SCADA hacking @ Seoul

This year we will manage Choo Choo PWN ICS/SCADA/PLC hacking challange and workshop at Power of Community conference. http://www.powerofcommunity.net/


'Choo Choo Pwn' challenges the participants' skills in exploiting various vulnerabilities in industrial equipment which provides automation and control of technological processes. The contestants will be offered to choose from access to communication systems of industrial equipment or HMI systems access. The goal is to independently obtain access to a model of a system which controls a railroad and cargo loading by exploiting vulnerable industrial protocols or bypassing authentication of SCADA systems or industrial equipment web interfaces. The Industrial Control System (ISC) of the railroad will include video surveillance, and, as an additional task, the competitors will be offered to disable the surveillance system.

Hope to see you there.

Choo Choo PWN at 2:39.

XXE OOB strikes back

Microsoft just released patches MS13-072 and MS13-073 to fix CVE-2013-3159 and CVE-2013-3160 XML External Entities Resolution Vulnerability or XXE OOB issues. Details and tools for this and similar issues can be found at XML Out-Of-Band Data Retrieval Black Hat Talk by Timur Yunusov and Alexey Osipov.

So, hack XML, use XXOETA and be happy.

WinCC Harvester Metasploit module is updated

New version of modules/ auxiliary /admin /scada /simatic_wincc_harvester.rb is released.

It's still in unstable but I hope it will be fixed in the nearest future


Credits 

Dmitry Nagibin, Gleb Gritsai, Vyacheslav Egoshin

What's new
 

CVE-2013-0678 and  http://scadastrangelove.blogspot.ru/2013/03/wincc-vulnerabilities-fresh-meat.html

+      # decrypt user password
+      prj[db]["users"] = prj[db]["users"].map do |usr|
+        usr_pass = decrypt usr[1].strip,usr[2]
+        usr.insert(3,usr_pass)
+      end

Download

Enjoy

SSA-064884: WinCC/TIA Portal fixes

Siemens updates WinCC SCADA and TIA Portal to fix two minor issues in HMI panels discovered by our team:

• CVE-2013-4911: CSRF (Cross-site request forgery) attacks, compromising integrity and availability of the system
• CVE-2013-4912: URL redirection to untrusted websites

Thanks for Timur Yunusov and Sergey Bobrov for research and thanks for Siemens Product CERT for fix and collaboration.

Details

Siemens SSA-064884:

 http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-064884.pdf

ICS-CERT ICSA-13-213-02:https://ics-cert.us-cert.gov/advisories/ICSA-13-213-02

Enjoy

SCADA (in)security in pictures #2

Short video about profinet_scanner.py released by Alexander Timorin at PHDays III.

Unbelievable?
Don't try this at home!

Please update your plant. On recent WinCC fixes

Few days ago Siemens published update for WinCC 7.2 SCADA to fix several vulnerabilities discovered by SCADA StrangeLove team.
CVE-2013-3957 – most dangers one. Simple SQL Injection because some configuration and architectural issues an attacker can execute arbitrary code in context of SQL server. This vulnerability can be exploited not only via WebNavigator (e.g. HTTP), but via WinCC Runtime Client (e.g. OPC). So Cisco Applied Mitigation Bulletin 29768 should be fixed to filter OPC traffic also.

CVE-2013-3958 and CVE-2013-3959 is funny stuff because… Because backdoors hardcoded accounts are always funny.

Credits:
Alexander Tlyapov, Sergey Gordeychik and Timur Yunusov.

Links:

http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345843.pdf

https://ics-cert.us-cert.gov/advisories/ICSA-13-169-02

Thanks to Siemens Product CERT for collaboration and fixes.
Special thanks to Dec for the slide 44

Enjoy.

Invensys ICS/SCADA fixes

Invensys published updates to fix CVE-2013-0688/CVE-2013-0684/CVE-2013-0686/CVE-2013-0685 discovered by SCADA StrageLove team during assesment of ICS/SCADA based on ArchestrA System Platform. There are several trivial and some interesting bugs in Invensys Wonderware Information Server (WIS).
Patches (limited access): https://wdn.wonderware.com/sites/WDN/Pages/Downloads/Software.aspx
ICS-CERT advisory ICSA-13-113-01: https://ics-cert.us-cert.gov/advisories/ICSA-13-113-01\

• SQLi ~10 instances
• XSS ~30 instances
• XXE/XXE OOB/“ADSI Injection” and other interesting stuff…

Credits: 
Gleb Gritsai
Nikita Mikhalevsky
Timur Yunusov
Denis Baranov
Ilya Karpov
Vyacheslav Egoshin
Dmitry Serebryannikov
Alexey Osipov
Ivan Poliyanchuk
Evgeny Ermakov
 

  Enjoy...

Thanks to Invensys security team for collaboration and rapid fixes.