start	end	text
1300	9800	Hi, thank you for attending our talk. I wish we were able to see you in person and hope that in the next year that things will get back to normal.
9860	20500	As you can see from the title, the topic is very important because the Internet, the biggest storage of all your funny pictures and memes runs on electricity.
20500	33760	And we are here to talk about internal self-power generation automations, about vulnerabilities that we were able to find, and about what you can do about that.
34120	40700	We are security consultants who have been working with different industrial solutions for many years.
40700	51180	Actually, we have been doing it for so long that we have a long list of contact information of different system integrators and industrial vendors.
51380	62200	So when an asset owner, for instance, a power plant comes to us and asks for a service, we don't just give them information about vulnerabilities that we found.
62200	73440	We closely work with all involved entities, including the vendor, to find together safe and reliable fixes and workarounds.
73780	85720	We work at Kaspersky, and this research is a result of the teamwork, not just of the three of us, but also of Gleb Guritsay, Sergey Andreev, and Sergey Sidorov.
87060	96260	Everything that we are going to discuss today was reported to the respective vendor, I'm talking about Siemens, a long time ago.
96260	105050	But actually, this is not one vendor problem. You can find similar issues in systems of other vendors as well.
105740	114860	We are going to talk about real vulnerabilities in real power plants out there, and at first glance, it may seem irresponsible.
114860	128280	But if you think about it, for good guys to do such research, it's a challenge. You will need to have relevant experience.
128280	136260	You will need to have a lot of time, and you, of course, you will need access to the industrial environment.
136260	141480	There is no welcome sign on power plant doors, right?
141980	151500	So for good guys, for penetration testers, for auditors, for power plant separators, it's challenging to get access to all of the things together.
151540	162060	On the other hand, for bad guys, for those bad guys who would be willing and able to attack a power plant, it's their job to do such research.
162060	169140	They have significant investments, they have a lot of time, but they keep their vulnerabilities to themselves for their malicious purposes.
169420	181400	So we assume that those guys already have all this information, and from our side, we would like to share this information with good guys, with you, so you would be able to act upon this.
182540	188620	Power plants is the main source of electricity on our planet.
188620	203540	And thanks to carbon monitoring, anyone with internet access can get information about where different power plants are located on the world map, what fuel they use, and which is their capacity.
204120	207600	The heart of every power plant is a turbine.
207600	214260	We don't have a picture of a turbine here, but if you ever saw a modern airplane, I believe you also saw a turbine.
214260	217700	This is a giant rotating thing generating electricity.
219240	223440	And on power plants, they look and work quite similarly.
226680	233380	Turbine manufacturers are generous enough to share information where the turbines are used.
233380	237700	Here, for example, a screenshot from Siemens' website.
238720	247340	Turbines are used not only on power plants, they are used in many different areas like chemical or oil and gas and many others.
247340	256560	But if you correlate this picture with the previous one, you will be able to understand a solution from which vendor is used on a particular power plant.
257400	269520	In addition to that, online you can find a lot of information about what solutions are used in certain power plants, in different press releases and marketing materials.
269520	276720	You can find a lot of interesting information about software hardware version generations or different systems.
277060	279740	Sometimes you can even find building plans.
279740	281780	Here's just a small example.
281780	284700	Okay, Google, show me some power plants of California.
285820	289600	Here are just a few power plants of California.
289600	293000	And they have one more thing in common.
293120	298260	They use the same plant control system, SPPAT 3000 from Siemens.
298260	304020	This is exactly the system that we are going to discuss today.
304400	316500	But before we move on to power plant generation automation, let's talk a little bit about power generation process in general, what we are going to automate.
318900	332300	Here and throughout the presentation, we will be intentionally oversimplifying a lot of things, partially to make them more suitable for the audience and partially because, to be honest, we don't fully understand them ourselves.
332840	335700	So let's go from right to left.
337280	341220	First, you will need some fuel. Here is coal, for example.
341220	349280	You put fuel into a combustion chamber, put it on fire, and it generates pressure to rotate a turbine.
349320	358080	The turbine is connected to an electricity generator through a shaft, so when it's rotating, the generator starts generating electricity.
358280	364140	But it's important to mention that electricity doesn't go straight to your house or city.
364440	368620	First, it goes to a special place called power grid.
368620	380320	Power grid knows information about market demands, it receives energy from different power plants, and this is power grid who distributes electricity to consumers.
381160	391400	During the burning process in the combustion chamber, you can have a lot of excessive heat, so-called cold waste heat, and there are different ways how to approach it.
391400	398300	First, you can release it to the air through a condensing tower, or you can reuse it during recuperation.
398800	405860	For example, warm water and send the steam to a turbine to generate more electricity.
407480	415120	Systems that are used to automate this process are called distributed control systems, or DCS.
416420	422140	They are designed to make life of power plant operators much, much easier.
422240	427140	They allow you to conveniently start and stop the power generation process.
427140	435660	They allow you to control the amount of electricity you want to generate, you just enter there the amount in megawatts that you want to have at the output.
435660	438080	And they allow you to monitor everything.
438080	449620	These systems are literally very powerful. They are connected through PLCs, they're connected to many parts of the plant, including the turbine.
449620	466960	And they control such interesting things as the amount of fuel, the temperature in the combustion chamber, the rotation speed of the turbine, and even control the turbine not to go into different dangerous modes.
466960	473280	Obviously, it's not a small piece of software that you just install on the server and it magically works.
473280	485160	It's a very sophisticated system consisting of different hardware, software, PLCs, input-output modules, the turbine itself, and a lot, a lot of things.
485480	490660	And often starting to create such a system starts even from building a structure.
490660	497640	So someone comes to a vendor and says, we have an empty field, please build us a power plant.
497820	504080	And there are many vendors who do this, but today we will be talking about Siemens.
506020	511220	The DCS from Siemens that we analyzed is called SPPAT3000.
511220	525220	Just like other DCSs, it consists of many different industrial components, PLCs, OPCs, different servers, HMI, a lot of things.
525220	535680	And it may have very different architecture depending on the site, but there will be two components that are unique for SPPAT3000.
535680	541140	They are called application server and automation server. And this is how we will structure our talk.
541140	548820	First, we will talk about application server, then we will move on to automation server, and then we will move on to conclusions.
549860	558760	In different manuals and documentation from Siemens, you will see how the system should be built in a perfect world.
558760	570000	For example, they will say that the application network where application server is located should never be connected to any external networks, and how everything should be designed.
570840	577920	However, also, we again here worry over simplifying everything.
579040	586320	In reality, in real power plants, you will meet a lot of interconnections to other systems.
586320	592580	For example, you will need a sensor network to monitor different vibrations inside the turbine.
592980	601320	You will need a demilitarized zone because you will need to get some kind of remote support from the vendor.
601320	606260	You will need to get updates for your operating systems, for antivirus, and so on.
606260	614460	You will need to push out OPC traffic to your corporate network or to a regulator because this area is very strictly regulated.
614460	619040	So, in practice, you will need a lot of interconnections.
620280	626120	The life of our vulnerabilities started almost two years ago.
626120	641160	Back in November 2018, we reported a bunch of vulnerabilities to Siemens, and about a year later, Siemens published an advisory containing information about how to approach these vulnerabilities,
641160	652140	and also a set of other vulnerabilities that were reported by other vendors, other teams, and that's great that this area receives a lot of attention from security researchers.
652820	659820	But also, about a year passed, it doesn't mean that during this year, Siemens didn't do anything.
660600	671120	The thing is, SPPK3000 is an exclusively supported system. It means that a system integrator for this is Siemens themselves.
671120	682900	So, soon after we reported these vulnerabilities, Siemens started to roll out patches and working directly with their clients to fix everything.
683140	686180	So, December is just when this information became public.
688160	695880	We don't have a lot of time to discuss in detail what kind of attacker, what can do with the system.
695880	708140	I will just highlight that CVSS scores given here, obviously, do not represent how critical these vulnerabilities for real power generation process.
708140	713840	They're just individual scores for vulnerabilities in the vacuum.
713840	724140	To better understand what kind of attacker can do what, you can take a look at our threat model that is published in our white paper.
726440	734960	Let's start with application server. Application server is a logical core of the entire system.
734960	741100	Everything has connections to application servers in the logical sense.
741240	745860	If anything needs to connect to the network, it will end up in application server.
745860	751420	Other servers start their work from the loading software from application server and launching it.
751420	753880	So, this is the heart of the system.
753880	758960	And what can possibly go wrong if you open over 40 ports there?
759540	764260	This is for an attacker. This is a huge attack surface.
764980	767960	They are likely to get into their respective network.
767960	770080	They can choose what they want to attack.
770080	775040	Do they want to attack Windows operating system because this is simply a Windows server?
775040	777200	Do they want to attack third-party components?
777200	782800	Or they want to attack own SPP 83,000 services which are based on Java?
784820	788460	Also, we hope that these vulnerabilities are already fixed.
789180	794740	In industrial environment, usually, you don't update your systems very often.
794740	801720	Usually, it's about half of a year or several months between major updates of operating system.
801720	813560	So, it's always possible to find a time window with remotely exploitable vulnerabilities in Windows operating system.
813560	815260	Configurations also could be better.
815260	819480	You can find some statistics for security benchmarks on the right-hand side.
820100	824020	But one of the biggest problems is actually passwords.
824380	829620	The life of passwords has three stages.
829620	832800	At first, passwords were the same for all power plants.
832800	834860	They were default and the same everywhere.
834860	836900	And you can find them online.
837380	841720	Obviously, this screenshot were not from information published from Siemens.
841720	850840	Some power plant operators decided that it would be a good idea to share passwords and a lot of other technical information with the Internet.
851560	859360	But they are available online and we also have a work list in our white paper.
860140	867280	Around 2014-2015, Siemens started to generate different passwords for different applications.
867280	870740	However, the process of changing them was challenging.
870740	875240	You would have to be familiar with the process to change the passwords by yourself.
875280	884540	And only in the last year, in 2019, the process became easier and now you can do it yourself much easier.
884560	890520	Now please welcome Radu who will tell you about vulnerabilities in Java.
892040	893680	Hello everyone.
907810	912730	Let's look how SPP software works on application server side.
912830	917570	Operator can communicate with system through theme or fed client.
917570	929090	In case of theme client, it uses Java plate of Internet Explorer and communicates with server over HTTPS.
929090	936530	So it can be outside of application network and its communication can be constrained by firewall.
936530	942770	In opposite, in case of fed client, operator should belong to application network.
942770	958110	And fed client directly communicates with RMI registry to found RMI services and after that directly communicates with Sys services.
966640	972080	Illustration of SPP architecture was kindly provided by system through a public URL.
972080	976160	So not to be missed, let's divide it into spaces.
976540	982100	In red zone there are items that process HTTPS requests.
982100	986080	And in green zone there are RMI services.
986080	992300	RMI service looks like network services which assert on dynamic TCP ports.
992780	996360	SPP consists of containers.
996860	1001100	All types of containers are represented on these illustrations.
1001100	1007060	And containers have self-explanatory names.
1007060	1015540	So before we go deep inside internals of SPP, let me introduce some tools which used in this research.
1015540	1022320	First of all, all jars files of SPP are obfuscated with commercial product.
1022320	1026860	But this security measure can simply bypassed by public available tool.
1026860	1032220	Secondly, sometimes it is useful to see how legit software communicates with server.
1032220	1038040	It helps to understand architecture and to see client workflow.
1038520	1042100	In case of SPP, RMI desector was written.
1042100	1047000	It represents raw TCP streams and in human readable format.
1047000	1051640	Inside it used read object method of SDK.
1051640	1058900	It is known that this method suffers from insecure deserialization vulnerability.
1059180	1063440	So be sure not to be exploited through remote pickup.
1065620	1069560	The first pillar of SPP is Apache web server.
1069560	1076360	According to its configuration, folder Orion Software Config can be accessed by unauthorized user.
1076360	1087660	But in fact, this folder contains some critical information about application and about items of application and automation network.
1087660	1094860	Also, configuration of Orion web application in Tomcat also can be accessed.
1096020	1101400	Tomcat, there are three web applications registered in Tomcat.
1108010	1113230	There are Remote Diagnostic Service, Manager and Orion.
1113290	1124090	According to configurations of Apache and Tomcat, all these applications can be accessed by unauthorized user.
1125090	1130230	Inside Orion web application there are seralettes which can be accessed.
1130230	1137460	All of them are listed in configuration web.xml and the list is huge.
1137790	1144150	Some of seralettes has attractive names for attacker.
1145150	1157130	For example, BrowseSeralette allows unauthorized user perform directory listing on arbitrary folder.
1157130	1162490	But in case of exploitation, another seralette is more useful.
1164650	1171570	FileUploadSeralette allows unauthorized user perform file upload
1171570	1182980	and folder is fully controlled by parameters based on target name of HTTP request.
1183150	1188680	This vulnerability can simply be bypassed to remote code execution.
1190820	1202940	For example, attacker can corrupt some startup scripts of SPPoA or simply inject JSP Shell in Tomcat web application
1203980	1208120	and get remote code execution with system rights.
1213140	1217280	Also there are seralettes which has service factory in its name.
1217280	1222560	This seralette redirects HTTP request to RMI services.
1222800	1234320	Inside it uses parameter service url of HTTP to identify RMI service which will be called
1234320	1246220	and serialized object in data section of HTTP request contains information about method and arguments which will be called.
1247260	1258300	So there are situations when themed client and fan client can communicate with RMI services.
1258300	1268780	But in case of fed client, it can communicate with RMI registry.
1268780	1279620	So if application server miss some important security updates of Java, then server contains insecure deserialization vulnerability
1279620	1289960	and public available tool ySourceSerial can exploit it and perform remote code execution with system rights on server.
1289960	1296640	So the next task will be to identify all input vectors for attacker
1296640	1303800	and for this task we will try to list all RMI services in system.
1303800	1311240	At first step we will use class LocateRegistryOffice.com and get big list of RMI services.
1311240	1322840	All but one are Jamex RMI services and I assume that they used to control and manage containers of spp.
1322840	1328860	For further investigation we will choose Lockup service.
1328860	1343020	In fact, it looks like a collection of next level RMI services and using its public methods we can get the reference to this next level RMI services.
1343340	1349920	Next level RMI services should implement InterfaceServiceFactory.
1350920	1371720	So it also looks like some collections of another next level RMI services and using public methods getService and parameters such as clientId and name of the service.
1371720	1379900	The instance of next level RMI service will be created and reference to it will be returned to client.
1381700	1391880	And this next level RMI service is a server which performs real job of spp.
1391880	1402380	But in fact it contains a lot of public methods which can be accessed by unauthorized user.
1402800	1408340	So input vector of spp is very huge.
1408340	1415760	The next question is to understand how authentication performs on a system.
1415760	1423470	For this task let's look how client performs request to security service.
1424760	1436060	To do this first of all client tries to get reference on security service with some clientId.
1436060	1442420	It needs to PCServiceFactory use this clientId to get valid session in SessionManager.
1442420	1451560	If SessionManager will fail then exception will thrown and client request will be rejected.
1451560	1458900	But in case of success valid sessionId will be returned to PCServiceFactory.
1458900	1474220	And in its turn PCServiceFactory create instance of security service where sessionId will start in loginId.
1474700	1479240	And reference to this instance will be returned to client.
1479240	1485420	Further client can call some public methods of this service.
1486900	1495180	And in its turn these methods can perform some privileges checks of client.
1495240	1499600	So we have two security measures of system.
1500180	1508300	But there is a question how client can perform login operation on system if he doesn't have any valid clientId.
1508300	1518340	For this task at startup of SVPR SessionManager create anonymous session with clientId 0.
1518460	1524380	And client use this clientId and perform login operation.
1524380	1530500	But attacker can also use this and simply bypass this security measure.
1530500	1544780	To sum up, there are a lot of RMI services which has a lot of public methods.
1545240	1550440	And permissions checks are fully delegated to these methods.
1550440	1556840	So it's really difficult to perform security management of this system.
1557920	1563360	So we understand all input vectors and security measures.
1564200	1568190	So it's time to find vulnerabilities.
1568800	1573800	In the list of RMI services there is admin service.
1573800	1576680	It can be accessed by an authorized user.
1576680	1581340	And its public method transcript doesn't have any privileges checks.
1581340	1590680	In fact inside it first step create instance of class loader using bytes from arguments.
1591500	1596540	In fact this step will load arbitrary Java class.
1597280	1603160	This class should implement interface admin script and defined method execute.
1603160	1608460	This method will be called by run script of RMI services.
1608460	1618620	For this case we create Java class which simply run OS command.
1618920	1622920	And this OS command will be run with system rights.
1623340	1633840	In fact there is more powerful post exploitation because we inject arbitrary Java class around SPPS software.
1633840	1642740	So we can use some Java reflection and patch some private variables of SPPS.
1642740	1652320	And as a result we can corrupt some technological process of SPPS.
1653400	1662340	To bypass privileges checks in methods we can use second vulnerability.
1671020	1678800	It's using RMI session service and its public method get login sessions.
1678800	1685640	Attacker can get information about all login user on the system.
1685640	1693820	This information contains user names, IP and client ID of login users.
1693820	1709680	Attacker can reuse this and if in this information there is a user with admin rights
1709680	1722660	then attacker can simply reuse his client ID and get the reference to security service with more privileged session.
1723020	1730940	And after that attacker can call public method get all users of security service
1730940	1737580	and as a result get all private information about all users on system.
1737580	1742740	Moreover password hashes also contains in this information.
1744900	1755760	Both of these vulnerabilities can be accessed from either external or application network.
1755760	1765700	All communications between RMI services are unencrypted so username and password hashes are transferred in plain text.
1765700	1771820	Moreover system doesn't have any session protection mechanism.
1772060	1781680	This fact is more critical in case of fed clients because of attacker can perform meat attack on the user of SPPS
1781680	1788760	and get valid username and password hashes from the traffic of user.
1788760	1799960	And after that simply reuse this username and password hashes and perform login operation on the system.
1799960	1807940	Moreover attacker can also change the password of the user.
1808220	1815740	I talked a lot about password hashes and users so it's time to understand how these items are organized on the system.
1815740	1817220	Alex, you're welcome.
1819960	1824540	Hello everyone. Let's continue our discussion about application server.
1824600	1828420	On the previous slide you could see how remote authentication works.
1828420	1831400	Now I'm going to tell you about how it's organized locally.
1831440	1842180	After the system gets started it begins to read the content of files users1.xml and pdate1.xm to get user list and their password hashes.
1842180	1848400	User1 is a simple XML while pdate1 has a slightly more complex structure.
1848400	1851300	It's a gzip archive encoded in base64.
1851300	1858200	There is a javascriptization object in the gzip archive containing a specific XML.
1858200	1863020	The fields of this XML from pdate1 file are presented on the slide.
1863020	1869490	They are used to calculate password hashes and check it during user authentication.
1869490	1876930	At the bottom of the slide you can see a password check algorithm in a pseudocode.
1876930	1881930	The cryptographic scheme is a typical crypt hashing scheme like in your Unix and Linux machines.
1881930	1889210	It has solved different number of iterations and the only one thing which was added is hardcoded salt.
1889210	1894530	The same for all users which is concatenated to the password.
1895670	1902370	The tool to extract password hashes and their parameters from pdate1 file has been developed.
1902370	1905370	Its output is presented on the slide.
1905750	1914110	The tool can be used during password auditing to check weak or dictionary passwords and their hash calculation parameters.
1914110	1919510	The tool is available in our GitHub repository.
1920650	1923450	Draw the line under application server analysis.
1923450	1932110	As you have seen, the attack surface is really huge and includes Java and MySQL systems, Tomcat applications and a lot of others.
1932270	1936170	Secondly, it's about remote connections.
1936670	1944250	Whether SPP has or has not remote connections according to vendor, system integrator or someone else, you should check it.
1944250	1948630	And the good starting point for this is application server.
1948630	1957530	Because OPC maintains remote operator, all of these things will end up on application server.
1957530	1970170	Thirdly, despite the fact that there is automation network between application server and field devices, an attacker can affect generation process from application server.
1970170	1979530	These actions include to start stop generation, change power output or just get information how power plant works.
1981370	1989250	Of course, such manipulation will always be visible for operator, always monitoring technological process.
1989250	1997690	So a real attacker will also be required to change or modify data on operator's HMIs.
1997690	2001690	But it's also possible with real security issues.
2002470	2004910	That's all about application server.
2004910	2011930	Now let's move on to another main component of SPP infrastructure, automation server.
2014070	2022870	The main goal of the automation server is to execute real-time automation functions and tasks for power plant control.
2023830	2035050	Depending on power plant project architecture and features, the role of the automation server can be different.
2035050	2037130	We have distinguished three roles.
2037130	2039130	And the first one is automation.
2039510	2050830	There may be slight confusion because the term automation is used both for server and its role, but analyzing automation server configuration and publicly available information about it,
2050830	2057310	we have found that whatever the role is, almost the same hardware and part of software are used.
2057310	2063170	So we have decided to use this kind of role classification, which seems less confusing to us.
2063170	2068570	But at the same time, it's slightly different from the vendor's one.
2068570	2081850	Anyway, having an automation role means that the server is responsible for interaction with input-output modules, which control and monitor power plant equipment such as turbines or electric generator.
2082130	2084870	The second role is communication.
2084870	2089810	This role is used to communicate with third-party systems.
2089810	2099830	In another words, it's just a protocol converter, supporting such protocols as Modbus, IEC 101, 104, and some others.
2100090	2101990	And the last role is migration.
2102730	2113450	In this role, the server is used to connect previous versions of SPPA, such as SPPA-T2000 or Teleperm-ME.
2113450	2121530	In the automation role, the automation server can be run both on schematic-assigned PLCs or industrial PCs.
2121530	2126210	In the case of other roles, it can be run only on industrial PCs.
2127630	2136390	Let's talk a little more about each role and let's start with the automation role based on PLCs.
2136430	2142870	PLCs are what directly control field devices and access to them is game over for any security discussion.
2142870	2150670	Any configuration changes and updates for PLC are required to stop technological process.
2150670	2160070	Therefore, these devices usually have security misconfiguration and firmware without security updates.
2160090	2168850	Another common security issue for PLCs is using unsecure industrial protocols.
2168850	2175870	In the case of SPPA, there are schematic S7 protocol and PLC data protocol.
2177010	2183010	There is quite a lot of information about S7, but not so much about PLC data protocol.
2183010	2186510	So we had to deal with it and analyze it ourselves.
2186870	2189330	It's not a special protocol for SPPA.
2189330	2197730	When you program your PLCs and you need to exchange some data between them in real time, you use this protocol.
2197730	2205210	It's pretty simple and maybe its description is available somewhere in the internet, but we couldn't find it.
2205210	2207950	So just in case, I'll show its structure here.
2208510	2217730	It doesn't have any security mechanism and the only obstacle while dooming in the middle attack to spoof data is a sequence number,
2218330	2222550	which we can get from a packet and just a fuzz incrementation.
2224050	2230790	For protocol analysis, Wireshark Dissector has been developed and is also available in our repository.
2232050	2243790	During PLC security assessment, one of the main things which we check is unauthorized access to reading and writing the PLC memory.
2243790	2256150	Availability of unauthorized access is determined by the position of mode selector of schematic PLCs and some other configuration parameters.
2256470	2265230	The matrix on the slide shows unsecure states for schematic PLCs when unauthorized access is possible.
2266390	2278310	The tool for gathering information from PLCs over the network and for its analysis has been developed by one of our colleagues and also available in our repository.
2281800	2286440	Now let's talk about automation server based on industrial PC.
2286440	2291520	The workflow of all roles in this case is quite similar to each other.
2292360	2297880	When automation server is based on industrial PC, it's just a Linux box.
2297880	2303740	During the start, it tries to download some additional files from application server.
2303740	2316560	These files include JARs, which represent SPPA runtime containers, Barscript, some configuration files, and other.
2316560	2323020	In order to execute downloaded JARs, PTC PERC virtual machine is used.
2323020	2331920	It's a real-time Java virtual machine widely spread in industrial and military areas.
2333280	2341600	After that, running JARs open RMI services or some of their extension.
2341600	2348180	In case of migration server, Orion RPC services, which are extension of classic Java RMI services, are used.
2348180	2351780	And you can see their listing on the slide.
2353260	2359400	Automation server based on industrial PC has following security issues.
2359400	2367600	Firstly, there is a possibility to spoof downloaded from application server files.
2370360	2379080	These files are downloaded over HTTP and there are no security mechanism like authentication or integrity check during this process.
2379080	2382120	Secondly, it's about using default credentials.
2382120	2384600	Username admin with password cm.
2384640	2388680	Thirdly, it's RMI services running on automation server.
2388680	2397980	The research has found two vulnerabilities in Orion RPC services, which allow to perform sensitive data exposure and RCE.
2397980	2412460	And the last group is vulnerabilities found in the software used to fulfill a migration role for connection previous version of SPPA.
2413540	2418000	SPPA-T2000, also known as TXP.
2421020	2433880	All these vulnerabilities found in migration server software are related to different kinds of overflow, stack, heap, integer, and other.
2433880	2447300	Actually, there are so many overflows here that this talk would be overflown by that if we started to describe all these vulnerabilities in details.
2448580	2458530	If you want to know about RPC vulnerabilities, these vulnerabilities have been found in runtime engineering service.
2459740	2471440	This service has a method, requestRuntimeContainer, where the first argument defines an action to be executed.
2471440	2476320	Using the action readFile, it's possible to read any file from the system.
2476320	2483200	Using writeConfigFile action, it's possible to write any file to any folder in the system.
2483260	2492380	For example, it can be jar file, which executes shell command from the command line.
2492380	2503400	Then, using the same requestRuntimeContainer method, it's possible to execute this jar later.
2504640	2507060	That's all about automation server.
2507060	2513260	To sum up, automation server can be run on PLC or industrial PC.
2513260	2519420	In case of PLC, it's a usual PLC with well-known security issues.
2519420	2531500	In case of industrial PC, it's a Linux box, which tries to download jars from application server and then executes them with PHP or virtual machine.
2531500	2540580	An attacker can spoof downloaded files or just exploit revealed vulnerabilities in network services.
2542140	2550820	So far, I haven't mentioned any network equipment used in distributed control systems.
2551180	2557280	During the research, we saw a wide variety of network devices and network infrastructure.
2557280	2566760	They include different kinds of switches, routers, firewalls, and more rare devices, such as data diet, for example.
2566760	2575740	We tried to summarize all this information and got common SPP network topology scheme presented on the slide.
2577520	2593000	We have shown in purple usual places for network devices, but it also should be mentioned that the same devices in the same places can be found in other distributed control systems from other vendors.
2594720	2601100	Network devices in industrial network usually have a lot of security issues.
2601100	2609760	The reason is these devices don't require any configuration and can be run out of the box.
2609760	2625180	Therefore, the things like weak community strings in SNMP, weak credentials in HTTP, FTP, Telnet, and other services, firmware with publicly available exploits, and just security misconfiguration.
2625480	2629820	All these things are common and typical for industrial network devices.
2629820	2640960	Additionally, some industrial protocols, for example, such as Profinet-DCP, can allow to get or set network configuration of these devices.
2641100	2653260	In case of Profinet-DCP, it also can be very useful for device enumeration.
2653260	2672300	And the last thing about industrial network devices is always remember that these devices with years of uptime can act unpredictably for completely legal and normal activities, such as browsing a webpage with statistics or logging into Telnet.
2672620	2678360	Here, my part is over, and now Evgenia will sum up our speech. Thank you.
2678880	2680680	Thank you, Alex.
2680680	2687660	So, the topic of power plants is huge, and the topic of DTS is huge.
2687660	2709400	We just tried to poke a couple of things here and there, and showed that to affect the power generation process, you don't have to go deep to the field level, to PLCs, but you can focus on higher logical levels, like application server and automation server.
2709400	2718940	What we do not talk about today is havoc or damage that you can cause by such attacks. Actually, that's because it's not that bad.
2718940	2733700	If you already imagine a hacker in a hoodie who writes a couple of lines, and after that, the entire city goes into the darkness, it's not like that, because it's power grid who is responsible for power distribution.
2733700	2736500	This is not a power plant.
2737170	2746500	So here we mostly talk about more local damage, like would it be possible to damage a turbine.
2746500	2771460	Since a turbine is connected to a DCS through PLCs, and the turbine is a giant mechanical monster, and it self-degrades by working, probably by putting it into different uncomfortable modes or quickly starting and stopping it, it would be possible to make it degrade even faster or even break it.
2772240	2780560	We were not able to check it. Unfortunately, or actually, fortunately, we were not able to find a spare turbine on eBay.
2780780	2789120	But we are making an educated guess that the damage is out there based on the system architecture.
2790060	2806460	We wanted to make life of power plants a little bit easier, and we prepared a small do-it-your-own assessment guide that you can use to check your SPPAT3000 system for vulnerabilities that we will discuss today.
2807860	2815240	You just connect your laptop to a couple of places in the network, go through a simple checklist.
2815240	2830340	You don't have to hire expensive security consultants for that. And after that, you can fix some parts yourself, or you can call your system integrators to discuss what to do further.
2831740	2841240	Just any other industrial system. DCSs are not so good in terms of security. It could be better.
2841240	2870260	And we recommend you to take a look at ISAIC 62443 set of standards to know what to do to improve security in terms of communicating with different entities, because in the industrial area, it's usually a challenge when you, for example, when a vendor is not interested in fixing something.
2870260	2882440	So it describes in particular what kind of relationships you can build with regulators, with vendors, and other parties involved in the industrial area.
2883200	2891980	Of course, update your systems, change your passwords, improve your configurations according to the vendor security guidelines.
2891980	2901800	We also recommend you to set up monitoring since most servers are based on standard Windows and Linux boxes.
2902440	2910800	You will not be able to detect different Java attacks, but at least you will be able to detect some parts of attacks.
2911060	2921720	And again, this is more about DCS and industrial security in general, rather than by one system by a single vendor.
2922520	2935580	We released a lot of information. We released a white paper, different tools that we mentioned today. I recommend you to take a look at our GitHub page to find all of that.
2935580	2952700	And we would like to thank Siemens product search, who made all the communications very effective. They were very responsive. They allowed us to contact Siemens product team. And of course, they released the patch.
2953240	2964900	Take a look at the advisory and Siemens always tries to raise awareness of their users, how to better build such systems.
2964900	2979220	What are better configurations, but they also highlight that it's not the vendor who is solely responsible for security of an industrial environment. There are a lot of things that power plant separators
2980640	2987480	can and must do themselves. So please follow the guidelines for that.
2988260	2995680	That's all for our talk. Thank you very much for your attention and we will be glad to answer any questions.