Security of the morning calm

In early November 2012, the SCADAStrangeLove striking force was thoughtless enough to accept an offer to speak at the Power of Community (POC) conference held in Seoul, South Korea. While I am still under the impression, I want to tell you how they do security in the Land of the Morning Freshness.
Many photos are under the cut.

WinCC Harvester

Metasploit module for Siemens SIMATIC WinCC forensic/postexploitation.

Use WinCC MS SQL access to harvest sensitive information (users, roles, PLCs) from the database.

Copy this file to: /opt/metasploit/msf3/modules/auxiliary/admin/scada/
Use: use auxiliary/admin/scada/wincc_harvester

Thanks to Vyacheslav Egoshin, Dmitry Nagibin, Gleb Gritsai.

Link: https://github.com/nxnrt/wincc_harvester

PLCScan the Internet

Special release for Power of Community 2012 by Dmitry Efanov: PLCScan. Feel free to contribute!

Tool for scan PLC devices over s7comm or modbus protocols.

Usage examples
plcscan.py 192.168.0.1
plcscan.py --timeout 2 192.168.0.1:102 10.0.0.0/24
plcscan.py --hosts-list hosts.txt

Link again: https://code.google.com/p/plcscan/

SCADA Safety in numbers

The number of detected vulnerabilities has increased by 20 times since 2010. 
It takes more than a month to fix each fifth vulnerability.
50% of vulnerabilities allow a hacker to execute code.
There are exploits for 35% of vulnerabilities.
41% of vulnerabilities are critical.
More than 40% of systems available from the Internet can be hacked by unprofessional users.
The third part of systems available from the Internet is located in the USA.
The fourth part of vulnerabilities is related to the lack of necessary security updates.
54% and 39% of systems available from the Internet in Europe and North America respectively are vulnerable.

Enjoy.

All your PLC are belong to us

Siemens has published advisory “SSA-240718: Insecure storage of HTTPS CA certificate inS7-1200 V2.x”  about bug, discovered by our team. Very funny one, because PLC have built-in CA and generates valid certificates based on IP. So you can trust to CA certificate and you will have security SSL sessions with all PLCs. But as you understand all PLC have same private/public key pair for CA and private key hardcoded into firmware.

 

Not easy bug to fix, but we hope Siemens will do it.

Thus, allyour PLC are belong to us.

New vulnerabilities in Siemens SIMATIC WinCC

Siemens has fixed vulnerabilities in SIMATIC WinCC 7.0 and SIMATIC PCS7 V8 discovered by SCADAStrangeLove team. There are very different one, from trivial XSS and CSRF (last one still unfixed) to arbitrary file reading and awesome username and password disclosure.

ShortList of bugs addresed in SSA-864051:

• Lot of XSS and CSRF (CVE-2012-3031, CVE-2012-3028)
• Lot of to arbitrary file reading (CVE-2012-3030)
• SQL injection over SOAP (CVE-2012-3032)
• Username and password disclosure via ActiveX abuse (CVE-2012-3034)

Thanks to Denis Baranov Sergey Bobrov, Artem Chaykin, Vladimir Kochetkov, Timur Yunusov.

Now we had more info for our speech at power of community. The world has become safer! Hurray!

SCADA StrangeLove and Power Of Community

We will speak about vulnerabilities in SCADA systems @powerofcommunity conference.

New releases comming soon.

Links:
http://www.powerofcommunity.net
https://twitter.com/#!/search/realtime/powerofcommunity

 See you @Seoul