Pierluigi Paganini
July 14, 2012
Excerpt from the article published on the last edition of PenTest AUDITING & STANDARDS 06 2012
The article exposes the main issues related to the use of SCADA systems in critical infrastructures, providing a careful analysis of the relative level of security on a global scale. It discusses the main vulnerabilities of critical systems exploitable by cyber attacks and possible solutions to implement to ensure their safety.
Over the last years worldwide countries have discovered their critical infrastructures too vulnerable to cyber attacks due the increasing attention in cyber security matter and successfully attacks to SCADA systems. Events such as the spread of Stuxnet virus have alerted the international security community on the risks related to a cyber attacks and the relative disastrous consequences, we have learned how much powerful is a cyber weapon and which is real involvement of governments in cyber warfare.
SCADA (supervisory control and data acquisition) is an industrial control system (ICS) used for the control and monitor of industrial processes, it is typically present in all those potential targets of a cyber attack such as a critical infrastructures or a utility facility.
Being related to industrial processes we find this family of devices everywhere, manufacturing, production, power generation and many times they are implemented to control of activities of critical systems such as water treatment and, electrical power transmission and distribution and large communication systems.
These components are privileged targets for cyber attacks, with a virus is possible to destroy the processes inside a nuclear plant as it happened in Natanz nuclear site during the offensive against Iran and its nuclear program. Western countries have been the first to explore the possibility of a cyber offensive using a cyber weapon such as a malware, the operation Olympic Games demonstrates the high attention of US government in cyber operations and the strong commitment provided by Bush administration first and after by the Obama one.
The scenario is really alarming, an attack on a SCADA system of a sensible structure could materialize the nightmare of every government, similar incidents can undermine the safety of millions of individuals and can compromise the homeland security. Dozens, hundreds, thousands of installations all over the world are potentially vulnerable to attack from anywhere on the planet, the offensive option is moved into what it is defined as the fourth dimension, the cyberspace, but that could also lead to the loss of many human lives.
Not necessarily our minds must fly to a nuclear plant thinking to a possible accident in its control systems, we can think for example of the impact of an attack on the processes in a chemical plant. The main problem of SCADA systems is that they are in large number, each industrial process has its own, and many of them are exposed on internet without proper protection.
Which is the typical structure of a SCADA system?
SCADA systems consist of the following components:
Figure 1 – Scada Schema (Wikipedia)
In similar structure is possible to imagine several entry points for the external agents such as malware, the supervisory system is usually a computer based on the commercial OS for which is possible to exploit known vulnerabilities and in case of state sponsored attacks also 0-day vulnerabilities. Incidents occurred in SCADA systems have been demonstrated that these systems could be infected in different ways, we can imagine the inoculation of a virus through a USB stick or via a network interface.
After the recent events many security firms have started the design of specific solutions to address security problems of SCADA systems, but the major challenge is for governments that have to include the protection of these critical components in their cyber strategies. Several audits executed by governments on their critical infrastructures have illustrated a dangerous scenario, the lack of security mechanisms for the many systems located all over the world, but it is really alarming the absence of a precise census of the SCADA systems for many of the principal industrialized countries.
Events such as the virus Stuxnet diffusion and the alleged incident to the water facility in Illinois occurred last year have shown to the world that it is possible to conduct a terrorist attacks on foreign state remotely, this has increased the awareness of cyber threats and the necessity to implement right countermeasures to mitigate the risks.
Defense mechanisms virtually absent, the SCADA system components are often under the government of local authorities who do not deal with adequately trained personnel and that operates with limited budgets. This means that this kind of control devices is installed everywhere without being qualified in the installation phase. There are many systems deployed with factory settings, pre-set standard configurations and common to entire classes of devices. To this we add that even those who maintain them, should not exceed security, thus making it accessible for remote diagnostics without necessary attention.
Fortunately, something is changed, precise guidelines identify best practices to follow in the management of SCADA systems and operations groups monitor the operation of facilities around the country.
The last “INTERNET SECURITY THREAT REPORT” published by Symantec reports that during 2011 have been detected several weaknesses in Critical Infrastructure Systems, the security firm has seen a dramatic increase in the number of publicly-reported SCADA vulnerabilities from 15 in 2010 to 129 in 2011. Since the emergence of the Stuxnet worm in 2010 36, SCADA systems has attracted wider attention from security researchers. However, 93 of the 129 new published vulnerabilities were the product of just one security researcher.
In December the Industrial Control System – Cyber emergency Response Team (ICS-CERT) has distributed a new alert to provide timely notification to critical infrastructure owners and operators concerning threats or activity with a potential impact on critical infrastructure computing networks.
ICS-CERT informed that some models of the Modicon Quantum PLC used in industrial control systems contain multiple hidden accounts that use predetermined passwords to grant remote access Palatine, Illinois–based Schneider Electric, the maker of the device, has produced fixes for some of the weaknesses and continues to develop additional mitigations. ICS-CERT encourages researchers to coordinate vulnerability details before public release.
In a SCADA system the programmable logic controllers (PLCs) are directly connected to in-field sensors that provide data to control critical component (e.g. Centrifugal or turbines). Often the default passwords are hard-coded into Ethernet cards the systems use to funnel commands into the devices, allowing administrators to remotely log into the machinery.
An independent security researcher Rubén Santamarta reported that the NOE 100 and NOE 771 modules contain at least 14 hard-coded passwords, some of which are published in support manuals. Even in cases where the passcodes are obscured using cryptographic hashes, they are trivial to recover thanks to documented weaknesses in the underlying VxWorks operating system. As a result, an attacker can exploit the weakness to log into devices and gain privileged access to its controls.
Hard-coded passwords are a common weakness built into many industrial control systems, including some S7 series of PLCs from Siemens. Because the systems control the machinery connected to dams, gasoline refineries, and water treatment plants, unauthorized access are considered a national security threat because it could be used to sabotage their operation.
Doing a search on the server search engine known as Shodan it’s possible to discover what appear to be working links to several of the vulnerable Schneider models. Santamarta said there is no fix for the devices other than to retire the faulty Ethernet cards and replace them with better-designed ones. The ICS-CERT advisory issued on December said the fixes from Schneider removes the telnet and Windriver services. The advisory made no mention of changes to FTP services.
The scenario is very worrying and reveals the need for a radical change, fortunately, the emergency has been perceived by most Nations. The ENISA (European Network Information Security Agency, has produced a recommendation for Europe and Member States on how to protect Industrial Control Systems. The document describes the current scenario of Industrial Control System security and proposes seven recommendations to improve it. The recommendations call for the creation of the national and pan-European ICS security strategies, the development of a Good Practices Guide on the ICS security, fostering awareness and education as well as research activities or the establishment of a common test bed and ICS-computer emergency response capabilities.
In June The Pacific Northwest National Laboratory (PNNL), a federal contractor to the U.S. Department of Energy (DOE), in collaboration with McAfee has published an interesting report entitled “Technology Security Assessment for Capabilities and Applicability in Energy Sector Industrial Control Systems: McAfee Application Control, Change Control, Integrity Control.”
http://www.mcafee.com/us/resources/reports/rp-energy-sector-industrial-control.pdf
The report provides an excellent picture of the current status of critical infrastructures and the effort spent to identify and fix vulnerabilities, in particular, it analyzes the value and effectiveness carefully integrated security solutions necessary to support the national security mission to secure industrial control system environments.
Very meaningful is the statement said by Philip A. Craig Jr, Senior Cyber Security Research Scientist, a researcher within the National Security Directorate at the Pacific Northwest National Laboratory:
“When early critical infrastructure systems were created, neither security nor misuse of the interconnected network was considered”
“Today, we are still focused on enhancing the security of control systems. Outdated security methods that use a maze of disparate, multi-vendor, and stacked security tools will only delay a cyber attack, providing numerous opportunities for a more advanced and modern cyber adversary to attack cyber security postures throughout critical infrastructure.”
The document proposes a list of principal vulnerabilities that have been identified for control systems environments:
For now we have spoken of the possible vulnerabilities of the control systems without considering the principal reason of concern for critical infrastructures, the cyber warfare. Today cyber attacks have critically evolved into a sophisticated and carefully designed cyber weapon created with specific offensive intents, Stuxnet, Duqu and Flame are good examples.
Dr. Phyllis Scheck, Vice President and Chief Technology Officer, Global Public Sector, McAfee said
“Infrastructures that control systems affecting our everyday lives, such as smart grids, are rising in adoption yet still lack the proper security needed to prevent sophisticated cyber attacks, “
“Achieving security by design is essential in securing critical infrastructure. Cybersecurity must be embedded into the systems and networks at the very beginning of the design process so that it becomes an integral part of the systems functioning.”
Which are the principal solutions to prevent the exploits of vulnerabilities?
Well, after the discovery of government programs for the design of cyber weapons that are able to exploit vulnerabilities present in the control system many security firms and experts of the same governments have invested in the project for the defense of critical infrastructures. Today there aren’t cyber strategies that aren’t considering the strategic importance of cyber defense. To give an idea of the possible solutions implemented for defensive and preventive purposes the PNNL report cites:
Conclusions
The SCADA systems are increasing in complexity, due to the integration of different components produced in many cases by different manufacturers it is necessary to address the security level of each device, but also on the overall environment, integration tests are fundamental during the deployment phase, the design approach must totally change and have to take care of all the possible cyber threats that could arm the systems.
There must be a collective effort by all governments to produce continuous report on the security status of critical infrastructures and related SCADA systems. The overall security will pass through a global collaboration and information sharing on the possible cyber threats and the vulnerabilities of every device that is qualified in the market.
The security component must become part of the project of the industrial system, it must be considered as a specific requirement, overall security of critical infrastructures must be audit during the entire lifecycle of its components.
Only following these recommendations we could defend our nation.
Pierluigi Paganini
About the Author
Pierluigi Paganini has a Bachelor in Computer Science Engineering IT, majoring in Computer Security and Hacking techniques. Security expert with over 20 years experience in the field. Certified Ethical Hacker at EC Council in London. Actually he is Company Operation Director for Bit4Id, Researcher, Security Evangelist, Security Analyst and Freelance Writer. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to found the security blog „Security Affairs”.
Security Affairs ( http://securityaffairs.co/wordpress )
Email : [email protected]
