Krypt3ia

(Greek: κρυπτεία / krupteía, from κρυπτός / kruptós, “hidden, secret things”)

Archive for the ‘SCADA’ Category

ASSESSMENT: OSINT Reconnaissance of Power Systems

with 5 comments

Screenshot from 2014-01-09 14:09:34

Power Systems, Dams, Grids & The Internet:

Since the attack on the Natanz plant the acronym SCADA Supervisory Control and Data Acquisition Systems have been in the news as the next greatest threat to us all. Of course if you listen to the bulk of what people are saying out there in the news media you might be missing some salient points on just how vulnerable we all may be and not so much because someone is going to upload malware to a system in an “air gap” somewhere in Tehran. The fact is I now understand just how vulnerable we may be and most of the problem isn’t going to be some exotic string of ones and zero’s, but instead it will be due to a lack of OPSEC. Of course this report does not mean that there will be a cascade attack that will knock out power to the United States like some far fetched Discovery cable show. Instead this report is just a slice of what was discovered in a few hours of searching with Google and should give you an idea of just how available data that could be misused is out there. My intent here is to scare people nor is it (completely) to shame people but I find that in today’s news cycle much of the real truth to things gets cut out for smaller and sexier soundbytes.

OSINT Reconnaissance:

My reconnaissance tools were just a browser, my brain, and a bit of time. I used Google Fu to look up certain key words and phrases to seek out systems sharing out data that perhaps they were unaware of. In the case of all of the pictures below, these items were open to anyone who looked for them. There was no bypassing any kind of authentication here whatsoever, all you had to do was click and wait for the system to deliver the data and therein lies the biggest problem. In one case (data not shown here) I was able to locate a user online with not only diagrams but also SCADA passwords and ID’s in an excel sheet. That user was called and told that they were sharing and they took it offline (thanks to those who used their GV numbers and made calls anonymously, you know who you are…) and I am sure was more than a little freaked out after the call was all said and done.

Screenshot from 2014-01-09 13:25:38

Hydroelectric DAM SCADA

Screenshot from 2014-01-09 14:17:27

Gas Leaks & Repairs Sheet

Screenshot from 2014-01-09 14:27:42

SCADA DIAG Hydroelectric DAM

Screenshot from 2014-01-09 14:28:37

SCADA DATA & Connection + CDR’s

Screenshot from 2014-01-09 14:34:15

Live Diagram of Circuit to Substation

Screenshot from 2014-01-09 14:35:35

Another Live Diagram to Substation

Screenshot from 2014-01-09 14:38:53Diagram for Substation

Screenshot from 2014-01-09 14:41:42GAS Pipeline Maps Northeast

Screenshot from 2014-01-09 14:51:26

Full Diagrams for Electric Fencing and Facilities for Power Station (Southeast)

As you can see there is a lot out there and remember that an aggressive and determined individual or group could in fact collect quite a bit of data not only from the government sites but also the companies that run the grid, or the gas, or the water systems. Once again though, all of this data does not mean that there will be an epic “Fire Sale” from these data leaks. It does however make you wonder just how many people and entities (corps) lack such basic OPSEC as to allow these things to be placed out in the open for anyone looking for them to have. I will be widening the scope and working with the same individuals in the background to connect with the more egregious offenders and insure their data is no longer out there for the taking but my main goal here is to sound the warning.

The internet of things… Is full of “stuff” too.

ANALYSIS:

If an adversary were looking to have a cascade effect attack like that postulated by the Chinese student then their first task would be to carry out reconnaissance on the power systems of the country they wish to attack. In the case of the US let’s say, it is easy enough to look up the Wiki on all of the companies here neatly listed out with their domains. Once you have this you can spider out and carry out the OSINT on all of them. Technically as well as logically, you can carry out the intelligence gathering on employees, systems, and overall target hardness just with Google. This is not really elucidated very often when you see these things in the news or you hear the president speak about the threats to the “grid” Of course now I want you all to realize that the threat is not only the Chinese Green Army or PLA warrior at the end of the keyboard but instead YOU Mr. plant manager with a shared out hard drive in your new Macbook.

So the extrapolation to make is that it’s not the end of the world but it is a problem. In fact, it could be pretty bad for certain places were this data to be used by the wrong people. Now do I think that the Chinese and others already have this data? Well the answer to that is yes, I do believe that since this stuff has been sitting around so long in directories open to the internet anyone with a plan probably has run a script and scraped all that data at some point. Will it be used in some massive attack? I don’t really think so necessarily. My reasoning here is that to really do it well it would have to be nation state and that state would have to be pretty crazy to have a fire sale given our interconnectedness today globally. Of course that doesn’t stop someone like the Kim Jun Un’s of the world from trying to go all Bloefeld on us all from some lair with sharks though.

Here’s the overall takeaway: People do stupid things. People who are not trained to think about their data security and access do doubly stupid things. So when you hear the government next time talking about how insecure our networks are and how the grid could be taken out by a foreign power who already have backdoors in our systems, just remember that much of that probably was easily obtainable through recon and OSINT use…

K.

Written by Krypt3ia

2014/01/09 at 21:08

Posted in .gov, GRIDSEC, ICS, OPSEC, SCADA

Well, if Cyberwar means controlling the temps at a mall in Fresno, then we have a problem…

with 3 comments

So, You Wanna Be Zer0C00l?

I was made aware of a pastebin alleged to be from Anonymous/AntiSec sourcing about 49 IP addresses that had SCADA systems on them. Furthermore those said systems were claimed to not have any authentication on them whatsoever. To quote Anonymous/AntiSec;

@ntisec Exposes Amerikan #SCADA systems #fulldisclosure

The world has been warned enough, and corperate power has done nothing. People are at risk. We all need to be made aware of
our infrastructure lacking normal forms of safety procedures.

Hackers are targetting #SCADA this year and we have to do something about it.!

So here we go.

Please take some Screenshots and show them to me on @twitter @ntisec.
Be carefull and dont cause rampant anarchy. They might trace you and I have warned you not to alter control states. Just have a look around
To see 4 yourself how these systems affect our everyday life.

Maybe its time politics pointed their attention to bigger problems then #SOPA #PIPA etc.
Trying to regulate the last freedom, will cause uprising and dangerous cyber threats.
As our financial state gets worse and the smart IT and SEC workers have nothing to da
they will at least cause mayhem against what in our view is injustice.
Arresting and kidnapping foreign people for spreading bandwith? #OPMEGAUPLOAD?
Go try and fix your infrastructure first. Its wide open to legally expose and enter your
buildings. Like urban exploring from behind my PC.

Locking up Bradley manning? Better be carefull a hacker does not open his jaildoors 4fun!

Dont even need an exploit to get in here. Dont even have to be a hacker. No passwords what so ever.

So how is the state of your other #SCADA systems like your electrical grid? Or trafic management?
What about chemical industry? Or can hackers swich some stuf that sends trains to another fail?

That pump you saw a while back is just the first sign af being infiltrated.

It can be your vent system, a cooky factory up to a switch that switches of an entire country and economy.

These systems where found through google and shodanHQ by using the search term:

I took the IP’s and checked them all and indeed many were HVAC or other systems belonging to a range of churches, a mall, and some other businesses across the country that were in fact online without any authentication mechanism whatsoever. The first IP in fact in the list was a demo system a company was using to sell their services in the SCADA arena, so overall, I have to say “meh” on this little dump by the skiddies.

I also have to take them to task for crying wolf a bit here. See, when you dump SCADA systems and compare the issues to OPMegaupload etc, you really should in fact be presenting something that people should worry about. Frankly, if anyone can control the heat at a mall, I say ho hum. However, if you present me with a hospital or a power plant, THEN you have something to wield as leverage to make an argument kids.

You failed once again.

Who is doing your recon out there? Really, you wasted your own time as well as mine (well I do enjoy these posts and looking into these things) looking at these systems. Sure, they could be a nuisance and yes, they do make a point (basically don’t put this stuff online without authentication.. If online at all) but this is not an earth shattering and scary finding.

Shodan, A Wonderous Tool For Mischief and Education

Ok, so now you guys have found Shodan and you know how to look for SCADA (at least this type: ord?) but really, Shodan has been around quite a while now and those in the know have been messing about with it as well. The security wonks out there have been beating on people quite a bit (S4 recently releasing new findings on SCADA systems without pre-warning the companies that they found the vulns in) so really, what have you done here?

Again the comment that comes to my mind is the title of this piece: “Well, if Cyberwar means controlling the temps at a mall in Fresno, then we have a problem…” Personally, until someone comes along with a pastebin list of important infrastructure systems that are unprotected and available to attack, I will pretty much say the same thing..

“ho hum”

Of course if you all out there are mapping things like say H.D. Moore with his latest on video conference systems, and you are in fact archiving it on pastebin or in blog posts, then you are in fact perhaps doing something interesting.

This stuff though Anon/AntiSec is just showing your lack of understanding of the issues you think you are being ever so clever about.

SCADA CYBERWAR! (Eh, not so much)

Meanwhile, the press does not seem to have caught on to this little paste dump whereas many folks grabbed right on the Israeli dump earlier. I guess its just not as sexy as “Middle East Cyber War” as some put it on the net. I am willing to bet soon enough though someone else will pick up on this dump and think that there’s a story in there that they can pimp.

Let me be clear to you reporters and media… There’s a case to be made that people need to learn about this technology and how to secure it… But… This stuff plunked down by the skiddies just isn’t it.. This story does not have legs.

As for the Anon’s.. Hey ZER0C00l, this little stunt was lame… Time to go back to fighting Ac1dBurn over a rinky dink television cart system…

So, on we plod.. Show me the real infrastructure and I will say you have done something…

Until then.. Just go use the LOIC somewhere and wait for the cops to show up.

K.

Written by Krypt3ia

2012/01/24 at 18:17

Posted in SCADA

INFOPOCALYPSE: You Can Lead The World To The Security Trough.. But You Can’t Make Them Think.

leave a comment »

“Dark, profound it was, and cloudy, so that though I fixed my sight on the bottom I did not discern anything there”

(Dante Alighieri; The Inferno)

The current state of the Security “Industry”

It seems that once again people who I have acquaintance with in the security industry are wondering just how to interface with corporations and governments in order to build a base of comprehension about the need for information security. The problems though are myriad with these questions and the task to reach people can be a daunting one, never mind when you have groups of them in hierarchies that comprise some of the worst group think in the world (AKA corporations)

Added issues for the “industry” also surround the fact that it is one at all. Once something moves from an avocation to a profession, you have the high chance of it becoming industrialised. By saying something has been made industrialised, implies to many, the cookie cutter Henry Ford model really. In the security world, we have seen this from the perspective of magic boxes that promise to negate security vulnerabilities as well as teams of consultants who will “securitize” the company that is hiring them with magic tools and wizardry. The net effect here is that those paying for and buying into such products and services may as well be buying a handful of magic beans instead.

Now, not every company will be efficacious in their assessments nor live up to the promises they make for their hardware/software solutions. Many practitioners out there and companies really try to do the right thing and do so pretty well. However, just as in any other business, there are charlatans and a wide range of skilled and unskilled plying their arts as well. Frankly, all that can be said on this issue is “Caveat Emptor”  It’s a crap shoot really when it comes to goods and services for security solutions. The key is though, to be able to secure yourselves as a company/entity from the standpoint of BASIC security tenets up.

Often its the simple things that allow for complete compromise.. Not just some exotic 0day.

So we have a cacophony of companies out there vying for people’s dollars as well as a news cycle filled with FUD that, in some cases are directly lifted from the white papers or interviews with key players from those said same companies seeking dollars. It is all this white noise that some now, are lamenting and wondering just how do we reign things in and get a stable base to work from in an ethical way to protect companies and individuals from information security meltdowns. More so it seems lately, the question has been how do we reach these people in the first place? How do we actually get a meaningful dialogue with the corporate masters and have them come away with the fundamentals of security as being “important”

Unfortunately, I think that there are some major psychological and sociological hurdles to overcome to reach that point where we can evince the response we all would like to see out of those C level execs. I have written about them before, but I will touch on them again later in this piece. Suffice to say, we all have a tough row to hoe where this is concerned, so, I expect there to be no easy answer… Nor really, any satisfactory conclusions either.

“It is a tale Told by an idiot, full of sound and fury, Signifying nothing”

(Shakespeare; MacBeth)

Security Joan of Arc’s and their Security Crusade:

Joan De Arc was a woman ahead of her time. She wore men’s clothing and lead the French in battle against the English and to victory, all as a teen girl. She later was burned at the steak for heresy and just recently made a saint many years later. I give you this little history lesson (link included) to give you an idea of who you all are in the security industry lamenting over not being listened to. You too may be ahead of your time, but, just as she was, you too will not be listened to because your ideas (to the listeners) are “radical”

Now, radical is a term I am using to denote how the corporate types are seeing it. We, the security advocates, do not see these concepts as radical, but instead as common everyday things that should be practices (complex passwords, patching effectively, etc) They (the client) see these things as impediments to their daily lives, their bottom lines, and their agenda’s both personal and corporate. There are many players here, and all of them have agenda’s of their own. This is a truism that you must accept and understand before you rail against the system that is not listening to your advice.

Here’s a bit of a secret for you.. The more ardent you seem, the more likely you will be branded a “Joan” The perception will be that you are a heretic and should not be listened to. Instead you should be marginalised in favour of the status quo.. After all, they have gone about their business every day for years and they are just fine! The more you rail, or warn with dire tones, the more you will be placed at the back of the mind.

Think Richard Clarke (I heard that chuckle out there)

Though Joan inspired the French forces to battle on and win more than a few battles, she eventually was burned at the steak. Much of this was because of her unique nature and fervour. Much as yours may do the same to you… Without of course literally being burned at the steak and you all must learn this. I think you have to take a page from the hackers playbook really and use the axiom of being a “Ninja”

The subtle knife wins the battle.

 

“If the Apocalypse comes, beep me”

(Joss Whedon;Buffy the Vampire Slayer)

What’s the worst that could happen really?

The quote above really made me chuckle in thinking about this article and the problems surrounding the premise. This I think, is the epitome of some people’s attitudes on security. Most folks just go along their days oblivious to the basic security measures that we would like them to practice as security evangelists. The simple fact is that like other apocalypse scenarios, people just have not lived through them and been affected by them to change their behaviours accordingly. What solidified this for me recently was the snow storm last October here in New England that caught so many people flat footed. They simply had not ever really had to rely on their wits and whatever they had on hand before like this. When the government and the corporations (CL&P) failed to provide their services to the populace, the populace began to freak out.

Its the same thing for information security. Whether it is the government or the corporations that supply us all, both are comprised of people who all pretty much lack this perspective of being without, or having really bad things happen to them. 9/11 comes the closest, but, that only affected NYC and DC directly (i.e. explosions and nightmarish scenarios with high casualties) In the case of corporations, you have lawyers and layers of people to blame, so really, what are the risk evaluations here when it is easy to deflect blame or responsibility? For that matter, it was inconceivable to many in the government (lookin at you Condi) that terrorists would use planes as missiles… Even though a month before a report was handed out with that very scenario on the cover.

The core of the idea is this. Human nature on average, and a certain kind of psychology (normative) that says “This can’t happen to us” We all have it, just some of us are forward thinking and see the potentials. Those forward thinkers are likely security conscious and willing to go out of their way to carry out actions to insure their security. Things like storing extra food and water as well as other things that they might need in case of emergency. These can be life of death deal breakers.. Not so much for information security at your local Acme Widget Corp. In the corporate model, they have the luxury of “It’s somebody else’s problem” So, these things are usually not too important to them unless that person making the decision is cognisant of the issues AND responsible for them. Unfortunately, as we have learned these last 10 years or so, responsibility is not their strong suit.

So, on they go.. About their business after you, the security curmudgeon has told them that they need to store food for the winter..

But the grasshoppers, they don’t listen… Until they are at your door in the snow begging for food.

 

“More has been screwed up on the battlefield and misunderstood in the Pentagon because of a lack of understanding of the English language than any other single factor.

(John W. Vessey, Jr.)

How do we communicate and manipulate our elephants?

Back to the issue of how to communicate the things we feel important. This has been a huge issue for the security community for a couple of reasons.

  1. The whole Joan of Arc thing above
  2. The languages we speak are.. Well.. like Tamarian and theirs are corporate speak.

We, the security practitioners, often speak in metaphor and exotic language to the average corporate manager. You have all seen it before, when their eyes glaze over and they are elsewhere. We can go on and on about technical issues but we never really seem to get them to that trough in the title. Sometimes you can get them to the trough easily enough by hacking them (pentesting) but then they think;

“Well this guy is a hacker… No one else could do this! What are the chances this is going to really happen? Naaahhh forget it, it’s not likely”

So there is a bias already against doing the things that we recommend. Then comes the money, the time, and the pain points of having to practice due diligence. This is where they turn off completely and the rubric of it is that unless they are FORCED to carry out due diligence by law or mandate, they won’t. We all have seen it.. Admit it.. It’s human nature to be lazy about things and it is also human nature to not conceive that the bad things could happen to them, so it would be best to prepare and fight against them.

So, how do we communicate with these people and get them on the same page?

I have no answers save this;

“Some get it.. Some don’t”

That’s the crux.. You have to accept that you as the security practitioner will NEVER reach everyone. Some will just say thank you and good day… And you have to accept that and walk away. As long as you have performed the due diligence and told them of their problems.. You have done all you can. You can try and persuade or cajole them… But, in the end, only those who get it or have been burned before will actually listen and act on the recommendations you make.

“The greater our knowledge increases the more our ignorance unfolds”

(John F. Kennedy)

The Eternal Struggle

There you have it. This will always be the case and it will always be the one thing that others seeking to compromise corporations and governments will rely on. The foolishness of those who do not plan ahead will be their undoing..

Eventually.

All you can do sage security wonk, is calmly and professionally explain to them the issues and leave it to them to drink.

K.

The Son of Stuxnet… Methinks The Cart Be Before Ye Horse

with 2 comments

My dear dear lord,
The purest treasure mortal times afford
Is spotless reputation—that away,
Men are but gilded loam, or painted clay.
A jewel in a ten-times barr’d-up chest
Is a bold spirit in a loyal breast.

Mowbray, Richard II Act 1 Scene 1

 

 

As fate would have it, today I saw a tweet that said Symantec had a paper coming out on “Stuxnet II” I surfed on over and read the document and what I was left with was this;

“We rushed to judgement here and wanted to get this out to get attention before anyone else did.. Here’s STUXNET REDUX!”

Now, sure, the code base appears to be Stuxnet’s and yes, there are similarities because of this, however, calling this Stuxnet Redux or “Son of Stuxnet” is just a way of patently seeking attention through tabloid style assumptions put on the Internet. Let me pick this apart a bit and you decide…

Code Bases and Re-Tasking

So ok, the coders seemed to have access to the FULL source of Stuxnet. It has been out there a while and surely some people in the world of “APT” have had access to this. It’s not like it was some modified version of Ebola kept at Sverdlosk at Biopreparate. Had you even considered that it was released on purpose as chaff to get others to tinker with it and thus middy the waters?

I’m guessing not from the report that I read, hurried as it was and full of conclusions being jumped to. In fact, Symantec even said that they had not fully audited the code! C’mon…

Alrighty then, we have a newly released and re-tasked version of Stuxnet that turns out to be just a recon tool to steal data. I find it interesting that they make so much of this and intone that the coders of the original are up to shenanigans again but fail to even beg the question that it could be anyone with the requisite skills to cut into the original code (after it had been laid out for everyone to look at) and re-task it with a new time frame. Please note that there are not the original 0day attacks and multiplicity factors of infection vectors as well as exfiltration schemes.

So, not really so complicated as I see it.. You?

The original code/malware was very targeted and this, well this is really just like any other APT attack that I have seen out there.. In fact, in some ways its less clever than the APT attacks out there from the past.

So, really Symantec, take a step back and mull this all over again before you release.. Say.. Just who else had the code and you were worried about that would steal your thunder here?

Pathetic.

RATS, RECON, & Targets

Speaking of the infiltration/ex-filtration picture, I see from the report that they are linking the RAT to the original worm but have not real proof that it came from DUQU! It was found in situ on the box that they analyzed and make the assumed statement that it was “likely” downloaded by the malware via its comms to the C&C.

Once again I say “Evidence Much?”

You have no basis other than assumption but you make no real clarification on this. Though there is mention of a DQ.tmp file which I assume means that it came from the RAT.. But.. Proof again please? It’s the little things that count here and I see a great failure in your haste Symantec.

Another thing that is bugging me now is that the news cycle is making connections to DUQU with attacks on power grids.

HOLY WTF?

Symantec, DO YOU HAVE EVIDENCE of what companies were “Targeted” by this malware re-hash? If so, you should come out of the closet here a bit because this is BS unless you have proof. I of course understand that you cannot name the companies, but CONFIRM OR DENY that they were all Power companies before making claims and allusions that the media will just shriek at the top of their lungs placing more FUD on the headlines.

Or… Wait.. Now that might be an advantage to you guys huh?

Ponder.. Ponder…Ponder…

Well played….

What it all boils down to for me is this:

Someone re-tasked the malware and stuck a common RAT in it. Until you (Symantec) come up with more solid evidence of more interesting and technical attacks, then I call bullshit on you.

What? No Mention Of APT Here?

Meanwhile, I see that people are assiduously avoiding the APT word… Hmmmm What does this attack really remind one of… APT!

There, I said it.

APT attacks:

  • Infiltrate
  • Seek data
  • Exfiltrate data
  • Keep access

And therein lies the rub. DUQU has a 36 day shelf life. Now, this is good from a foot-printing level AND could be excellent for setting up the next attack vector that could include the component of sustained access. So, the reality here for me is that this was a foot print attempt on whatever companies it was set upon. It was a recon mission and that was all.

NOT STUXNET..NOT SON OF STUXNET!

Had you called it a Stuxnet like attack re-purposing code then I would have had less problems with your document Symantec. Instead we got FUD in a hurry.

Baseless Claims: Pictures Or It Never Happened!

Finally, I would like to see Symantec spend some more time here as well as see others pull this all apart. I want to see more proof before you all go off half cocked and get the straights all upset over an attack that may have nothing to do with the original.

Frankly, I find your faith in rationality disturbing… Symantec…

K.

Anonymous, SCADA, LULZ, DHS, and Motivations

with 2 comments

Anonymous Is Interested In PLC’s & SCADA?

A recent .pdf bulletin put out by Homeland Security (i.e. DHS) claims that certain actors within Anonymous (and by that they mean “anonymous”, I added the distinction) have shown interest in at least Siemens SIMATIC PLC’s and how to locate them online for exploitation. It seems that DHS though warning about this threat, is not too concerned about its actually being exploited by the group because they lack the expertise to attack them. So, why the BOLO on this at all? If the collective cannot do the damage to the infrastructure that you are entrusted in keeping safe, then why report on it at all as credible intelligence? It would seem to some, myself included, that Anonymous is not the problem that they are really worried about on the macro scale, but instead, those who may claim to be Anonymous hitting small scale facilities or pockets of targets for their own purposes.

And therein lies the difference.

If indeed Anonymous the collective is looking at attacking SCADA, one has to wonder at their reasons to target such systems. After all, if Anonymous takes out the power or poisons the water, it will not look good for them PR wise. In fact, were such things to happen in the name of Anonymous, I can pretty much guarantee you all that they would be enemy #1 pretty darned quick post an attack. However, if they were to target a company such as a car maker that pollutes, then, you have a real agenda (per their social agenda of late) So, the targeting is really key here and I will cover that later on.

DHS Jumping The Shark?

The motivations of the release by DHS have also  been called into question by some as to why they chose to talk about this at all. This is especially prescient since they take pains to say that the Anonymous movement “most likely” does not have the technical means and motive to really pull of these types of attacks on the infrastructure. So why even bother? Perhaps they are just covering their bases (or asses) just in case the Anon’s actually attack? Or perhaps, they too are clued in on the fact that even if claimed to be anonymous, it could be others working against the US (Nation State Actors) who have chosen to attack and use Anonymous as a cover so as to throw off attribution.

Either way, as some look at it, it is almost like they are daring Anonymous to do it out of spite because they are calling Anonymous’  factions and actors “inept” or “unskilled” which, might get their dander up a bit. All of these scenarios pretty much do not preclude someone hitting SCADA systems in the future and it being blamed on Anonymous, which will bring on a new wave of efforts by the government to stamp them out. Reciprocity being what it is, this too will mean that Anonymous might in fact gain strength and sympathy from such actions and fallout as well.

For me though, I just see DHS covering the bases so as to not be blamed later on should something happen. Not so much am I of the opinion that they are in some kind of propaganda war here with this little missive.

Motives, Means, Technical Abilities

So lets go with the theory that certain elements of the Anonymous collective want to mess with the infrastructure. Who would they target and why? More to the point, what companies would they target that fits their agenda?

  • Telco?
  • Power?
  • Manufacturing?

Those are the three areas that I could see as potential attack vectors. Though, once again I have to say that the only two that I see as real possible would be the telco and manufacturing and even the telco would be dangerous for them to try as well. I mean, if you start messing with Ebay or Paypal that’s one thing, its quite another to mess with national infrastructure, as these two would be considered. If indeed Anonymous hit them and took them down for whatever reason, they would then be directly considered terrorists… And that would be seriously bad for their movement and its legitimacy.

Now, we do know that the  Anon’s hit the BART system but as I remember it, it was BART that took out the communications infrastructure themselves so as to prevent communication between anon’s. So, this just doesn’t seem to fit for me either. Manufacturing though, as I made the case above, could be something they would try. It’s not national infrastructure and it will not take the country down if they stop something like cars  being made.

Is it just me? Or does anyone else just see this as a non starter for Anonymous central? What I do see is the threat of other actors using the nomme de guerre of Anonymous as cover for their actions to mess with the national infrastructure. Perhaps some of these people might in fact be motivated by anonymous, but, my guess that if there were to happen, it would be nation state driven… And something I have been warning about for some time.

Anonymous, as an idea, as a movement, will be subverted by those looking to fulfil their own ends and justify their means. All the while, they will let the Anon’s take the fall for it.

Governments

Nations

Nation States

… AND.. Corporations.

You know, those with the money and the people who could pull off the technical hacks required to carry these capers off.. Not a bunch of rag tag hacktivists and hangers on.

Blowback

In the end, what I fear is that there will be a great deal of blowback on Anonymous even talking about hacking and messing with infrastructure. The same can be said for their attempts on taking down Wall Street or the NYSE with their DD0S. If they had succeeded, they would have been an annoyance really, but that would not have caused any great fluctuation in the markets I think. No, unless they hacked into NYSE itself and exposed the fact that they had root in there, I think that it would have a very minimal effect on Wall Street and the economy at large.

Not to say that everything is going ever so well now…

DHS seems to have jumped the shark a bit for me on their BOLO and the coverage of this just tends to add to the FUD concerning SCADA and PLC code. Hell, for that matter we have the new Symantec report on DUQU that yells out about it being the “Son of Stuxnet” but in reality, it is more like a clone of Stuxnet used for APT style attacks by persons uknown..

Get yer FUD here!

Same goes for this DHS warning.

Your results may vary…

K.

SCADA SCADA EVERYWHERE! STUXNET, SCADA, Terrorism, Nation State Terrorism & FUD

with 3 comments

Yes, this diagram does come from a .gov site for an actual system... *sadpanda*

THE STUXPOCALYPSE:

“When he opened the seventh seal, there was silence in heaven as the malware began changing PLC code”

From the book of Langer & Wright:  Revelation Chapter 1 Verse 1

The news cycle still is full of hand wringing over SCADA and Stuxnet while more government officials worry about “Stuxnet” being modified to attack other PLC systems that are vulnerable and riddled with 0day. I have written in the past that I had thought that all of this chicken little reporting and fear mongering was a little over the top and have been taken to task by the likes of certain people who shall remain un-named (though, you don’t have to look much further than the book of Stuxnet revelation above to know who I am talking about)

So, I decided to take some time and do a little research online to see just how bad things really are… With Google and Shodan.

What I Found:

Ok, well, once I began to dig into Shodan and Google I decided that I needed to define the scope a bit. So, I did searches for the popular systems like Siemens. What I discovered was that there were systems indeed online and with web gateways available. Some of these were systems for water treatment, some were for telco, and some were in fact for electrical networks. The numbers showed though, that at least through Shodan, there were not a preponderance of American systems just laying about. Europe though and other countries had a bit higher number of systems.

Once I got past the popular names though, I began to look for other vectors of attack. I thought perhaps I should look for the product names of the gateway products and sure enough, I located a bunch of them out there. The most popular one though (by numbers online) turned out to be a south American product/system and there were plenty of those out there. In fact, once I saw where they were located I had a fleeting thought about power outages in South America and how everyone was debating that they were hacked..

Mmm Could be…  However, without real proof of that, I am unwilling to go on the record and be like the other pontificator’s out there.

Here’s a list of the product names sampled within the Shodan results.

Now, having done all this poking about the question then becomes just what systems are they using for PLC control and just how many companies are there out there? This becomes important as all of the talk is about “Stuxnet” and the apocalypse of the code being re-engineered to attack other facilities than Natanz and the Siemens System 7. I then went to the “Googles” and asked the following question of the great and wise oracle.

“How many PLC controller makers are there in the world?”

Out of the results I got here was the most relevant answer:

PLC controller manufacturers-getting one available through the internet
While finding PLC controller manufacturers to get a PLC, it is important to learn on how to control programmable logic controllers. A PLC programmer is known as person who has the ability to create a system by using PLC programming. Learning about PLC programming is the key for those who want to take part in the automation industry. When it comes to PLC controller manufacturers, some options are available such as Panasonic, Hitachi, Foxboro, Keyence and many more.

Well then, “many” is not a good enough answer for me and I am sure someone (who shall remain un-named) shall beg the question of had I been thorough enough. So, I went back to the great and wise “Google” and put it another way;

“Commonly used PLC systems”

What I got back was a site  that was a kind of a ranking site for people to nominate the makers and systems. Culling the data from this page I get the following names:

  • Allen-Bradley
  • Siemens
  • Mitsubishi
  • AB
  • OMRON
  • Modicon
  • GE 9030 and SLC100
  • Rockwell
  • Telemecanique
  • Schneider Electric
And the list goes on a bit more… But you get the point. Not only are there many of them, but, this was also in 2000 when this list was started. So, there is likely to be a great change in the vendors that have popped up on the small scale. However, you can see that the biggies, or should I say “biggie” of Siemens is still pretty popular.

Alrighty then, So, there are many out there but there may be a monoculture of sorts going on due to the nature of choice per countries. As the site listed it, the US uses a lot of Siemens and Rockwell. In fact, the list suggested that Rockwell was over Siemens in the stats for the US. This could be the case, but either way, there is a case to be made that there may indeed be a monoculture issue here. Given that Siemens was pretty 0day riddled per the DEFCON presentation this year, we may indeed have a larger problem that one might think.

This depends though on the target of your attacks and the redundancy of the systems being attacked as well. However, it really does depend on the facts and figures of just how much of a monoculture in PLC/PID/SCADA systems and networks there are out there of varying types and configurations. It’s a complex ecosystem, and thus, to pull off a “Stux” attack en mass is going to be rather difficult. This is why the Stuxnet attack on Iran was so directed. They knew the specific models and systems within the Natanz facility and they programmed accordingly to damage them. In the case of a “Stuxpocalypse” the coders would have to program in every conceivable system type (and yes the PLC flaws do carry over so it may be a one size fits all in that case) but what about all the others? Are all these systems based on all the same code?

Regardless of the zero sum game theories on SCADA system security flaws being universal, then, one would have to create malware that would be in effect, polymorphic (Hell, should just say zenomorphic huh? Go all Alien) This would, as I have said in the past, make the payload pretty much bloatware in my book. So where is the efficacy or for that matter, the probability that the Stux is going to be modified to this level of pandemic generating scale? Never mind the task of getting it onto all of the systems needed to have the “apocalypse” that every chicken little seems to be worried about. I know, I have said this before, but I thought I would just re-iterate it all again. I just don’t see this being a large scale attack vector even from a nation state level. Pockets of attack yes, but not anything that is going to put us down for the count.

And that is what I am trying to say here. There is way too much FUD with all of the yammering I have seen and not enough rational thought. It’s, to quote “Team America”

Spottswoode: From what I.N.T.E.L.L.I.G.N.C.E has gathered, it would be 9/11 times 100.
Gary Johnston: 9/11 times a hundred? Jesus, that’s…
Spottswoode: Yes, 91,100.
Chris: Basically, all the worst parts of the bible.
Yeah, that about sums it up… So, on to more of the argument against the “Stuxpocalypse”

Targets & Vectors:

Gas Pipelines

Yep, this would be bad for areas of the country. If gas pipelines exploded it would cause fires and destruction, likely loss of life etc etc. So, if someone were to make a concerted effort to locate all of the gas pipeline/producers networks and find out what PCS’s they are using they could do it. This would be nation state really and it is possible. However, this type of kinetic attack would have to be in tandem with other manoeuvres to attack the infrastructure. It’s a fire sale scenario really.. The fallout though of hitting one facility and  causing damage/fear/deaths would the psyops side of it.. That is unless the aggressor is looking once again, to a larger attack on the country concurrently.

Nailing all of the pipelines though or a great number of them simultaneously… I really don’t see as all to feasible.

This is not the Stuxpocalypse you are looking for…

Electrical Facilities and Grids

Ok, so here we have an interesting conundrum. With the advent of the “smart” grid, this might in fact make it easier to have a larger percentage of failure within the system itself. Everything being tied together this way and monitored will only serve to make the system more susceptible to a single point of failure I think. Of course there are many people working on this issue and trying to make the smart grid more secure. We will see how that plays out down the road though. At present though, one would have to look at taking down the grid with malware.

Could it happen? Maybe, large sections could go out. Or, if you hit the central nervous system of the network you could potentially have large areas of the country down for a while. Now, can you use Stuxnet and PLC malware to make the grid eat itself en toto is the real question isn’t it? All at once? A cascade failure of epic proportions?

Not likely. Though the systems are connected, once again, the effort would have to be nation state, it would have to consider that the energy companies are using monocolture technologies, and code accordingly. So, I don’t see this as happening on the level of the FUD reporting out there would make it out.

Nuclear Facilities

To start off, I would like to cite an article on SCADA and Nuclear facilities to enlighten you all…

In retrospect, Lunsford says–and the Nuclear Regulatory Commission agrees–that government-mandated safeguards would have prevented him from triggering a nuclear meltdown. But he’s fairly certain that by accessing controls through the company’s network, he could have sabotaged the power supply to a large portion of the state. “It would have been as simple as closing a valve,” he says.

From America’s Hackable Backbone on Forbes back in 2007

I have said this before and now I will say it again. There will be no Chernobyl events here, and for those of you who know reactors, will know the reasons it will not be a Chernobyl event (design wise) However, the fact is that people worry about this because they think a meltdown is as easy as the China Syndrome.  So, will Stuxnet or some other PLC hacking cause this to happen? Apparently no according to this IBM guy and the NRC.

*breathe people*

Could the system scram and be down for a while? Sure. That could happen and it would cause people to be without power for a while as they find out what happened. Having just gone through a tropical storm and power loss here, I can see how it would be irritating but it would not be the preamble to war… Or the apocalypse.

Supply Chain Attacks

Supply chain attacks are quite possible but, they are likely only to happen in pockets as the companies are all varied. So, you might not get your new car on time, or whatever else you wanted to buy or sell that you manufacture. This could be bad from a bottom line perspective monetarily, but, once again, this would not be an apocalypse. It is also key to note that with each company would be different PLC systems so that stux code would have to be very specific or hugely varied and bloated to work on a large scale.

Chemical Facilities

Here we have something that I for one kind of do worry about. It would not take a mass attack on all chemical facilities to cause mass panic and perhaps deaths. At the very least, a chemical production facility being affected by a PLC/Stuxnet like attack would cause evacuations in the area that the plant sits. If someone were to mod the Stux or create something new to attack the controllers at specific facilities, they could cause an explosion or release of toxins.

Ok, I can go with this one a bit… Still though, not an apocalypse. For that matter, one could just get some C-4 and get a job at the facility long enough to plant a bomb… and that is more AQ’s style than trying to create a super weapon out of Stuxnet for this purpose.

Water Treatment Facilities 

Personally, the poop factory is only on here because there are so many of these facilities with an online SCADA presence according to Shodan. If someone were going to attack the infrastructure this way, they could flood the systems with waste and certain areas would have to live on bottled water a while. Surely not the Stuxpocalypse you are looking for here. Frankly, if a terrorist wanted to go after us this way, they would instead do what they have already tried to do in the past, poison the water with a toxin that they pour into it.

Not so worried here…

Telecommunications

Shodan showed many telco’s with SCADA online to access. Now, if I were looking to take over a country I’d use the old aphorism of going after the radio and TV first.. Sure, this could be done in pockets but once again, there is no silver bullet here, no digital Ebola, that is going to take out the networks of all of these carriers. So, this would be a nuisance, people would have issues, some may die due to 999 or 911 not working, but, yet again, not the Stuxpocalypse.

SCADA On The Internets and There ARE NO AIR GAPS!

*facepalm*

Once again, yes Virginia, SCADA systems are networked. Yes they are even connected to the Internet insecurely in some cases. Just like any other technology, the connections are made for the ease of use of the company/user. In fact, as I have said before and as you can see from the diagram at the top of this article, they in fact also use Microwave, WIFI, and other RF means to get far flung data from point A to B.

Yes.. It’s true.

However, so far in my looking around, the systems that I primarily see as having these types of connections (RF) are water, gas, and electric systems. So yeah, you could mess with them by RF and cause issues. However, I have also seen systems that were located in well areas with only puny locks to protect the doors to the facility and no one.. not a soul around for miles to stop you from picking them.

I’d say that is insecure… BUT, I have yet to see one of these sites that if I popped it and brought it down, would cause a cascade failure and the apocalypse… And therein lies the key to the rationality. All systems have pain points but the infrastructure is so large and it has been built with some redundancy to prevent a system wide failure from one node going down.

Meanwhile, back to the air gap thing. I actually saw ONE. One facility had a separate network and it was not V-LAN’d off to “logically separate it” I cannot name the facility,  but lets just say it was involved with power generation. So, yes, they are in some cases air gapped (and you know who I am looking at when I say this.. Captain Generality) Other places, not so much. They have logical air gaps only and yes, those can be breached with the right hacking attacks. I must say that in other places people just didn’t even put any thought into it at all and its all just hanging out for anyone to access like a college girl in a tube top.

It all matters on who has done the planning and who’s watching the hen house. One hopes that post Stuxnet the government and the companies are working on cleaning up their flaws so as to prevent an attack.

Time will tell though… All these companies and infrastructures are snowflakes….

EMP’s Man Made & Solar… Now There’s Your Apocalypse:

So, you want a real apocalypse? Well then, just think on this. If there is a mass coronal ejection big enough, great swaths of the world could be hit  by a nature made EMP. As the sun cycle seems to be ramping up a bit, we may just someday see this happen. If that happens, then you will see some real apocalypse events. I have written about this in the past and frankly think this is a greater threat than the supposed Stuxpocalypse everyone is all chicken little over. There are also small scale EMP weapons the Military have been working with along with the usual talk of a nuclear high altitude det to kick everything off and send us back to the stone age.

Each of these scenarios could happen but, probability wise, they are all pretty low I think.. Including the Stuxnet scenario.

One Last Parting Thought:

So once again, I have stepped into the breach between FUD and SANITY. I am hoping that sanity wins out, but, I know that in a world where Gregory Evans is alleged to be speaking to Congress about cyber security, I have little hope of being listened to by the masses. I will just go back to sharpening my blades, cleaning my guns, and preparing my bugout bags…

Oh, not for the apocalypse you think will be happening.. No.. For the apocalypse of stupid that will be happening thanks to the likes of CNN and the book of Langer and Wright.

K.

Written by Krypt3ia

2011/10/13 at 14:46

Posted in FUD, SCADA, STUXNET

“What We Have Here… Is A Failure To Communicate” Stuxpocalypse and FUDDERY

with 3 comments

FUD FUD FUD PUFFERY!

Once again I find myself having to respond to chicken little dullards spewing FUD across the internets to make themselves muy importante. Once more I have to say that the current FUD du jour on STUXNET and the fact of just how many SCADA systems are online is getting tedious. So, Mr. Wright, yet again I have to school you on the facts and disabuse you of the idea that you are correct in your thinking.

So you say that SCADA is online… I never said they were’nt frankly. If you look closely at the sentence I actually say *crosses fingers* I KNOW that there are systems online and available to the internet TODAY, a simple Shodan search for Siemens Simatic PLC systems turns up 25 hits in the US alone. So, yes Mr. Wright, they are online and I knew this. I also was saying tongue in cheek that I had hoped that more of them would not be so readily available and that the people involved in management were taking care to remove the systems from non air gap networks.

Yes Craig, there is a problem, but, it is not of the EPIC proportions that you seem to be ascribing to as a member of the Langer echo chamber.

Shodan Search


http://www.shodanhq.com/?q=PLC
http://www.shodanhq.com/?q=allen+bradley
http://www.shodanhq.com/?q=fanuc
http://www.shodanhq.com/?q=Rockwell
http://www.shodanhq.com/?q=Cimplicity
http://www.shodanhq.com/?q=Omron
http://www.shodanhq.com/?q=Novatech
http://www.shodanhq.com/?q=Citect
http://www.shodanhq.com/?q=RTU
http://www.shodanhq.com/?q=Modbus+Bridge
http://www.shodanhq.com/?q=modicon
http://www.shodanhq.com/?q=bacnet
http://www.shodanhq.com/?q=telemetry+gateway
http://www.shodanhq.com/?q=SIMATIC
http://www.shodanhq.com/?q=hmi
http://www.shodanhq.com/?q=siemens+-…er+-Subscriber
http://www.shodanhq.com/?q=scada+RTS
http://www.shodanhq.com/?q=SCHNEIDER

Above links from backtracklinux.com by way of infracritical.com

So Craig, your experiences, while not the outside the norm of mine and others in the business (inclusive of pentesting systems within airframe and engine facilities inclusive of SCADA used to control engines) has little bearing on the contention at the root of Mr. Langers diatribe about a “stuxpocalypse”  In short, in order to have the “mass casualties” scenario he is crying about, the Stuxnet variants would have to be as varied as the number of makers of PLC systems out there. Just as the actual payload file to make a fire sale scenario happen would geometrically increase to have to become its own form of bloatware.

No Craig, I just don’t see it all happening. I see perhaps pockets of localized attacks on systems, but I do not see a large power failure as much as I see someone making the poop factory spill waste into the water systems. Quite simply, as I was trying to point out Langer is spreading a large amount of FUD in an attempt to garner attention.. Much like I think you have been with your posts on Island that have been.. Well, lackluster at best. It would seem by my reading, that you only comprehend half of what is said and then regurgitate the FUD interspersed with your own experiences.

Let me enlighten you some more..

I have also been told that it’s too expensive, or it’s not important, or it’s not on our agenda as well when it comes to remediation’s that I have recommended to companies, agencies, or governments. We all have, I know this. However, the point I was making was that post Stuxnet, I had hoped that all of these people were taking a new look and remediating the problems that we all know are there. I am not foolish enough to think that everything has an air gap and that all those systems connected to the SCADA themselves are fully patched. This does not mean though, that I think we have to be chicken little here and run around being the “Langer who cried wolf”

Which, you seem to be falling into that category Craig. Which once again makes me think that you are less of a source I would listen to, and perhaps this is why these people you speak of have not taken your advice.

Just an opinion Craig.

So, back to the problem at hand other than your puffery…

SCADA systems are all too often connected to non air gap networks. We all know this. Let me tell you a secret *this one’s for you Craig* Some of them even have WIRELESS connectivity! *yes, its true!*

INCONCEIVABLE!

So, do I think it is a problem? Yes. Do I think that there are so many of these systems online and readily available that we will have a fire sale as Mr. Langer would imply?

No.

Could someone (either state or hacktivist or miscreant) do something to select systems fairly easily if there are not remediations?

Yep.

Would the world end and there would be mass casualites?

No.

All of the systems at play have some redundancy built into them. Am I worried about a meltdown at a nuclear facility *Chernobyl style* if someone messes with some Simatic PLC’s?

No.

Why? Because the systems are redundant and deliberately so. Stuxnet did not cause a meltdown, it was not that kind of network. Stuxnet took out some centrifuges. Could someone infect a network/facility to the point of making all redundant systems fail and cause a meltdown in a nuke plant?

Maybe, but that is really pushing it.

So, sure, there are problems. I know this, you know this, we all know this. However, there is no need to go around whining about how no one will listen to you because you are whining pathetically about no one listening to you. All of this being done on the media who embellishes and uses the FUD to sell air time as well as makes it even worse! It would be better to just shut up and say I told you so than to add to the cacophony of FUD which will inure the masses into apathy.

So, where do we go from here?

As I mentioned before, the picture is bigger than whether or not SCADA systems (whether they be Xp, Windows 98, or NT 3.5.1) *shudder* Old, unpatched, or otherwise vulnerable systems still pose a large threat whether or not they are internet accessible (directly) The fact that physical access had to be had in order to load Stuxnet and then had a feature (p2p) built in as well as a re-infection vector for USB in general, shows that it was a rather complex effort. If someone were able to modify the payload to work on other systems and use it in a phishing exploit, sure, we would have many more potentially infected systems. However, unless they create the uber package I mentioned at the top of this piece, it would take a fair amount of footprinting to find the exact models and firmware being used. Not impossible, but not easy either.

See, its more about defense in depth (or should be) than it is “THE SKY IS FALLING!!”

Do changes need to happen?

YES!

One hopes that they are, but all of this debate and going off half cocked is pointless… And that was my main point.. Which you utterly failed to comprehend Craig. It just goes to show, no matter how many acronyms and letters you have after your name, or how big your bio at the bottom of articles online, do not really mean you have a grasp of the situation.

K.

Written by Krypt3ia

2011/09/25 at 22:49

Posted in Duh, FUD, SCADA, STUXNET