hello thank you very much for being here
with us
my name is javier perez and i work as a
director of research and development for
dream data technologies
and i'm juan escobar and i work as a
senior cyber security consultant for
dreamlab technologies
this talk is basically in our experience
in the field of security audits instead
of response as well as in the research
of new vulnerabilities and how they are
applied in the ics cyber kill change
ics are devices that generally operate
in critical infrastructures these are
not well known since they operate in a
different environment compared with
companies that have common information
technologies
also
many incidents involving ics devices and
the ot environment have had very
important geopolitical connotations
which has changed the world related to
the vulnerabilities existing in them
which has led governments to take
measures that classify them as a
critical element of the nation
as many of you probably know today we
are in what is called industry 4.0 which
is characterized by broad
interconnectivity data collection
analysis and communication which results
in the optimization of the flow and
quality processes
although the benefits are many this
convergence between the it and others
increases the attack surface
and as well as the number of new
controls to implement
basing on this province
is that in the 90s theodore
williams along with members of the
purdue university consortium developed
the purdue enterprise reference
architecture as a model for enterprise
architectures where the puritan model
defines the different levels of critical
infrastructure that are used in
production lines and the way to secure
them but as we know is very difficult to
implement maintain and monitor all cyber
security system
we must remember that not all companies
are the same
therefore the security mechanisms and
architectures are different but at the
base and activities to be carried out by
an attacker will almost always be the
same
that is why michael assant and robert
lee adapted the cyber kill change model
created by lockheed martin to the ics
world to understand visualize and
organize the steps required for an
adversary to reach their goal so the ic
ics cyber kill chain consists of two
phases
cyber intrusion
preparation and execution is related to
the id war and the ics attack
development and execution is related to
the i.t world
so
in this tool we will try to emulate
the most common vector attacks
to get access to a remote
power plant
let's see what these steps are for the
stage one the first one is recognizance
recognizing is an activity to obtain
information about something
through observation and or other
detection methods this activity is
divided into passive and active
recognitions where the passive is in
charge of searching for the information
available in public sources and the
active interacts directly with the
target for the collection information
okay let's continue
first let's define our target and the
attacker in this case the target is a
nuclear power plant called macros and
the attackers will be a group called
apt-666
if we search for this nuclear nuclear
plant in google we have a result
and we can see
that this plan
is located in switzerland also has
another
energy project
continuing with passive recognizance we
can do search in cholan or sumai where
probably there is not much information
which always should be the case
in linkedin we find one profile related
to the company and not much else in
internet
it is when the attackers carry out an
active recognizance obviously both
activities can be carried out in
parallel
as we know the plan is located in
switzerland so we proceed to scan the
entire country looking for any reference
to the company
one of the protocols consulted is snmp
although there are not many
vulnerabilities for it it provides
information that may be important to
carry out an attack
for this purpose an automatic tool is
created and launched nationwide using
the default community stream to perform
the authentication
as a result
we can see there is an ipa related to
the company
so in this tool
we will set
the name of the database the community
and the files with the eyepiece
so in switzerland there is around 20
million psip so this will take a
like a
couple of hours to finish
but now we can see
and that we have the result related to
the
macros electric power
plant so
in this ip address that was not a
link of any
site like showdown or sumai
we will scan to see what it is in this
iep address related to
the macro selected power plant
now we will see what information this
service can give us for this we can use
several tools but now we will use one
called snmp check that will give us the
data in an orderly way
as we see
it give us quite a lot of information
but an interesting piece of information
correspond the network connections
here we can highlight a connection
established to port 22
which is generally used for remote
administration and we can see that it's
accessible
now we know that someone is connected so
we can assume that is someone who
manages this system
let's see what we find in this source ip
we launch a quick scan and see that for
ads open
we exit through the browser and see
there is a login page
with a little more research we see that
type of device it is and what part of
the world the expert is assigned
this is a
home router
located in the united states as we take
a look
and do some research about it and we
don't have any vulnerabilities on this
device
so as a summary of the first step we
have one link hidden account one website
one linux servers one snmp service one
in
one interesting ip address and one
internet border device with not no
vulnerabilities
next step
the preparation
in this step there is weaponization and
targeting both can take place but this
is not required basically this step is
to prepare the tools according to
identify objective
in this case we will use two vectors the
social engineering one
and the other we will call it
infrastructure
our goal for the social engineering
vector is that the victim visit a
malicious website and exploit abundant
ability in order to take control of her
computer our school excuse will be an
interview for a magazine specialized in
cyber security issues in industrial
environments
so for this
vector we will create a
[Music]
fake website
where we locate
our
exploit
for browser
and also
we create a fake linkedin account
for a journalist
who is working on this fake
magazine called
scalawire.com
okay and now our plan for the vector 2
infrastructure is also similar to the
previous one we want to redirect all the
web traffic to our malicious sites
but since we don't know who is behind
this device we need to hack the device
and change the configuration of the dns
server so in this way the traffic can be
redirected to our malicious dns server
so i
we don't know the password we have to
find a way to enter to this device
so what we're going to do is try to find
a vulnerability
so we will try to find our zero day
uh
what we going to do is try to fast
the parameters
of this web application and try to find
some kind of
remote code execution because these
devices
are common vulnerability to this kind of
vulnerabilities
so we will try to fast
all these parameters in the pos regions
so what we did was
using a
dictionary with
a lot of comments
in unix try to find a way to
execute some commands and we can see in
payload 6 and playbook 7
we have the answer
what we need so in this moment we find
our remote code execution
on this device so this is a zero day
vulnerability
so now in the
field keypad
sending a specific request concatenated
to the
parameter we have a remote current
execution in this case we send the
command id
to identify who is running the process
in this case it's a remote code
execution
with root privilege
so
now we finish the preparation and
weaponization and targeting now we go to
the next step is cyber nutrition
management enablement and sustainment
entrenchment development
and execution
so basically and this is the moment and
we can act
so can we deliberately explore install
or modify
to gain access to the system of the
victim
and we launched
our command and control
and using methods as a connection to
previously installed
capability
or abusive trusted communications such
as the vpn
and then we have the entertainment
arrangement development and execution
phase
when in this phase documents a variety
of angles that an adversary may have in
this space
is when the adversary acts
so we can discover doom lateral movement
everything we know in
in common i.t
attack
so now our first
victim will be
an operator
of the scada
of the company macros powerplant and now
we will send her a message
uh through linkedin
so we will
put a link of our
scada
wire magazine
and now we will try to exploit
vulnerability and her browser
so for this first we need to
activate
our exploit on the website
and now we can send
the message
so we said i mentioned
saying that i'm a journalist for a
magazine and
if she wants to participate in an
interview and
we add the link for the website
so now we can see in
the linkedin profile of the victim she
received
the message
and she probably links
click the link
and she will have access
to the
website
and see there is a normal
magazine related to
industrial technologies
but in the background you will see
we
execute the exploit on the browser and
we have immediately access
to her machine so we can start to look
for
credentials
and
also we can
look for interesting files
like
vpn or
software like for password management
like keypads for example
and also we can start look for some
files
related to the related to the company
and so for the
second vector infrastructure we already
find a remote execution so we will try
to get some information about that
device
in this case we have the credentials of
the device
so we will now try to crack it
so now we have the password of the
device
so now we can login in the device
and we're now going to change
the dns server
so now we apply the change
so now we can take a look on the victim
machine
and we can see
the dns has changed
so for example if it goes to
gmail.com
so we can see
let's try to connect to gmail
so
any
domain he wrote in
the euro bar is re is redirected to our
malicious
site
so now we can see we have almost the
same information like
credentials
a lot of vpn
config files
and probably more information that we
need for
prepare the next step for the attack
so as
a part of command and control we are
using the same application and this case
is metasploit
and as
we showed previously we have a lot of
information related to
the victims in this case
we have the windows credentials and we
can see
this person is working not only for
macro selectors also for another
power plant
companies
and we can get of course some password
manager like uh keepass
and some sensitive files like uh
details of the infrastructure
so if we take a screenshot of the
big team we can see is a system
administrator for an external company
work for macros powerplant
also we can
use keyloggers for have the password for
the key pass and we can see
he have the system for
almost a lot of
sensitive
infrastructure like the cm scada and the
active directory
so probably this will give us domain
admin immediately without any other
attack
also sensitive files same for lisa
lisa is a operator of this class so we
are interested
also in their
password management
database so we
add a key lawyer
in the attack
so as a summary and we have access to
two important
computers and now we have remote access
to the plan
with the config files
they have in their computer also we can
pivot from their computers too we have
credentials for almost all the
infrastructure and the details of the
infrastructure
so next
is the stage two and i give you
um honest cover
to explain this part
thank you javier um continue with the ic
a cyber kill chamber in its second stage
more especially in the development phase
in this phase the attacking group tries
to create new offensive abilities using
the information from the previous stage
and this is possible because the
attackers have discovered excel
documents with a list of devices in this
case we can see on snyder electric plc
using the modbus protocol
and first it's necessary to understand
the modbus protocol luckily for us this
protocol is really very simple
we are going into
too much details the first seven bytes
of the packets
in red correspond to the header fields
continue with one byte result to the
claria function this can be bt1
to
127 in hexadecimal
finally we have the attack segment the
content of this field will depend on the
function code we use
as you can see the request is very
simple
this one is a value request using the
function called one or read coils
and if a request is valid the response
will keep the function a field
corresponding to 8 byte with the same
value as the original request
but what happens
when the request contains an error in
this case the response will to will
return to buys results
for
exception we have a session function
code which is one byte
and exception code
the first the assertion function call is
equal to the total sum of the value of
the function used
one in this case plus 80 in hexadecimal
so for example if the function call in
the response will be
the value 81
if you will if we use the function call
one
and if we use for example from zero on
code two the response
if the request contains an error will be
82
and we use function 3 and we in the
request contain an error will be
83 and so on
and the second field the exception code
is represented by a numerical value
that will depend on the following flow
so if a request can pass the first
condition illegal function
this means that the function is valid
in other words if the exception call is
different from one the function is valid
so by saying the error messages it's
possible to determine either existency
or the existence of implemented function
and this is very
helpful to build various attacks
it's also important to consider uh an
enabled multiple functions with a
possible attack
so with this knowledge it is possible to
build a tool that can lead the
implemented function the toolsense valid
modbus frames always trying to force
error messages and lease all the
possible functions
or the attack better
so to continue our simulation we or the
attackers will focus in function 43
which is a read device identification
and also function and id
umass which is on a schneider electric
proprietary function differential was
discovery
with a new enumeration tool
so what is a function for t3 in short it
is a function
that will provide device information so
for example a vendor name product code
revision number etc
here are some first tests with
description function 43 so we can see
some information about the plc
and the project
uh the other interested function of a
snyder electric device is the function
called knighting
among the many functionalities or
functions available we are interested in
the following three
40
41 and 20.
we are star plc short pills and read
memory block
so for the final attack we are looking
for a request that can easily generate a
stop on the target device
for which in our controlled environment
request has been sent to our plc using
only function 19 which are in
hexadecimal a
5a
but with random data
so finally it was possible to generate a
denial of service condition by sending
two null bytes as you can see
here in the function
create a
memory block
finally a tool that was developed for
this attack which we call modbus killer
so uh the next phase is validation
in the validation phase uh the aim is to
certify the new abilities or development
in a controlled environment with a
specific hardware
all tests have been performed in a
laboratory environment just as the one
we show below
so the following demo evidence denial of
service with the modbus killer tool
so here we are uh
setting a value a
one for the
sl slide id
one
using the function called f5
to start the
motor
and then we person some panoramic with
the check argument with the modbus
killer
script this is performing a banner run
using function 43 and then we are
sending the exclude argument we will use
a function umass
or function call 90
so we can see that the motor or the
device is stopped
when we send the the two null bytes
so as you call observe the resulting
denial of service or off all the plc
functionalities and also disconnect it
from the network forcing a physical
restart
and the final phase is called ics attack
this stage is used to deploying and
executing the attack
so we have another video that simulates
the final
step
in us in the simulate a macros
plant electric plant
so as you can see we send um the kill
command and the device was
unresponsive
so this is a system to control the
temperature of the weather
and when the plc has stopped
working
the alarm will be
reactivated
and also the temperature will rise
so
uh so just in case these vulnerabilities
we we found have already been reported
to the manufacturers and have their
respective security patch
and here are some a recommendation
overview that you can apply to about
this type of attacks
and finally thank you very much for your
time and do not forget visit us in
our ics research blog and our github
where we probably is exploits and tools
that can help you in your security
audits thank you