SCADA Security Deep Inside

Members of SCADA StrangeLove Gleb Gritsai and Alexander Tlyapov gave a talk at Zeronights conference @Moscow. New slides were splitted into two parts:
 - Industrial protocols (MMS and IEC 104) and how to act during a penetration testing of ICS enviroment with this protocols
- Patched WinCC vulnerabilities discovered by SCADA SL group including Alexander's results of deep reverse engineering of solution

We'd like to thank attendees for their questions and interest in topic. This year showed there is a room for organizational improvements, but the conference talks and the community compensate any negative impressions. Kudos to the organizers of the Zeronights conference for bringing up this international security event and giving us a chance to speak there.

What hack may come

Last week four guys of the SCADA StrangeLove team took part in Power of Community conference in Seoul, South Korea.
Alexander Timorin, Yuri Goltsev and Ilya Karpov run Choo Choo PWN challenge and workshop, and Sergey Gordeychik spoke on automatic exploit generation.






Choo Choo PWN challenge was built for PHDays III and it was the first time it was presented in Korea.

Power of Community 2013 special release of ICS/SCADA toolkit

Special release of ICS/SCADA toolkit for our speech and workshop at Power of Community conference. Lets play with industrial protocols: S7, Profinet, IEC-60870-5-104, iec-61850-8-1 !

Download

Enjoy...

ZeroDays vs ZeroNights

Alexander Timorin and Alexander Tlyapov from SCADA StrangeLove team will speak @ ZeroNights conference in Moscow, Russia. We will release protocol security analysis for IEC 61850-8-1 (MMS), IEC 61870-5-101/104, security features of “new another S7” for latest TIA Portal and S7-1500 PLC.
Following tradition, we will release information about new (but fixed) bugs in WinCC.

PS. Seems Alexander Timorin will be at Seoul/Power of Community at moment, so Gleb Gritsai will fix this issue and give a lecture @ ZN. 

SCADA hacking @ Seoul

This year we will manage Choo Choo PWN ICS/SCADA/PLC hacking challange and workshop at Power of Community conference. http://www.powerofcommunity.net/


'Choo Choo Pwn' challenges the participants' skills in exploiting various vulnerabilities in industrial equipment which provides automation and control of technological processes. The contestants will be offered to choose from access to communication systems of industrial equipment or HMI systems access. The goal is to independently obtain access to a model of a system which controls a railroad and cargo loading by exploiting vulnerable industrial protocols or bypassing authentication of SCADA systems or industrial equipment web interfaces. The Industrial Control System (ISC) of the railroad will include video surveillance, and, as an additional task, the competitors will be offered to disable the surveillance system.

Hope to see you there.

Choo Choo PWN at 2:39.

XXE OOB strikes back

Microsoft just released patches MS13-072 and MS13-073 to fix CVE-2013-3159 and CVE-2013-3160 XML External Entities Resolution Vulnerability or XXE OOB issues. Details and tools for this and similar issues can be found at XML Out-Of-Band Data Retrieval Black Hat Talk by Timur Yunusov and Alexey Osipov.

So, hack XML, use XXOETA and be happy.

WinCC Harvester Metasploit module is updated

New version of modules/ auxiliary /admin /scada /simatic_wincc_harvester.rb is released.

It's still in unstable but I hope it will be fixed in the nearest future


Credits 

Dmitry Nagibin, Gleb Gritsai, Vyacheslav Egoshin

What's new
 

CVE-2013-0678 and  http://scadastrangelove.blogspot.ru/2013/03/wincc-vulnerabilities-fresh-meat.html

+      # decrypt user password
+      prj[db]["users"] = prj[db]["users"].map do |usr|
+        usr_pass = decrypt usr[1].strip,usr[2]
+        usr.insert(3,usr_pass)
+      end

Download

Enjoy