There is a flame in media about our S7 bruteforce tool
Just for instance: "...and have unfortunately made the code available before the Siemens had the opportunity patch the flaw or offer mitigations..." (src = http://www.net-security.org/secworld.php?id=14303).
C'mon, guys, you serious? Mitigation against offline bruteforce in password-based authentication? Maybe you should take a lessen or two on information security?
1. There are no any security vulnerability disclosed by released tool. SHA-1 and HMAC-SHA-1 crypto implementation in S7 according our analysis strong enough. No salt? May be...
2. Issue related to S7 password known for a while and documented on Siemens site. Prooflink: http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&objid=51401544&nodeid0=10805148&switchLang;51401544;2.x=34&switchLang;51401544;2.y=4&lang=en&siteid=cseus&aktprim=0&objaction=csopen&extranet=standard&viewreg=WW
3. Published tool (and JtR plug-in) require valid challenge-response packets, so risk of potential abuse is very low because attacker need to intercept communications before.
4. It's hard to use Rainbow Tables. Because of challenge-response attacker need to spoof challenge, e.g. to mount MITM attack in adjacent network.
Thus we agree with Siemens, they don't need to release a patch (src = http://www.darkreading.com/vulnerability-management/167901026/security/news/240146748/scada-password-cracking-tool-for-siemens-s7-plcs-released.html)
PS. Yes, we know a bit about SSL. Prooflink: http://scadastrangelove.blogspot.com/2012/09/all-your-plc-belong-to-us.html
PPS. Yes, there are situations where you don't need to brute HMAC-SHA-1 to get S7 password. But...
Just for instance: "...and have unfortunately made the code available before the Siemens had the opportunity patch the flaw or offer mitigations..." (src = http://www.net-security.org/secworld.php?id=14303).
C'mon, guys, you serious? Mitigation against offline bruteforce in password-based authentication? Maybe you should take a lessen or two on information security?
1. There are no any security vulnerability disclosed by released tool. SHA-1 and HMAC-SHA-1 crypto implementation in S7 according our analysis strong enough. No salt? May be...
2. Issue related to S7 password known for a while and documented on Siemens site. Prooflink: http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&objid=51401544&nodeid0=10805148&switchLang;51401544;2.x=34&switchLang;51401544;2.y=4&lang=en&siteid=cseus&aktprim=0&objaction=csopen&extranet=standard&viewreg=WW
3. Published tool (and JtR plug-in) require valid challenge-response packets, so risk of potential abuse is very low because attacker need to intercept communications before.
4. It's hard to use Rainbow Tables. Because of challenge-response attacker need to spoof challenge, e.g. to mount MITM attack in adjacent network.
Thus we agree with Siemens, they don't need to release a patch (src = http://www.darkreading.com/vulnerability-management/167901026/security/news/240146748/scada-password-cracking-tool-for-siemens-s7-plcs-released.html)
PS. Yes, we know a bit about SSL. Prooflink: http://scadastrangelove.blogspot.com/2012/09/all-your-plc-belong-to-us.html
PPS. Yes, there are situations where you don't need to brute HMAC-SHA-1 to get S7 password. But...
No comments:
Post a Comment