have become targets and how industrial wireless devices are increasingly connected to the internet. It then examines the wireless standards, encryption methods, and key distribution processes used by three major vendors of industrial wireless devices. Specific exploits are described against the commissioning tools and encryption schemes of Vendors 1 and 2. The presenters were able to determine hardcoded encryption keys and extract keys from project files. While encryption was not able to be broken for Vendor 3's "perfect scheme" of using a per-site encryption key, weaknesses were still identified in other vendors' approaches.

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document summarizes a presentation on compromising industrial facilities from 40 miles away. It discusses how critical infrastructures have become targets and how industrial wireless devices are increasingly connected to the internet. It then examines the wireless standards, encryption methods, and key distribution processes used by three major vendors of industrial wireless devices. Specific exploits are described against the commissioning tools and encryption schemes of Vendors 1 and 2. The presenters were able to determine hardcoded encryption keys and extract keys from project files. While encryption was not able to be broken for Vendor 3's "perfect scheme" of using a per-site encryption key, weaknesses were still identified in other vendors' approaches.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    59 views53 pages

    US 13 Apa Compromising Industrial Facilities From 40 Miles Away Slides

    Uploaded by

    wifeharo
    This document summarizes a presentation on compromising industrial facilities from 40 miles away. It discusses how critical infrastructures have become targets and how industrial wireless devices are increasingly connected to the internet. It then examines the wireless standards, encryption methods, and key distribution processes used by three major vendors of industrial wireless devices. Specific exploits are described against the commissioning tools and encryption schemes of Vendors 1 and 2. The presenters were able to determine hardcoded encryption keys and extract keys from project files. While encryption was not able to be broken for Vendor 3's "perfect scheme" of using a per-site encryption key, weaknesses were still identified in other vendors' approaches.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 53

    COMPROMISING INDUSTRIAL FACILITIES FROM 40 MILES AWAY

    Lucas Apa Carlos Mario Penagos

    About Us
    Lucas Apa
    Vulnerability Research Exploitation Cryptography Reverse Engineering ICS/SCADA
    Argentina Colombia

    Carlos Penagos

    Agenda
    Motivation Industries and Applications Wireless Standards Journey of Radio Encryption Keys Vendor1 Wireless Devices Vendor2 Wireless Devices Vendor3 Wireless Devices

    Motivation
    Critical Infrastructures becoming targets Insider attacks (Lately)
    Devices connected to Internet 0days to reach the PLC, RTU, HMI

    Stealth and precise attacks Incident response at hazardous sites

    Industrial Wireless Automation


    Copper wires are used to monitor and control
    Corrosion, Ductility, Thermal Conductivity Cost of wires, trenching, mounting and installation

    Industrial Wireless Solutions


    Eliminate cost of hardwiring, logistics, installation Heavy machinery involved Remote control and administration (Geography) Minimize Safety Risk & Dangerous Boxes Adds durability

    Industries and Applications


    Plunger lift/artificial lift optimization Well-head automation RTU/EFM I/O extensions Cathodic protection monitoring Hydrogen sulfide (H2S) monitoring

    Oil & Gas

    Refined Petroleum Petrochemicals


    6

    Tank level monitoring Pipeline cathodic protection Rectifier voltage monitoring Gas/liquid flow measurement Pipeline pressure and valve monitoring

    Industries and Applications (2)


    Transformer temperature Natural gas flow Power outage reporting Capacitor bank control kV, Amp, MW, MVAR reading

    Energy - Utilities

    Remote pumping stations Water treatment plants Water distribution systems Wastewater/sewer collection systems
    Waste & Waste Water
    7

    Water irrigation systems/agriculture

    Industrial Wireless Challenges


    Defeat electromagnetic interference (EMI) Handle signal attenuation and reflections Reliability is far more important than Speed Higher transmitter power levels Site surveys to assess the consistency and reliability of the plant Mainly using 2.4Ghz or 900Mhz (ISM Band) No business protocols

    Cryptographic Key Distribution (WSN)


    Distribute secrets on a large number of nodes Base stations with clusters surrounding Limitations: Deployment in public or hostile locations Post-deployment knowledge Limited bandwidth and transmission power Methods for crypto key distribution: Out-of-band In-band Factory pre-loaded
    9

    IEEE 802.15.4 Standard


    Wireless Radios (Low Power/Speed) Set the encryption algorithm and AES Key Upper Layer Responsibility Each node can have an ACL MAC for upper layers:
    ZigBee WirelessHart ISA SP100 IETF IPv6 - LoWPAN

    10

    ZigBee 2007 (Standard Security Mode)


    Suite of high level communication protocols Based on IEEE 802.15.4 (Low level layers) ISM radio bands Trust Center introduced in 2007 Trust
    Center

    Network Key (AES 128-bit)


    Key Pre-installed (Factory Installed) Two Distribution Mechanisms: Individually Commissioned A (Commissioning tool) 1. Pre-Installation 2.Managed bythe the Trust Over air Center

    11

    ZigBee Pro 2007 (High Security Mode)


    Many enhancements More memory requirements New keys introduced

    Master Key Unsecured Transport Out-of-band Technique Secure other keys Link Key Unicast Unique between nodes Network Key Regenerated at Intervals Needed to join the NWK

    Trust Center

    MasterKey_TA LinkKey TA NetworkKey MasterKey_TB LinkKey TB

    A
    MasterKey_TA LinkKey TA NetworkKey MasterKey_AB LinkKey AB

    B
    MasterKey_TB LinkKey TB NetworkKey MasterKey_AB LinkKey AB

    12

    The Journey of Radio Encryption Keys


    R i a o d D v c e i e
    E U r n s d e
    13

    DeviceVendorID Key in Firmware

    No Encryption Key

    Per-Client Encryption Key

    Device Company Encryption Key

    No Encryption Key

    Change Encryption Key

    Per-Client Encryption Key

    Device Company Encryption Key

    Change Encryption Key

    Set Encryption Key

    No Encryption key

    Reusing Radio Keys


    End-User Node Key Storage
    Shared Secret Same Firmware or Same Radio Key

    Device Company Key attack


    1. 2. 3. 4. 5. Buy same Device (Buy same Key) Remove Radio Module Connect to USB Interface Interact: API & AT Command Mode Send frames using the unknown key

    Warning: Not possible if exists a Per-Client Encryption Key


    14

    Exploiting Vendor1 Devices


    Company Profile (+1990) Frequency Hopping Wireless Devices
    Great for long or short range wireless SCADA applications Secure proprietary FHSS with 128 bit AES encryption Hazardous location approvals, Perfect for outdoor Ethernet SCADA or indoor PLC messaging 30+ miles point to point with high gain antennas
    15

    Vendor1 Key Distribution


    <Vendor1 Tool> is easy to use and intuitive. Default values built into the software work well for initial installation and testing making it easy for first-time users. <Vendor1 Tool> manages all important settings to ensure that the network performs correctly. (User Guide)

    RF Encryption: A 128-bit encryption level key is suggested for the user.


    Blank: No encrypted packets

    16

    5-7 Chars: Field is translated into a 40-bit encryption level.


    15-24 Chars: Field is translated into a 128-bit encryption level.

    Reversing Passphrase Generation


    Compiled C++ Binary: srand seeds PRNG time returns epoch srand(time(NULL)) Low Entropy Seed Same algorithm rand() Bad ANSI C function
    17

    Attacking Weak PRNG

    C:\>passgen.exe 2013-04-04 21:39:08 => 1365136748 => knc6gadr40565d3j8hbrs6o0

    18

    The Oldest Passphrase


    Help File

    C:\>passgen.exe 2013-04-04 21:39:08 => 1365136748 => knc6gadr40565d3j8hbrs6o0 2013-04-04 21:39:07 => 1365136747 => nir3f1a0dm2sdt41q91c06nt 2008-04-17 15:20:47 => 1208470847 => re84q92vssgd671pd2smj8ig
    19

    Comissioning Tool Audit


    Bruteforce Passphrase
    2570 Passphrases
    Mixed lower case alphabet plus numbers and common symbols Impossible to calculate all passphrases Need to derive AES 128-bit key on realtime

    Weak PRNG Attack

    vs

    ~156 Million Passphrases


    Every second passed, one more key Only a few seconds to calculate all passphrases Calculate once and create a database with all possible AES 128-bit key derivations

    Easily breakable by an outsider Further Research with the Devices Comissioning Tools needs deep testing
    20

    Vendor2 Wireless Devices


    Market leadership: Oil & Gas Wireless and wired solutions for the digital oil field automation Trusted by top companies in different industries Family System (Point to Multipoint):
    Wireless Gateways Wireless Transmitters I/O Expansion Modules Hardwire Sensors

    21

    22

    An Extended Family of Devices

    Applications
    Oil & Gas Refining / Petro Chemicals Water & Waste Water Utilities Industrial Process Monitoring


    23

    Transmitters
    RTD Temperature Transmitter Analog/Discrete Transmitter Flow Totalizer Transmitter Pressure Transmitter Hydrostatic Level Transmitter Many more..

    PLC RF Modem RTU

    SCADA
    DCS HMI EFM

    24

    Tool and Project Files


    How the devices access the wireless information?

    Enhanced Site Security Key


    The Enhanced Site Security feature designed to provide an additional level of protection for RF packets sent and received between <Vendor2> devices and minimizes the possibility of interference from other devices in this area. This feature is not available on some older versions of legacy devices.

    Security Key == Encryption Key ???


    Legacy Devices Without Encryption???

    25

    Key Generation and Distribution


    Create a Project File and update all Nodes

    From documentation: If the project file name is changed, a new Site Security Key will be assigned Possible Scheme: Per-Site Encryption
    This Key MUST be somewhere on the Project File.

    26

    File Name Change => New Key

    27

    Project File Binary Diffing


    ProjectA
    \x17\x58\x4f\x51
    1364154391 Sun, 24 Mar 2013 19:46:31 GMT

    ProjectB
    \x51\x58\x4f\x51
    1364154449 Sun, 24 Mar 2013 19:47:29 GMT

    28

    Component Identification
    Support Center

    Firmware Images & Documentation


    Radio Modules, Architectures & Processors

    RISC
    29

    Understanding Firmware Image (RISC)


    Industry Standard Format

    @Address and content


    Incomplete Image (Update) Only compiler strings

    CrossWorks for MSP430

    Component Identification

    430F14 9

    YouTube (XT09 and 802.15.4)

    32

    No Per-Client Key
    Dear <<Reseller Sales Eng>>, We are going to borrow a used Analog Transmitter from one of our partners, We are going to test it for a few weeks and let you know if we decide to buy a new one. Are there any specific concern we might take into account when deploying this device to connect it with our <Device>? Or just upgrade all project configuration files? Thank you
    Lucas, You just need to upgrade the configuration files. Thanks.

    33

    Finding Embedded Keys


    Two kind of Firmwares (ARM and MSP430)
    One possible hardcoded key in both firmwares Binary Equaling

    34

    Acquiring the Devices


    RTD Temperature Transmitter
    Integrates Platinum 100 ohm RTD Sensor Ideal for use in various mission-critical industrial applications. Ideal for Monitoring Air, Gas, Water, or Liquid Temperatures

    Wireless Gateway
    Gateways are responsible for receiving/collecting data from wireless end nodes

    The collected data can be communicated with third-party Modbus device such as a RTU, PLC, EFM, HMI, or DCS

    35

    Resilience and Node Capture


    Tx
    Gateway

    Tx
    Stolen Node

    Tx

    S e r i a l

    Extraction
    Site Security Key
    Project File

    C a p t u r e

    FF 41 0A 00 0A 00 00 00 04 00 AB D0 9A 51 B0 ...

    36

    A crypto attack disappointment


    Protocol Reverse Engineering
    Device has a debug interface Developed a custom tool to receive and send 802.15.4 data
    2.4ghz Transceiver (Modified Firmware and Reflashed by JTAG)

    PyUsb, IPython, Scapy Dissectors, etc.


    Borrowed KillerBee Frame Check Sequence Code Key not really used for data encryption

    Against the perfect scheme: Per-Site Encryption Key

    Key only used to authenticate devices


    No integrity and confidentiality

    37

    Temperature Injection Live Demo


    Developed an HMI Project Chemical Safety Board (US) background video Modbus RTU Driver Arduino and SimpleModbus Rotary Actuator Cost of the attack: $40 USD Live Demo

    38

    KEEP CALM AND GET TO THE CHOPPA!

    Remote Memory Corruption


    Identify all the protocol fields Memory corruption bug using unhandled values. Remotely exploitable over the air Plant Killer =>

    Also could be useful to dump firmware or memory. We recorded a demo

    40

    PLC RF Modem RTU

    SCADA
    DCS HMI EFM

    41

    Vendor3 Devices
    Company Profile
    Self-proclaimed leader in process and industrial automation Clients: Nearly all manufacturing companies from Fortune 500 22.000 different products across 40 industries

    Wireless System (Family) Wireless Gateway


    Master device used to control network timing and comm traffic Collect data -> TX Gateway

    Nodes

    42

    Research
    Wireless Family Technical Note: Multi-layer security protocol protects your data
    Network Security Data Security Data Integrity and Control Reliability The wireless I/O systems provide a level of security, data integrity, and reliability far exceeding most wireless systems on the market today

    44

    Quotes (Network Security)


    <Family> is designed to completely eliminate all Internet Protocol (IP) based security threats. Wi-Fi access points have the potential to route any and all data packets, which is why these systems use encryption

    45

    Quotes (Data Security)


    The protocol only carries sensor data values. Only I/O data is transmitted in the wireless layer.

    46

    Quotes (Comm Protocols)


    Widely used open protocols such as Wi-Fi have serious security issues. Even a high degree of encryption may not protect your data. It is common for new encryption schemes to be hacked within months of implementation. Proprietary systems are more difficult to hack than an open standard.
    47

    Quotes (Comm Protocols)


    <Vendor3> achieves data security by using a proprietary protocol, pseudo-random frequency hopping, and generic data transfer. The <Family> protocol only carries I/O data, making it impossible for a malicious executable file to be transmitted.

    48

    Quotes (Comm Protocols)


    This protocol does not operate like an open protocol such as Wi-Fi and is not subject to the risks of an open protocol.

    49

    Conclusions (Securing the scheme)


    Out of bands methods
    Pre-share a strong secret for the initial link (eg: serial comm) Also 802.15.4 AES Encryption at lower layers (MAC)

    Secure the Node Physical Access (Mainly KDC) Use hardware Anti-tamper mechanisms Audit Source Code // Audit Site regularly ICS-CERT Hardening Guides

    50

    Conclusions
    Problem space has always been an open topic The journey of keys allows practical attacks WSNs standards maturity is growing Vendors can fail at implementing them No evidence of previous security reviews Testing the field location is possible with the proper Hardware and open source Software

    CC1111
    51

    RZUSB

    TelosB

    HackRF

    Aknowledgements
    ICS/CERT US/CERT References: Piotr Szcezechowiak, Haowen Chan, A. Perrig, Seyit A. Camtepe, Bulent Yener, Rob Havelt, Travis Goodspeed, Joshua Wright IOActive, Inc.

    52

    THANK YOU !
    Lucas Apa (lucas.apa@ioactive.com) Carlos Penagos (carlos.hollman@ioactive.com)

    You might also like