Guys, we have our next talk that is about to start.
It will be given by Vladimir Dushchenko.
Unfortunately, his partner, Sergey, cannot be here,
so he's going to be handling this one solo.
And it's going to be on pawning the industrial IoT.
RCEs and backdoors are around.
All right, thank you.
Hello, everyone.
Thank you for joining our session with Sergey.
He's supposed to be standing right here next to me,
but unfortunately, he cannot come here due to, like,
a super long process of getting a visa to the United States.
But anyway, Sergey, hi.
And, yeah, today, me and Sergey,
we're going to talk about the different vulnerabilities
that we have identified for the last, I guess, 15 months
in different industrial devices.
But we will be focusing on the industrial Internet of Things.
So.
So I will give a brief explanation what is the industrial Internet of Things,
what we have identified.
But first, I would like to mention that me and Sergey,
we are working at the nonprofit project in Kaspersky Lab.
It's called Kaspersky Lab ICS SERP.
And basically what we do, we do different vulnerability research.
We do different sophisticated malware analysis.
We are trained.
We are tracking different sophisticated attacks
on the industrial components and stuff like that.
So we are a group of people who has, like,
different and super cool background in malware analysis,
penetration testing, security audits,
security analysis, and blah, blah, blah.
All right.
So what is the industrial Internet of Things?
So you guys probably know that there are, like,
normal general Internet of Things, like, right behind you, right?
So this is a new type of the concept, like general Internet of Things.
New type of the concept when different vendors are trying to make any product smart.
Smart this, smart that.
Everything is smart.
People are smart.
Things are smart.
But industrial world is also trying to go towards that way.
So you probably can hear about or heard about the different,
different smart meters, smart devices, and stuff like that.
It helps to industrial companies to lower the expenses on different things.
For example, smart meters are trying to help to track how much electricity we're using
and, like, maybe we can, like, reduce the usage of electricity somewhere.
Anyway, so this concept means that everything is connected.
The smart industrial devices are also connected.
Right?
And they are connected with the, like, operators level.
So all the information, all the metadata is going to the operators level.
So the human can process that and can see, like, what's going on with the data.
Yeah, basically, what is industrial IoT?
Yeah, it's a fancy and cool concept, right?
It's a fancy and cool solution.
But still, it has...
It has the old security problems.
If we will take a look, if we will, like, see the low-hanging fruits and the vulnerabilities,
even in new solutions in industrial control systems and, yeah, industrial IoT stuff,
we will see that there are also still hard-coded passwords,
I don't know, super stupid cross-site scripting vulnerabilities and stuff like that.
But there is something bigger.
This is the basic statistics that we have identified.
So how many vulnerabilities and types of the vulnerabilities we have found.
As you can see, the major part goes to the denial-of-service vulnerabilities.
But the thing is that in industrial world,
DOS vulnerabilities can be way more dangerous than remote code executions.
So...
If there is, like, a technological process and the attacker is trying to exploit the
denial-of-service vulnerability, that vulnerability, that exploitation can stop the whole technological
process.
So they will start using the money, losing the money, or something more dangerous can
happen.
Yeah, we also found several injections, file manipulations, and there is one vulnerability
right here.
The account manipulation.
It's basically, it's not a bug, it's a feature, I was told by the vendor.
So the thing is that the remote attacker can disable Legimate user for, like, two or three
hours, so the user will be blocked totally.
So we submitted that vulnerability to the vendor, and the vendor was like, hey, you
know what, it's not a bug, it's a feature, you can increase the time, like, in the configuration
file.
I was like, well, okay, it's not going to take, like, two hours, not two hours, but
three hours.
And they were like, we can just input this, you know, thing in our FAQ document so they
can just increase the time to ten hours.
I was like, well, it doesn't make any sense.
So there is no CVE for that type of vulnerability, but, well, it looks funny.
Anyway.
So basic vulnerability research approach.
First of all...
First we start researching the custom-made protocols.
It's super cool and it's super interesting to go deeper into the, like, custom-made
protocols.
Then we start playing with the DECOM protocol, and then we were playing with OPC UA.
Did anyone heard about the OPC UA?
Cool.
Interesting.
That's awesome.
So OPC UA...
It's a concept.
It's open source type of the protocol and the way of communications of the devices.
So yeah, the source code is available.
And basically this is like a Lego for industrial companies.
So using those tiny bricks of the OPC, any company, any vendor can build, like, a huge
system on that.
And the new approach is the common solutions.
So we have identified that there are...
There are lots and lots of different common solutions among the, like, hundreds of different
vendors.
So here are the examples.
The first thing is about the custom implementation of the...
Excuse me.
About the custom implementation of the XML.
So we have identified that if you're inputting the random data without knowing any, you know,
tags.
The server side returns you the, basically, what are the tags and what are the fields
should be.
The legitimate fields.
We were like, okay, that looks interesting.
So basically if you're input, like, XXXX, the XXX thing, it starts, you know, comparing
if there is a field naming XXX with the real ones.
And he's like, this thing is going through the whole thing.
And shows, like, if XXX is equal to, like, AC, EC computer, object, and blah, blah, blah.
Then we enhanced that thing.
And, like, we have found that there are, like, different and different.
So we basically have built the whole tree of the XML.
That looks great.
And that basically gave us the remote code execution.
Okay.
But it wasn't the binary remote code execution.
It was the logical remote code execution.
Which looks better than the binary one.
The second example is about the OPC custom implementation.
So this is basically the whole proof of concept of the denial of service.
We have, like, internal feeling that there is remote code execution behind that.
But we still haven't found the way how to exploit the remote code execution.
So, yeah, this is the example how the, the, how we have identified that.
And you have it just, you just need to send, like, a tiny packet to exploit the vulnerability.
And that's it.
The system goes down.
And my favorite example.
So if you probably, if you remember.
How do you do that?
my presentation yeah let me just show the name of the presentation right here
right so you see it like there are remote code remote code executions and
this word this this vendor didn't want me to name that word so I decided to
change that word into the other one you will see now so yeah custom protocol but
first custom protocol so first we have identified this thing just in like ICS
and industrial IOT things but it became huge like super huge so there is a
custom-made protocol so if you interact with that protocol as a
protocol as a custom-made protocol so if you interact with that protocol as a
with the HTTP server it will work with you as like HTTP server if you input
binary data it allows you to do like some binary things with that so what
happened these guys they had a custom made you
know packer for for their solution so they wanted to protect their solution
from like researching and stuff like that but for some reason
for some reason they have removed removed well-known security things for
example can we stack like safe cookie and stuff like that basically what does
it mean if you find like the the the point where the this thing crashes you
can just go like you can just exploit the remote code execution like super
good so if you
if you're paying attention to the security in the code and you
you will see that there is like aaa and so it goes like really good and fast so it allows you
to do the remote code executions but after after we have submitted the vulnerability to the uh to
this vendor strange things started happening uh we submitted the vulnerability uh in december
december 5th uh 2000 uh what is it 16 16 right so we submitted them two different uh remote code
executions and 11 daniel service uh then i sent one more reminder because i didn't get any feedback
from them uh then i sent one more reminder and one more reminder and um in january of 2017 i got
the feedback from them that they received our vulnerability report and stuff like that uh then
i was sending them reports almost every month but nothing happened so they were just sending me back
like uh
like hey just uh yeah thanks for your email uh you just have to wait for our feedback uh then they
uh in when was it may or june they have submitted a new version of the driver but they didn't make
any announcement after i didn't know that and our team didn't know that and we were still sending
them emails and they were still replying that hey we're still working on that problem but the driver
is updated
it turns out that even after the driver was updated uh the uh they didn't submit the new
version of the driver to to the like microsoft so if you update your windows system it will not
get the new version of the driver that's that looks strange um after we decided to do this
defcon talk on this vulnerability i have sent them email saying that hey guys we're gonna do like a
uh iot village talk on the devcon about this vulnerability and they were like oh hold on
a second we got the uh we got actually the advisory published but the advisory is on the
like private website so you cannot like get it like online so you have to get the uh you have
to log in somewhere get the advisory and stuff like that they didn't want to submit any cves so
we did that for them um and yeah we of course notified the um usac cert on the, we are notified
this vulnerability because the thing is that first we thought that this
vulnerability is only like in like super custom-made solution and it and we
didn't pay an attention but then we start like looking deeper and wider and
we have identified that it's super huge yeah so those CDs are already it turns
out that these guys they work with the thousands and thousands vendors under
the OEM under the OEM theme and basically each vendor has thousands of
the clients right so we still don't know how many people and how many companies
are still vulnerable and we don't know how to notify everyone we didn't know how
to notify everyone too
to update the driver so this strange things started happening we continued
our research on that and we have identified several strange functions
yeah some functionality okay so basically what if you can remotely
remotely turn on and turn off the administrative panel
you can turn on and turn off the administrative panel
you can turn on and turn off the administrative panel
using undocumented API functions what if you can remotely make a
configurations on the computer do the changes in the configuration file using
the legitimate API functions again and it will not be so the security
administrator will not see that right how do you call that
how do you call that what's the name for that I'm not allowed to say that word
what's the name for that I'm not allowed to say that word but anyway so it turns out that the those guys
so we're doing some stuff someday I have no idea when so when we reported this
functionality undocumented functionality to them they were like no no it's not
it's not the bear it's not that thing it's our mistake in the code and we were
like hey you just have a hidden functionality like in your solution right
but like how can we manage that so how can we how can we how you cannot agree
but like how can we manage that so how can we how can we how you cannot agree
with this word and they were like no we don't agree with this or so we decided
to call like not a bear thing yeah this is the basically what I have just said
like remotely enable and disable admin administrative panel is nondocumented
and the panel is available by default on like the local host right and the other
thing is that basically if you have a Windows based computer right and the
computer is locked right so you can just take this thing you know this USB device
like it's official thing from from the vendor like it's not fake you just plug
in this thing right what happens next the driver the vulnerable version of the
driver is being uploaded from the like Microsoft service right the this thing
opens a port the port is being added to the like a legitimate and open port to
the Windows
system
firewall and the bit Windows firewall allows that port open and that's it
that's done basically right you have the like the vulnerable Windows machine with
open port and with some strange functionality so we started researching
that thing and so the manipulations from the configuration file so basically you
can change the the proxy server for the binary updates so if the attacker change
the
proxy server for the binary updates so you know what's gonna happen and we also
have identified that it is possible it is possible to capture the NTLM hash of
the built-in user of like there are several built-in users in the Windows
operation system so you can capture that NTLM hash function and that's it so
we submitted the thing to the vendor and they were like hey you cannot do the SMB
relay attack I was like yeah of course we cannot do because like it's a building a
user so it's not possible but still there is a possibility to do that so we
decided to we agreed with the vendor to publish this advisory so but the thing is
that we don't want to leave the world like you know vulnerable we decided to
provide like open source and free overall definitions so they are available and you
can download them and you can use the Mitre tool to you know to play with those overall rules all the
definitions and you can check if your system vulnerable or not vulnerable to
that thing so yeah the alert is being well is available here under this link
link and so what are the conclusions so if the best thing is which can help to
protect this world is knowledge sharing if you share the knowledge like everyone
will be protected the second thing is well if you made a mistake someday
you have to admit it you have to admit that well there was a problem but we
are doing our best to fix the vulnerabilities and of course if you
are going towards the new concepts for example industry 4.0 or like
industrial Internet of Things or blah blah blah whatever well you have to do
it right you have to put this security on the basement everything should be
secured by design not like you know those things and of course if there
are different third-party solutions I used in in a huge like industrial or
industrial systems or industrial Internet of Things you have to test them
properly so if you are like if there are any vendors and if you are using the
different third-party solutions you have to test them first you have to see like
the source code or you have to do the vulnerability research of that so you
have to work you have to do what you have to do okay
that's it thank you
yeah so if you have any questions I'll be happy to answer yeah yeah
oh it's different
it's different our so our research group is working on the so we're CERT
with like we're like a computer emergency response team so what do we do
we do the like vulnerability research incident response if the customer asks
us to do the penetration testing we do that so it's like we're research
department the research group of people
actually do that uh so in a job it just works like that every time the
let me show you so yeah you're talking about like this case yeah so basically
they have turned off not turn off but they didn't use for example safe cookie
there there is a special mechanism it's called like safe cookie and they didn't
use that like when they were writing is the code for that binary and like they
didn't use like a really common and the world-known security mechanisms yep
all right