On the insecure nature of turbine control systems in power generation
Gritsai, Gleb (repdet)
Motspan, Radu (@_moradek_)
c0rs
Korotin, Alexander
A deep dive into power generation process, industrial solutions and their security implications. Flavoured with vulnerabilities, penetration testing (security assessment) methodology and available remediation approaches. The research studies a very widespread industrial site throughout the world – power generation plants. Specifically, the heart of power generation – turbines and its DCS – control system managing all operations for powering our TVs and railways, gaming consoles and manufacturing, kettles and surveillance systems. We will share our notes on how those systems are functioning, where they are located network-wise and what security challenges are facing owners of power generation. A series of vulnerabilities will be disclosed along with prioritisation of DCS elements (hosts) and attack vectors. Discussed vulnerabilities are addressed by vendor of one of the most widespread DCS on our planet. During the talk we will focus on methodology how to safely assess your DCS installation, which security issues you should try to address in the first place and how to perform do-it-yourself remediation. Most of the remediation steps are confirmed by vendor which is crucial for industrial owners.
 One of the obvious critical infrastructures we have nowadays is power generation. If there's no power, we're pretty much screwed. Our next speakers will take a very close look at common industrial control systems used in power turbines and their shortcomings. So please give a warm round of applause to Reptap, Moradek and Kors. Good morning Congress. Thank you for waking up in the morning. We will talk about the security of power plants today, specifically about automation systems that are used in the power plants. You might think that this is another talk about how insecure the whole industrial things around us are, and more or less it is. So for years we are, we and our colleagues speak about problems in industrial security. We are happy to say that things are getting better, but it's just that the temper is a little bit different and feels a little bit uncomfortable. So anyway, we will speak about how power plants are built, what is the automation inside, what are the vulnerabilities, and the high level overview of what you can do with this. But at first a little bit of introduction. We are security consultants. We work with a lot of industrial things like PLCs, RTUs, SCADES, DCSS, whatever it is. We were doing this for too long. For so long that we have a huge map of contacts with a lot of system integrators and vendors, and throughout the time we are not just doing the consultancy work for some asset owner, for example for a power plant, we also talk to other entities and we try to fix things all together. We work at Kaspersky and actually the whole research was done not just by me, Rado and Alexander who are here, but also with the help of Evgenia and two Sergays. Things, yeah. So things that are very important to note is that everything that we will discuss right now is reported to a respective vendor basically a long time ago. You can see like vendors here, but more or less we will speak only about one vendor today. It is Siemens, but we would like you to understand that similar security issues can be found in all other industrial solutions from other vendors. You would find some of the findings, not for example that seller and it doesn't require like weeks of work to find them out and this would be true specifically for all other vendors which are not mentioned in the talk. Jokes aside, we will share security issues of real power plants out there and it might look like we are kind of irresponsible guys, but in fact this is the other way around. I mean that to do some kind of research with these systems that are working in the power plants you need to get access to them, you need time to do this research, you need to have some knowledge to do this research and all these resources they are limited for guys like us for penetration testers, for auditors, for power plant operators and engineers. But for the bad guys like the potential attackers or adversaries, this is actually their job. They have a lot of investments to do some research. So we assume that bad guys already know this and we would like to share some information with the good guys so they would be able to act upon this. So let's go to the talk itself, power plants. Power plants is like the most common way how humans get their power, their electricity, they are everywhere around us and I believe the closest one to Leipzig is called Lipimdorf power station and during this research when we were preparing an introduction we were surprised how many information about power plants you can get from the internet. It's not just for example a picture of the same power station on the Google Maps, it is a very good scheme of what you can see on the marketing materials from vendors because when they sell some system that automate power plant operations they sometimes start with building construction and on their websites you can find a schematic pictures of actually which building does what and where you will find some equipment, which versions of equipment are used in these systems. But if you don't have this experience you can just Google things and you will find out which systems are used for automation in power plants. For example for Lipimdorf it's some system that is called Siemens SPPAT2000 and P3000 which actually have another Siemens system inside called Siemens SPPAT3000. So it's a little bit confusing and it is and we are still confused. This is exactly the system that we will focus today, the Siemens SPPAT3000 and again it could be any other automation system but it just happened the way that we've seen this system more and more often than others. There is a way how you can actually see all the generation sites throughout the world thanks to the carbon monitoring communities. This is not just power plants, this is also like nuclear sites, wind generation, solar plants etc. And etc. They are all here marked by different fuel types of generation, for example there is a coil and gas power plants marked there. So the topic is really huge and what we will focus today in our talk is mostly the power plants which work on coal and gas. This is important to mention. The heart of each power plant is actually a turbine. We don't have a picture of a turbine on the slides but more or less I think everybody saw it on the airplane. They are very similar specifically in terms of size and mostly how they work. On different vendors' websites you can actually find a lot of information where those turbines are used and this is for example the map of the turbines from Siemens. Not all turbines specifically are used in power plants. So they have a lot of different applications like chemical plants, oil and gas, a lot of other things. But if you correlate this information from previous slides you would be able to identify which systems are used by which power plant and if you will Google more information you can actually tell the versions and the generations of the systems that are used on these power plants. This is important because of the vulnerabilities that we will discuss later on on the slide. So before we will speak about what is the automation on power plants we should understand a little bit how they work. So we will go from right to left and it's very easy. A little notice throughout the talk we will simplify a lot of things for two reasons. One of them to make it more suitable for the audience and another thing we don't really understand everything by ourselves. So the first thing you should get is a fuel. Fuel could be for example a coil or a gas and you will just put this inside the combustion chamber where you would put it, set it up on fire actually and it will generate a lot of pressure which will go to the turbine and because of the pressure the turbine will begin to rotate. The turbine will have a shaft which will drive the electricity generator which obviously will generate electricity and put it on the power grid. So it is important from now on to understand that when we generate some electricity on the power plant we put this power not just for for example for this congress center or for some city we put it in a big thing called power grid where other entities will sell this electricity to different customers. There is also a very interesting point about like when we do generate this pressure and the combustion chamber is on fire we have a lot of excessive heat and we have two options like one of them is to safely put it in the air with condensing towers. This is option number one and another option is we can do some form of recuperation for example we would take this heat we will warm water the water will produce steam and we will put this steam in the steam turbine and produce additional electricity this is kind of an optimization of some form. So what is the automation in this process? The automation systems that are used on the power plants are usually called distributed control systems or DCSs and everything that I just described actually is automated inside those systems. The vendor of the solution want to simplify all things for the operator because we don't want like hundreds of people working on the power plant we just want like maybe dozens of people working there and they want to simplify the whole process of like they don't care about where they get this gas or coal how much they need it they just should be able to stop the generation process started and the control one main thing which is called how much power we should produce to the power grid so like how many megawatts of electricity we should produce. This describes actually the complexity hidden inside these solutions because there are a lot of small things happening inside and we will discuss it a little bit later. As I said this DCSs they are not exclusively used on the power plants there are a lot of other sites that would use the same solutions the same software and hardware. The DCS is not just like a software that you can install it's a set of hardware and software there is input output models sensors etc etc as I said sometimes they start from building construction like there is a field please build us a power station so it's a more complex projects most of the time. There are a lot of vendors that are doing it as I said we are focusing in this talk on the Siemens one. Just a short description of how simplified things are for operators of this DCS software. So for example if we would like to answer the question how we would regulate the output in megawatts of our power plant we would need to control basically three things again we are oversimplifying here. First of all you would control how many this is an example for the gas turbine so we would need to regulate how many gas we would put inside the combustion chamber we would control the flame temperature and we will control the thing that gets air inside the turbine. Basically three things that are controlled by simple PLCs in the whole system and you would be able for example to change 100 megawatts to 150 megawatts based on these settings. So the system itself that we are going to discuss is called Siemens SPPAT 3000 and actually again as all other DCS systems from other vendors this is a typical industrial system it has all these things called PLCs, RTUs, HMI servers, OPC traffic etc. etc. The only thing that is different specifically for Siemens SPPAT 3000 is that they have two main things called application server and automation server that this software running on this server is not what you will find on other installations. Like the fact that there are a lot of like if you would read the manuals for the systems from Siemens there would be a lot of different networks and highways and a lot of things like Siemens would state that there is no connection between the application network and external networks in practice and in reality you will find things like specific sensor network like monitoring of vibration for an object and some noises inside the turbine you will find the demilitarized zone because all in all like all power plant operators they won't have like on-site maintenance guys, engineers they would try to do a remote support they would need to install updates for operating system for their like signatures for their antiviruses they would need to push some OPC traffic so like information about the generation process outside either to corporate network or to some regulator because the whole energy market is regulated and there are different entities who would monitor how many electricity you are generating or they basically will tell you how many electricity you should generate because this is how many electricity was sold on the energy market. Basically the whole talk with this structure like this we will speak first about application server then automation server and then some summary it all started with the process called coordinated vulnerability disclosure we notified Siemens about some issues almost a year ago and like a month at the beginning of December Siemens published an advisory it was not an advisory just from the issues just from us a lot of other teams also contributed to it and this December this year's December doesn't mean that Siemens just released the patches when they the system as the PAT 3000 is exclusively supported so the system integrator for the system is Siemens itself so throughout the year after we notified them about some security issues they started to roll out patches and install updates on critical infrastructure they support and hopefully they did it with all the sensitive issues. There is a lot of things to discuss here we will skip because we are a little bit in a hurry things like not all vulnerabilities are the same and we use for example CVSS here to talk about like how critical the vulnerability is but it's actually not very applicable to the industrial sites you should understand what you can do with each vulnerability how you can impact the process and we will skip this part there's actually a kind of a threat model in the white paper that we will release later on like during January we will hold. So application server application server is this main is a main resource that you would find in the SPAT 3000 network like if someone will remotely connect to the system it would end up in application server if someone wants to start the generation process or to change some values it would be the application server if there are other servers that would for example try to communicate the application server they will actually start their work by downloading their software from application server and then executing it. So the first thing you might notice here is there are a lot of network ports available on this machine and actually this is like the first point there is a huge attack surface for the adversary to choose whether or not he would like to compromise some Siemens software or it's Windows software or it's another third party. Huge attack surface starting from the fact that all of the installation of this SPPA systems are kind of different so depending on the version and the generation you can find different Windows versions from I don't know 2003 to 2016 hopefully they are all updated right now but because the update process for such installations is a hard thing to do I mean you should wait for maintenance and it should be like maybe once in a half year or once a year you will always find some window where you can use some remotely exploitable vulnerabilities like eternal blue or blue keep are mentioned on this slide. There's tons of different additional software like old Cygwin that will allow you to do privilege escalation badly configured Tomcat and we have here this funny pie charts that show how configuration of different software is aligned with the best practices from CIS benchmarks those are basically security configuration hardening guides. The most important thing in the application server is a lot of Java software and in a minute rather will tell you about this. Surprise surprise one of the most notable problems in the Siemens SPPA 3000 is actually passwords. There are three important ranges the first to them is like what's all the installations before 2014 or maybe 2015 all passwords for the for all power stations were the same and you can easily Google them. We will also publish like the full word list in the white paper. After this years Siemens started to generate the unique passwords for all power plants but until this year it was kind of hard to change this password so you need to be aware of how to do this you need to know the process you maybe need to contact your system integrator to do this starting up from this December it would be much easier specifically to change passwords so it's in the past even if you know you have these issues you are not able to simply change all these things. Along with the passwords you can find like the full diagrams and integrator documentation that can like show you how the system is built how it's operating specific accounts etc. And of course this was not published by Siemens those some power plant operators who thought it would be a good idea to share this information. So as I said the most important thing of the application server is a bunch of Java applications and please welcome Radu who will share the details about this. Hi everyone let's look how SPF software works on an application server operator can communicate with systems through a thin client and fed client. A thin client acts as Java player inside internet explorer browser and communicate with server through HTTPS so it can be outside of application network and its communications can be constrained by firewall. In opposite in case of fed client software should be installed on operator machine and client directly communicates with RMI registry to find services and after that directly communicates with this RMI services. So fed client should belong to application network. Illustration of SPF architecture was kindly provided by SPPA through the URL. Not to be missed let's divide it into spaces in red zone the items that process request from thin client and redirect them to RMI services. And in green zone there are RMI services which act as network services on dynamic TCP ports. SPPA consists of containers each container can encapsulate inside one or more RMI services. All type of containers are represented on illustration and all of them have self-explanatory names. Before we go deep inside internals of SPPA let me introduce some tools which used in this research. First of all all JARs files inside SPPA are up to skated with commercial product but the security measure can be easily bypassed by public available tool, the investigator. Sometimes it is useful to see how ledger search where communicates with system. It helps to understand architecture of system and workflow of clients. In case of SPPA RMI detector was written. It represents RAL TCP streams in human readable formats. Inside it use method read object from JavasDK. And it is known that this method is unsafe to insecure digitalization. So be careful not to be exploited through remote pickup. The first pillar of SPPA is patch web server according it config folder auto software config can be accessed by unauthorized user. In fact this folder contains some sensitive information of system for example files PC system configuration data XML and files inside AFC contain start up options and configuration of all containers either application network or automation network. Else configuration of oriental application in Tomcat also can be accessed using this vulnerability. And about Tomcat. There are three web applications registered remote diagnostic viewer, manager and orient. According to configurations of Tomcat and Apache web server as orient serverlets can be accessed through HTTPS. And in the file web.xml there are list of all serverlets of orient application and the list is really huge. So some of these serverlets have attractive name for attacker for example browserlet. In fact it allows an authorize user, listing directories of operation system. Right in case of exploitation another serverlet is more attractive. File upload serverlet allows unauthorized file upload with system right. Parameters base dir and target name fully control the name of the file. So this vulnerability can be easily transformed to remote code execution. You can override some start up scripts of SPPA or simply inject the SPL in Tomcat web application and get remote code execution with system right. Else there are some serverlets which contains word service factory in the names. In fact they redirects HTTP request to RMI services. Right they passed parameters for HTTP request and search desirable RMI service according to parameter service URL and further invoke call to the public method of security service and the name of the method defined in serialized object in the data section of HTTP request. There are parameters of this calls also defined in this object. So now we have situation when theme client and fed client can access RMI services. But in case of fed client it can also directly communicate with RMI registry. So if application server missed some important data security updates it contains insecure digitalization vulnerability and using public to your serial we can simply exploit it and get code execution with system right again. The next task will be to list all available RMI services of SPPA system. This first step we simply use class locate registry of Java SDK and get big list of services. All but one are the mix RMI services. I assume that they perform some general interface for common for control and manage containers of SPPA. And first investigation we only choose lookup service. In fact this service looks like some collection of another RMI services using its public method list. We get the name of all available services and using the name and public method lookup we get the reference of RMI service. All RMI services in this step implement interface service factory. So according this we can assume that this is again collection of another RMI services but in fact it doesn't have public method to get the name of the service. So we need to decompile. So we need to decompile the class and find some factory methods which create RMI service for example create admin script and inside we can find the name of created service. As it can be guessed it's admin service. So using public method get service and this name we finally get the reference to next level RMI service. And in final step we get the reference to RMI services which perform real job of SPPA. But it's this RMI service also contains a lot of public methods for an authoritative user. So to sum up which refers registry and at each level we found a lot of RMI services and the last item also contains a lot of public methods. So the attack surface of SPPA system is really huge. So now when we list all available RMI services the next question is how does authentication of client request performs on the system. To answer this question let's look how client request to security service process on system. First of all client gets the reference to security service using some client ID. Further PC service factory try to get valid session using this client ID in session method manager. If session manager will failed in his task the exception will be throat and client will be failed. But if it succeeds valid session ID will return to PC service factory. And further in its turn instance of security service will be created in factory method and value of session ID will be stored in a login ID inside security service. And finally client will get the reference to security service. Further he can call some public method of it. But this methods can perform privilege checks of user using login ID in security manager. So to sum up we have two security measures in this system but there is a question how user client can perform login operation if he doesn't have any valid client ID. In this case at start up of the system session manager will be added an anonymous session with client ID equals zero and client will use this client ID and perform login operation. But attacking can also use this feature and simply bypass first log. So to sum up there is only one security measure on the system and it fully delegated to met it of remote services. But amount of remote services is huge. Amount of public methods is really huge and so it become really difficult to manage security service of system according to this information. So we know all inputs of system. We know all possible security measures of system. So it's time to find vulnerabilities. In the list of remote services there is one which looks some attractive. It's admin service. It can be accessed with anonymous session inside it has public method run script. This method doesn't perform any privilege checks so we can call it without any credentials and so on. But first step this method create instance of class loader using bytes from arguments and in fact this step will load arbitrary Java class. This class should implement interface admin script and defined method execute and this method execute will be called by run script of remote services. For this case we create Java class that simply run OS command from arguments of run script and we get code execution on system with system right. Of course there is more powerful post exploitation of this vulnerability than simply run OS command. You can, this vulnerability allows inject arbitrary Java class inside running SPPA application. So you can use some Java reflection to patch some variables of system and have influence of on technological process of SPPA. Also privilege check inside methods of remote service can be bypassed with second vulnerability in session service. This service has public method get login sessions. In fact this method return session data of all login users on system. This information includes user names, IP and client ID. So if in this amount this client ID of user that has some admin privileges, attacker can use this client ID to get reference to security service and this reference will be with some more privileged session. Further, attacker can call public method of security service, get all users and get all private information about all users of the system and password hashes also included in this private information. So to sum up, we have two, both of these vulnerabilities can be accessed through HTTPS and firewalls. Rules can be bypassed. In general all communication with remote services are encrypted. So user names and password hashes are transferred in plain text. This is more critical for Fed client case. So moreover password hashes doesn't perform any, doesn't have any session protection mechanism so if attacker can perform man in the middle attack against some user of this pipeline and capture the traffic between this user and application server, he can get valid username and password hash of the system and simply reuse this credentials and perform login operation on the system. Moreover, he also can change the password of this user. I talk a lot about user names and password hashes so it's time to understand how these items are organized on the system. Alex? Hello everyone. Let's continue our discussion about application server. On the previous slide you can see how remote authentication works. And now I'm going to tell you about how it's organized locally. After the system gets started, it begins to read two files, user1.xml and pdata1.exe to get user list and the password respectively. The user1 file is a simple xml while pdata1 has a slightly more difficult structure. It's a gzparkive encoded in base 64, the right driver civilization object in the gzparkive containing a specific xml. The field of the xml presents on the slide. They are used to calculate hash value and check password during the authentication. On the bottom of the slide you can see password check algorithm in pseudocode. The graph is typical for the script hash scheme like in your Linux and Linux machine. It has a number of iterations, soles and the only one thing that was added is hard code itself which is the same for all user. The tool to extract password hashes and the parameters from the pdata1 file has been developed. On the slide you can see its output. The tool can be used during the password auditing to check password, the check week or dictionary password and the hash calculation parameters. The tool is available at the link below. It draws a line and applications analysis. First as we have seen, attack surface is really huge and includes a lot of different components. Secondly, it's about remote connections. Whether the SPPA has no remote connections according to vendors or someone else who told you it, you should check it anyway. The last thing is attacker has an opportunity to impact power generation process. For example, it can start stop generation, change some output value or get some additional information about generation process and all this action can be done from application server. It's all about application server and let's start discussion about automation. The main goal of the automation server is to execute real-time automation functions and tasks. Depending on the power plant project architecture and its features, the role of the automation server can be different. We have distinguished three roles. The first one is automation role. There may be slight confusion because the term is used both for server and for its role. But analyzing automation server configuration and publicly available information, we have found that whatever the role is, almost the same hardware and software are used and we have decided to use this kind of classifications. It seems less confusing to us. At the same time, it's different from the vendor classification. Anyway, meaning automation role, having automation role means that the server is responsible for interaction with input output modules, which control and monitor power plant equipment such as turbine, electric generator, some other. The second role is communication. In this role, this role is used for connection the third-party software and system. In other words, it's just a protocol conventer supporting such protocols as Modbus, IEC, 101, 104 and some other. In the last role is the migration role. This role is used to connect previous versions of SPPA T3000 and other legacy systems such as SPPA T2000 or Teleperum ME. Automation role in automation server can be run on CMATIC 7 PLC and an industrial PC. Now let's talk a little more about each role. Let's start with automation role based on PLC. PLC will directly control devices like walls in turbine and access to them. Access to them is a game over for any security discussion. They usually represent the lowest level in different reference models such as Purdue model for example, any configuration changes and updates for PLC require to stop technological process. So these devices always have security misconfiguration firmware without security updates and unsecure industrial protocols. In case of SPPA, they are S7 protocols LPC data. We have a lot of information about S7 protocols in the Internet but not so much about PLC data protocol. So we had to deal with it and analyze ourselves. It's not a special protocol for SPPA when you program your CMATIC PLC and need to exchange some data between them in real time. You use this protocol. It's quite simple protocol and maybe its description is available somewhere in the Internet but we couldn't find it. So just a case show you its structure. Anyway there are no security mechanisms in this protocol. So only obstacle while do the main in the middle attack to spoof data is the sequence number which we can get from a packet and just fasts the implementation. For protocol analysis we have developed a de-sector which is available at the link below. During the security assessment of PLC configurations, one of the main things which we check is unauthorized access to reading and writing PLC memory. Security of unauthorized access is determined by position of the mode selector of the PLC and some other configuration parameters. During the previous research conducted one of our colleague Daniel Parnichev, the privilege matrix has been obtained. They show unsecured states and configurations of PLCs. The tool for gathering information from the PLC over the network and its analysis has been developed by Daniel and also available in our repository. Now let's talk about application server based on industrial PC. It's just a Linux box. During the start it tries to download some additional files from the application server. This file includes jar files, bar scripts, some configuration protocols files and some other. In order to execute jar files, the PTC per virtual machine is used. It's a runtime Java machine widely spread in industrial, IOT and military area. PTC per contains a head of time compilation mechanism. As a result jar files contains byte code transformation. That's why regular decompiles fails with them. To solve this problem we have written a PHP script to perform reverse transformation. After that regular decompiles have been successful. Running jars open RMI services on the automation server and some there extension. For example in case of migration server, the Orion RPC services which are extension of classic Java RMI services are used. On the slide you can see the list of these services. The security issues of automation server based on industrial PC are presented on the slide. Firstly as you can see there is a possibility to spoof downloaded files from application server. The files downloaded over HTTP and there are no security mechanism during the process. Secondly it's about default credentials. You can get access over SSH to server with user CM admin and password CM. Next it's vulnerabilities in Orion RPC services. These vulnerabilities allow to perform sensitive data explosion and remote execution. And finally the last group is vulnerabilities found in the software used to fill a migration role for communication with SPP 80 2000 also known as TXP system. With a number of issues on immigration server with old TXP you are not in magic position will be. A few words about Orion RPC vulnerabilities. They are in runtime engineering service. This service contains request runtime container method where the first argument defines the action to be executed. Using the action read file it's possible to get content of any file from the system. Using the write config file it's possible to write any information to the server. And for example it can be a JAR file which execute a shell comment from the comment line and using some SPPA specific functions you can execute these JAR files later. That's all about automation server. To sum up automation server can be based on PLC or industrial PC. In case of PLC it's the simple PC, it's the usual PLC with known security issues. In case of industrial PC it's just a Linux box which try to download some additional files from the application server and some of them execute with per virtual machine. So far we haven't mentioned any network equipment using distributed control system. In the research we saw a wide variety of network devices and network infrastructure including switches, firewalls and more rare devices such as data diet for example. We try to summarize all this information and got a common SPPA network topology. We have shown in a couple of places of network devices but the same devices can be found in other vendors distributed control system. Network devices in industrial network usually have a lot of security issues. The reason for this is that most of them don't require any configuration before start and can be run out of the box. And that's why the things like guestable SNMP community string with credentials for different services firmware with publicly available exploits and just a lack of security configurations. All the things are usual for network devices and they are usual security issues for industrial network. I think that's all. Now Gleb to sum up our discussion. So the topic of power plants is huge. The system is huge and we try to cover this and that sort of small things in the talk and everything can be summed up on this slide. These are just vulnerabilities as you can see problems in Java, in web applications, in different simple mechanisms that you can exploit to actually directly even not go into the PLCs or field level you can impact the process itself. What we don't cover in this talk is actually what's like havoc or disaster could be caused by attacking such systems because it's actually not that bad. I mean, if we are talking about things like blackouts of the cities or things like this, this is not what you can do with attack on such system because the distribution of the power in the grid is not the, according to the threat model, is not the problem of the power generation. It should be like another regulator who should watch for enough capacity in the network to fill the electricity to the customers. So what we are really speaking here is how we can impact the, for example, the turbine, the turbine itself, for example. But we had no access to the real turbine. They're big expensive and we haven't found anyone willing to provide us one, so we would destroy it. But the point is we have an educated guess, like PLCs, they control a lot of parameters of this turbine and the turbine is like a big mechanical monster that is actually self-degrading by working and putting it into different like uncomfortable operating modes will degrade it even faster or it will break it. And it's not easy. You can have a spare PLC or some other device, you won't have a spare turbine. So the impact is there, but it's not like very huge. So what we tried to do with this research mostly is like to understand how we can help the power plant operators out there and we have to find out all the issues and analyzing like this infrastructure on the customer side. We understood that all of the installations are actually the same and we can write a very simple do-it-yourself assessment and hopefully even like engineers on the power plants can test themselves. It is very easy like set of steps on two or three pages. You connect to application network, you connect to the automation network, you run the tests, you get the results and afterwards you talk with Siemens or you can fix something by yourselves and basically you don't have to hire like expensive consultants to do the job. You should be able to do it by yourself. I hope that you will be able to do it. Of course, to summarize the whole situation around DCSs, it is if you have seen other industrial solutions like SCADA stations, anything actually, you would find a lot of similarities and the whole, it will have the same pain points as all other solutions. There is a good document from the IAC 62443 which describes how like power plant operator or asset owner should talk to the system integrator and in the vendor with the vendor in terms of what security they should require and how they should control it. We urge any power plant operator to read this standard and to require security from their vendors and system integrators because nowadays it depends from vendor to vendor. The vendor is more interested in the security of the plant or some regulator and nobody knows how to act. This is the document where, which describes how you should talk with all other entities. Of course, read the slides or read the white paper in January, call Siemens, update all systems, change your passwords and configurations. This is actually very easy to, at least to shrink the attack surface. A lot of things inside SPPAT-3,000 network is a modern Windows boxes and it's kind of easy to set up some form of monitoring. You should talk to your security operations center. They would be able to look for some logs. Most of the impact that we showed, it was the impact from the Java applications and you won't be able to monitor this with security events and Windows, but at least it's still some form of detection process inside your network. Again, finally to summarize, it is not like a problem of one DCS from Siemens. There are exactly the same issues for other vendors not mentioned here. We will release a lot of things today, tomorrow and in January. Basically like the big white paper about everything that we found out with recommendations, what to do with the word lists, with the do-it-yourself security assessments, with a lot of tools. One of the tools would help you to do the research and other tools would help you, for example, if you're using intrusion detection systems like IDSS, you would be able to parse the protocols and maybe write some signatures for that. We work closely with Siemens. We want to say thank you for the Siemens product search. They did a great job in communications between us and the product team that develops the products of the Siemens SPPAT-3,000 itself. The main outlines from the vendor response is that if you are power plant operator, you should hurry and install a new version 8.2 SP2. There are Siemens is trying to educate and raise awareness inside their customers that first of all, they should change passwords, that there are critical vulnerabilities and they should do something with it. There is not all the problems are fixable by Siemens themselves. There is an operator is viable for some of the activities to do to the security by themselves. That's actually it. Thank you. Thank you very much. Thank you, Congress. If you have any questions, please welcome. Thank all of you for this excellent talk. We have a short three minutes for questions. If you have questions, please line up at the microphones and hall. If you are using hearing aids, there is an induction loop at microphone number three. Do we have questions from the internet? Yes. A question from our signal angel, please. We have a question. With the vulnerabilities found, could you take over those plans from the World Wide Web without further manding the middle attacks? Can you please repeat? A little bit louder, please. Sorry. With the vulnerabilities found, could you take control over those plans without worldwide from public internet without further manding the middle attacks? Actually no, this is some form of good news. As those systems are exclusively supported by one system integrator, by Siemens, they are more or less protected from the external access. Of course, there would be external access, but it's not that easy to reach it. Of course, we're not talking about internet. We're talking about some corporate networks or things like this. Next question, microphone three, please. Yes, hello. I also have a power plant on my planet and it's kind of bad for the atmosphere, I figured. My question is, can you skip back to where the red button is to switch it off? I'm asking for a friend. When I thought about that, these materials can be used in this way. Specifically, if you have operators or engineers friends on the power plant, you can talk to them. Do we have any more questions from the internet? No questions, any questions from the hall? I guess not. Well then, thank you very much for this talk and a warm round of applause. Thank you.
 One of the obvious critical infrastructures we have nowadays is power generation.  If there's no power, we're pretty much screwed.  Our next speakers will take a very close look at common industrial control systems used  in power turbines and their shortcomings.  So please give a warm round of applause to Reptap, Moradek and Kors.  Good morning Congress.  Thank you for waking up in the morning.  We will talk about the security of power plants today, specifically about automation systems  that are used in the power plants.  You might think that this is another talk about how insecure the whole industrial things  around us are, and more or less it is.  So for years we are, we and our colleagues speak about problems in industrial security.  We are happy to say that things are getting better, but it's just that the temper is a  little bit different and feels a little bit uncomfortable.  So anyway, we will speak about how power plants are built, what is the automation inside,  what are the vulnerabilities, and the high level overview of what you can do with this.  But at first a little bit of introduction.  We are security consultants.  We work with a lot of industrial things like PLCs, RTUs, SCADES, DCSS, whatever it is.  We were doing this for too long.  For so long that we have a huge map of contacts with a lot of system integrators and vendors,  and throughout the time we are not just doing the consultancy work for some asset owner,  for example for a power plant, we also talk to other entities and we try to fix things  all together.  We work at Kaspersky and actually the whole research was done not just by me, Rado and  Alexander who are here, but also with the help of Evgenia and two Sergays.  Things, yeah.  So things that are very important to note is that everything that we will discuss right  now is reported to a respective vendor basically a long time ago.  You can see like vendors here, but more or less we will speak only about one vendor today.  It is Siemens, but we would like you to understand that similar security issues can be found  in all other industrial solutions from other vendors.  You would find some of the findings, not for example that seller and it doesn't require  like weeks of work to find them out and this would be true specifically for all other vendors  which are not mentioned in the talk.  Jokes aside, we will share security issues of real power plants out there and it might  look like we are kind of irresponsible guys, but in fact this is the other way around.  I mean that to do some kind of research with these systems that are working in the power  plants you need to get access to them, you need time to do this research, you need to  have some knowledge to do this research and all these resources they are limited for guys  like us for penetration testers, for auditors, for power plant operators and engineers.  But for the bad guys like the potential attackers or adversaries, this is actually their job.  They have a lot of investments to do some research.  So we assume that bad guys already know this and we would like to share some information  with the good guys so they would be able to act upon this.  So let's go to the talk itself, power plants.  Power plants is like the most common way how humans get their power, their electricity,  they are everywhere around us and I believe the closest one to Leipzig is called Lipimdorf  power station and during this research when we were preparing an introduction we were  surprised how many information about power plants you can get from the internet.  It's not just for example a picture of the same power station on the Google Maps, it is  a very good scheme of what you can see on the marketing materials from vendors because  when they sell some system that automate power plant operations they sometimes start with  building construction and on their websites you can find a schematic pictures of actually  which building does what and where you will find some equipment, which versions of equipment  are used in these systems.  But if you don't have this experience you can just Google things and you will find out  which systems are used for automation in power plants.  For example for Lipimdorf it's some system that is called Siemens SPPAT2000 and P3000  which actually have another Siemens system inside called Siemens SPPAT3000.  So it's a little bit confusing and it is and we are still confused.  This is exactly the system that we will focus today, the Siemens SPPAT3000 and again it could  be any other automation system but it just happened the way that we've seen this system  more and more often than others.  There is a way how you can actually see all the generation sites throughout the world  thanks to the carbon monitoring communities.  This is not just power plants, this is also like nuclear sites, wind generation, solar  plants etc.  And etc.  They are all here marked by different fuel types of generation, for example there is  a coil and gas power plants marked there.  So the topic is really huge and what we will focus today in our talk is mostly the power  plants which work on coal and gas.  This is important to mention.  The heart of each power plant is actually a turbine.  We don't have a picture of a turbine on the slides but more or less I think everybody  saw it on the airplane.  They are very similar specifically in terms of size and mostly how they work.  On different vendors' websites you can actually find a lot of information where those turbines  are used and this is for example the map of the turbines from Siemens.  Not all turbines specifically are used in power plants.  So they have a lot of different applications like chemical plants, oil and gas, a lot of  other things.  But if you correlate this information from previous slides you would be able to identify  which systems are used by which power plant and if you will Google more information you  can actually tell the versions and the generations of the systems that are used on these power  plants.  This is important because of the vulnerabilities that we will discuss later on on the slide.  So before we will speak about what is the automation on power plants we should understand  a little bit how they work.  So we will go from right to left and it's very easy.  A little notice throughout the talk we will simplify a lot of things for two reasons.  One of them to make it more suitable for the audience and another thing we don't really  understand everything by ourselves.  So the first thing you should get is a fuel.  Fuel could be for example a coil or a gas and you will just put this inside the combustion  chamber where you would put it, set it up on fire actually and it will generate a lot  of pressure which will go to the turbine and because of the pressure the turbine will begin  to rotate.  The turbine will have a shaft which will drive the electricity generator which obviously  will generate electricity and put it on the power grid.  So it is important from now on to understand that when we generate some electricity on  the power plant we put this power not just for for example for this congress center or  for some city we put it in a big thing called power grid where other entities will sell  this electricity to different customers.  There is also a very interesting point about like when we do generate this pressure and  the combustion chamber is on fire we have a lot of excessive heat and we have two options  like one of them is to safely put it in the air with condensing towers.  This is option number one and another option is we can do some form of recuperation for  example we would take this heat we will warm water the water will produce steam and we  will put this steam in the steam turbine and produce additional electricity this is kind  of an optimization of some form.  So what is the automation in this process?  The automation systems that are used on the power plants are usually called distributed  control systems or DCSs and everything that I just described actually is automated inside  those systems.  The vendor of the solution want to simplify all things for the operator because we don't  want like hundreds of people working on the power plant we just want like maybe dozens  of people working there and they want to simplify the whole process of like they don't care  about where they get this gas or coal how much they need it they just should be able  to stop the generation process started and the control one main thing which is called  how much power we should produce to the power grid so like how many megawatts of electricity  we should produce.  This describes actually the complexity hidden inside these solutions because there are a  lot of small things happening inside and we will discuss it a little bit later.  As I said this DCSs they are not exclusively used on the power plants there are a lot of  other sites that would use the same solutions the same software and hardware.  The DCS is not just like a software that you can install it's a set of hardware and software  there is input output models sensors etc etc as I said sometimes they start from building  construction like there is a field please build us a power station so it's a more complex  projects most of the time.  There are a lot of vendors that are doing it as I said we are focusing in this talk  on the Siemens one.  Just a short description of how simplified things are for operators of this DCS software.  So for example if we would like to answer the question how we would regulate the output  in megawatts of our power plant we would need to control basically three things again we  are oversimplifying here.  First of all you would control how many this is an example for the gas turbine so we would  need to regulate how many gas we would put inside the combustion chamber we would control  the flame temperature and we will control the thing that gets air inside the turbine.  Basically three things that are controlled by simple PLCs in the whole system and you  would be able for example to change 100 megawatts to 150 megawatts based on these settings.  So the system itself that we are going to discuss is called Siemens SPPAT 3000 and actually  again as all other DCS systems from other vendors this is a typical industrial system  it has all these things called PLCs, RTUs, HMI servers, OPC traffic etc. etc.  The only thing that is different specifically for Siemens SPPAT 3000 is that they have two  main things called application server and automation server that this software running  on this server is not what you will find on other installations.  Like the fact that there are a lot of like if you would read the manuals for the systems  from Siemens there would be a lot of different networks and highways and a lot of things  like Siemens would state that there is no connection between the application network  and external networks in practice and in reality you will find things like specific sensor  network like monitoring of vibration for an object and some noises inside the turbine  you will find the demilitarized zone because all in all like all power plant operators  they won't have like on-site maintenance guys, engineers they would try to do a remote support  they would need to install updates for operating system for their like signatures for their  antiviruses they would need to push some OPC traffic so like information about the generation  process outside either to corporate network or to some regulator because the whole energy  market is regulated and there are different entities who would monitor how many electricity  you are generating or they basically will tell you how many electricity you should generate  because this is how many electricity was sold on the energy market.  Basically the whole talk with this structure like this we will speak first about application  server then automation server and then some summary it all started with the process called  coordinated vulnerability disclosure we notified Siemens about some issues almost a year ago  and like a month at the beginning of December Siemens published an advisory it was not an  advisory just from the issues just from us a lot of other teams also contributed to it  and this December this year's December doesn't mean that Siemens just released the patches  when they the system as the PAT 3000 is exclusively supported so the system integrator for the  system is Siemens itself so throughout the year after we notified them about some security  issues they started to roll out patches and install updates on critical infrastructure  they support and hopefully they did it with all the sensitive issues.  There is a lot of things to discuss here we will skip because we are a little bit in a  hurry things like not all vulnerabilities are the same and we use for example CVSS here  to talk about like how critical the vulnerability is but it's actually not very applicable to  the industrial sites you should understand what you can do with each vulnerability how  you can impact the process and we will skip this part there's actually a kind of a threat  model in the white paper that we will release later on like during January we will hold.  So application server application server is this main is a main resource that you would  find in the SPAT 3000 network like if someone will remotely connect to the system it would  end up in application server if someone wants to start the generation process or to change  some values it would be the application server if there are other servers that would for  example try to communicate the application server they will actually start their work  by downloading their software from application server and then executing it.  So the first thing you might notice here is there are a lot of network ports available  on this machine and actually this is like the first point there is a huge attack surface  for the adversary to choose whether or not he would like to compromise some Siemens software  or it's Windows software or it's another third party.  Huge attack surface starting from the fact that all of the installation of this SPPA  systems are kind of different so depending on the version and the generation you can  find different Windows versions from I don't know 2003 to 2016 hopefully they are all updated  right now but because the update process for such installations is a hard thing to do  I mean you should wait for maintenance and it should be like maybe once in a half year  or once a year you will always find some window where you can use some remotely exploitable  vulnerabilities like eternal blue or blue keep are mentioned on this slide.  There's tons of different additional software like old Cygwin that will allow you to do  privilege escalation badly configured Tomcat and we have here this funny pie charts that  show how configuration of different software is aligned with the best practices from CIS  benchmarks those are basically security configuration hardening guides.  The most important thing in the application server is a lot of Java software and in a  minute rather will tell you about this.  Surprise surprise one of the most notable problems in the Siemens SPPA 3000 is actually  passwords.  There are three important ranges the first to them is like what's all the installations  before 2014 or maybe 2015 all passwords for the for all power stations were the same and  you can easily Google them.  We will also publish like the full word list in the white paper.  After this years Siemens started to generate the unique passwords for all power plants  but until this year it was kind of hard to change this password so you need to be aware  of how to do this you need to know the process you maybe need to contact your system integrator  to do this starting up from this December it would be much easier specifically to change  passwords so it's in the past even if you know you have these issues you are not able  to simply change all these things.  Along with the passwords you can find like the full diagrams and integrator documentation  that can like show you how the system is built how it's operating specific accounts etc.  And of course this was not published by Siemens those some power plant operators who thought  it would be a good idea to share this information.  So as I said the most important thing of the application server is a bunch of Java applications  and please welcome Radu who will share the details about this.  Hi everyone let's look how SPF software works on an application server operator can communicate  with systems through a thin client and fed client.  A thin client acts as Java player inside internet explorer browser and communicate with server  through HTTPS so it can be outside of application network and its communications can be constrained  by firewall.  In opposite in case of fed client software should be installed on operator machine and  client directly communicates with RMI registry to find services and after that directly communicates  with this RMI services.  So fed client should belong to application network.  Illustration of SPF architecture was kindly provided by SPPA through the URL.  Not to be missed let's divide it into spaces in red zone the items that process request  from thin client and redirect them to RMI services.  And in green zone there are RMI services which act as network services on dynamic TCP ports.  SPPA consists of containers each container can encapsulate inside one or more RMI services.  All type of containers are represented on illustration and all of them have self-explanatory names.  Before we go deep inside internals of SPPA let me introduce some tools which used in  this research.  First of all all JARs files inside SPPA are up to skated with commercial product but the  security measure can be easily bypassed by public available tool, the investigator.  Sometimes it is useful to see how ledger search where communicates with system.  It helps to understand architecture of system and workflow of clients.  In case of SPPA RMI detector was written.  It represents RAL TCP streams in human readable formats.  Inside it use method read object from JavasDK.  And it is known that this method is unsafe to insecure digitalization.  So be careful not to be exploited through remote pickup.  The first pillar of SPPA is patch web server according it config folder auto software config  can be accessed by unauthorized user.  In fact this folder contains some sensitive information of system for example files PC  system configuration data XML and files inside AFC contain start up options and configuration  of all containers either application network or automation network.  Else configuration of oriental application in Tomcat also can be accessed using this  vulnerability.  And about Tomcat.  There are three web applications registered remote diagnostic viewer, manager and orient.  According to configurations of Tomcat and Apache web server as orient serverlets can  be accessed through HTTPS.  And in the file web.xml there are list of all serverlets of orient application and the  list is really huge.  So some of these serverlets have attractive name for attacker for example browserlet.  In fact it allows an authorize user, listing directories of operation system.  Right in case of exploitation another serverlet is more attractive.  File upload serverlet allows unauthorized file upload with system right.  Parameters base dir and target name fully control the name of the file.  So this vulnerability can be easily transformed to remote code execution.  You can override some start up scripts of SPPA or simply inject the SPL in Tomcat web  application and get remote code execution with system right.  Else there are some serverlets which contains word service factory in the names.  In fact they redirects HTTP request to RMI services.  Right they passed parameters for HTTP request and search desirable RMI service according  to parameter service URL and further invoke call to the public method of security service  and the name of the method defined in serialized object in the data section of HTTP request.  There are parameters of this calls also defined in this object.  So now we have situation when theme client and fed client can access RMI services.  But in case of fed client it can also directly communicate with RMI registry.  So if application server missed some important data security updates it contains insecure  digitalization vulnerability and using public to your serial we can simply exploit it and  get code execution with system right again.  The next task will be to list all available RMI services of SPPA system.  This first step we simply use class locate registry of Java SDK and get big list of services.  All but one are the mix RMI services.  I assume that they perform some general interface for common for control and manage containers  of SPPA.  And first investigation we only choose lookup service.  In fact this service looks like some collection of another RMI services using its public method  list.  We get the name of all available services and using the name and public method lookup  we get the reference of RMI service.  All RMI services in this step implement interface service factory.  So according this we can assume that this is again collection of another RMI services  but in fact it doesn't have public method to get the name of the service.  So we need to decompile.  So we need to decompile the class and find some factory methods which create RMI service  for example create admin script and inside we can find the name of created service.  As it can be guessed it's admin service.  So using public method get service and this name we finally get the reference to next  level RMI service.  And in final step we get the reference to RMI services which perform real job of SPPA.  But it's this RMI service also contains a lot of public methods for an authoritative  user.  So to sum up which refers registry and at each level we found a lot of RMI services and  the last item also contains a lot of public methods.  So the attack surface of SPPA system is really huge.  So now when we list all available RMI services the next question is how does authentication  of client request performs on the system.  To answer this question let's look how client request to security service process on system.  First of all client gets the reference to security service using some client ID.  Further PC service factory try to get valid session using this client ID in session method  manager.  If session manager will failed in his task the exception will be throat and client will  be failed.  But if it succeeds valid session ID will return to PC service factory.  And further in its turn instance of security service will be created in factory method  and value of session ID will be stored in a login ID inside security service.  And finally client will get the reference to security service.  Further he can call some public method of it.  But this methods can perform privilege checks of user using login ID in security manager.  So to sum up we have two security measures in this system but there is a question how  user client can perform login operation if he doesn't have any valid client ID.  In this case at start up of the system session manager will be added an anonymous session  with client ID equals zero and client will use this client ID and perform login operation.  But attacking can also use this feature and simply bypass first log.  So to sum up there is only one security measure on the system and it fully delegated to met  it of remote services.  But amount of remote services is huge.  Amount of public methods is really huge and so it become really difficult to manage security  service of system according to this information.  So we know all inputs of system.  We know all possible security measures of system.  So it's time to find vulnerabilities.  In the list of remote services there is one which looks some attractive.  It's admin service.  It can be accessed with anonymous session inside it has public method run script.  This method doesn't perform any privilege checks so we can call it without any credentials  and so on.  But first step this method create instance of class loader using bytes from arguments  and in fact this step will load arbitrary Java class.  This class should implement interface admin script and defined method execute and this  method execute will be called by run script of remote services.  For this case we create Java class that simply run OS command from arguments of run script  and we get code execution on system with system right.  Of course there is more powerful post exploitation of this vulnerability than simply run OS command.  You can, this vulnerability allows inject arbitrary Java class inside running SPPA application.  So you can use some Java reflection to patch some variables of system and have influence  of on technological process of SPPA.  Also privilege check inside methods of remote service can be bypassed with second vulnerability  in session service.  This service has public method get login sessions.  In fact this method return session data of all login users on system.  This information includes user names, IP and client ID.  So if in this amount this client ID of user that has some admin privileges, attacker can  use this client ID to get reference to security service and this reference will be with some  more privileged session.  Further, attacker can call public method of security service, get all users and get all  private information about all users of the system and password hashes also included in  this private information.  So to sum up, we have two, both of these vulnerabilities can be accessed through HTTPS and firewalls.  Rules can be bypassed.  In general all communication with remote services are encrypted.  So user names and password hashes are transferred in plain text.  This is more critical for Fed client case.  So moreover password hashes doesn't perform any, doesn't have any session protection  mechanism so if attacker can perform man in the middle attack against some user of this  pipeline and capture the traffic between this user and application server, he can get valid  username and password hash of the system and simply reuse this credentials and perform  login operation on the system.  Moreover, he also can change the password of this user.  I talk a lot about user names and password hashes so it's time to understand how these  items are organized on the system.  Alex?  Hello everyone.  Let's continue our discussion about application server.  On the previous slide you can see how remote authentication works.  And now I'm going to tell you about how it's organized locally.  After the system gets started, it begins to read two files, user1.xml and pdata1.exe  to get user list and the password respectively.  The user1 file is a simple xml while pdata1 has a slightly more difficult structure.  It's a gzparkive encoded in base 64, the right driver civilization object in the gzparkive  containing a specific xml.  The field of the xml presents on the slide.  They are used to calculate hash value and check password during the authentication.  On the bottom of the slide you can see password check algorithm in pseudocode.  The graph is typical for the script hash scheme like in your Linux and Linux machine.  It has a number of iterations, soles and the only one thing that was added is hard code  itself which is the same for all user.  The tool to extract password hashes and the parameters from the pdata1 file has been developed.  On the slide you can see its output.  The tool can be used during the password auditing to check password, the check week or dictionary  password and the hash calculation parameters.  The tool is available at the link below.  It draws a line and applications analysis.  First as we have seen, attack surface is really huge and includes a lot of different components.  Secondly, it's about remote connections.  Whether the SPPA has no remote connections according to vendors or someone else who told  you it, you should check it anyway.  The last thing is attacker has an opportunity to impact power generation process.  For example, it can start stop generation, change some output value or get some additional  information about generation process and all this action can be done from application server.  It's all about application server and let's start discussion about automation.  The main goal of the automation server is to execute real-time automation functions and  tasks.  Depending on the power plant project architecture and its features, the role of the automation  server can be different.  We have distinguished three roles.  The first one is automation role.  There may be slight confusion because the term is used both for server and for its role.  But analyzing automation server configuration and publicly available information, we have  found that whatever the role is, almost the same hardware and software are used and we  have decided to use this kind of classifications.  It seems less confusing to us.  At the same time, it's different from the vendor classification.  Anyway, meaning automation role, having automation role means that the server is responsible for  interaction with input output modules, which control and monitor power plant equipment  such as turbine, electric generator, some other.  The second role is communication.  In this role, this role is used for connection the third-party software and system.  In other words, it's just a protocol conventer supporting such protocols as Modbus, IEC,  101, 104 and some other.  In the last role is the migration role.  This role is used to connect previous versions of SPPA T3000 and other legacy systems such  as SPPA T2000 or Teleperum ME.  Automation role in automation server can be run on CMATIC 7 PLC and an industrial PC.  Now let's talk a little more about each role.  Let's start with automation role based on PLC.  PLC will directly control devices like walls in turbine and access to them.  Access to them is a game over for any security discussion.  They usually represent the lowest level in different reference models such as Purdue  model for example, any configuration changes and updates for PLC require to stop technological  process.  So these devices always have security misconfiguration firmware without security updates and unsecure  industrial protocols.  In case of SPPA, they are S7 protocols LPC data.  We have a lot of information about S7 protocols in the Internet but not so much about PLC  data protocol.  So we had to deal with it and analyze ourselves.  It's not a special protocol for SPPA when you program your CMATIC PLC and need to exchange  some data between them in real time.  You use this protocol.  It's quite simple protocol and maybe its description is available somewhere in the Internet but  we couldn't find it.  So just a case show you its structure.  Anyway there are no security mechanisms in this protocol.  So only obstacle while do the main in the middle attack to spoof data is the sequence  number which we can get from a packet and just fasts the implementation.  For protocol analysis we have developed a de-sector which is available at the link below.  During the security assessment of PLC configurations, one of the main things which we check is  unauthorized access to reading and writing PLC memory.  Security of unauthorized access is determined by position of the mode selector of the PLC  and some other configuration parameters.  During the previous research conducted one of our colleague Daniel Parnichev, the privilege  matrix has been obtained.  They show unsecured states and configurations of PLCs.  The tool for gathering information from the PLC over the network and its analysis has  been developed by Daniel and also available in our repository.  Now let's talk about application server based on industrial PC.  It's just a Linux box.  During the start it tries to download some additional files from the application server.  This file includes jar files, bar scripts, some configuration protocols files and some  other.  In order to execute jar files, the PTC per virtual machine is used.  It's a runtime Java machine widely spread in industrial, IOT and military area.  PTC per contains a head of time compilation mechanism.  As a result jar files contains byte code transformation.  That's why regular decompiles fails with them.  To solve this problem we have written a PHP script to perform reverse transformation.  After that regular decompiles have been successful.  Running jars open RMI services on the automation server and some there extension.  For example in case of migration server, the Orion RPC services which are extension of  classic Java RMI services are used.  On the slide you can see the list of these services.  The security issues of automation server based on industrial PC are presented on the slide.  Firstly as you can see there is a possibility to spoof downloaded files from application  server.  The files downloaded over HTTP and there are no security mechanism during the process.  Secondly it's about default credentials.  You can get access over SSH to server with user CM admin and password CM.  Next it's vulnerabilities in Orion RPC services.  These vulnerabilities allow to perform sensitive data explosion and remote execution.  And finally the last group is vulnerabilities found in the software used to fill a migration  role for communication with SPP 80 2000 also known as TXP system.  With a number of issues on immigration server with old TXP you are not in magic position  will be.  A few words about Orion RPC vulnerabilities.  They are in runtime engineering service.  This service contains request runtime container method where the first argument defines the  action to be executed.  Using the action read file it's possible to get content of any file from the system.  Using the write config file it's possible to write any information to the server.  And for example it can be a JAR file which execute a shell comment from the comment  line and using some SPPA specific functions you can execute these JAR files later.  That's all about automation server.  To sum up automation server can be based on PLC or industrial PC.  In case of PLC it's the simple PC, it's the usual PLC with known security issues.  In case of industrial PC it's just a Linux box which try to download some additional  files from the application server and some of them execute with per virtual machine.  So far we haven't mentioned any network equipment using distributed control system.  In the research we saw a wide variety of network devices and network infrastructure including  switches, firewalls and more rare devices such as data diet for example.  We try to summarize all this information and got a common SPPA network topology.  We have shown in a couple of places of network devices but the same devices can be found  in other vendors distributed control system.  Network devices in industrial network usually have a lot of security issues.  The reason for this is that most of them don't require any configuration before start and  can be run out of the box.  And that's why the things like guestable SNMP community string with credentials for different  services firmware with publicly available exploits and just a lack of security configurations.  All the things are usual for network devices and they are usual security issues for industrial  network.  I think that's all.  Now Gleb to sum up our discussion.  So the topic of power plants is huge.  The system is huge and we try to cover this and that sort of small things in the talk  and everything can be summed up on this slide.  These are just vulnerabilities as you can see problems in Java, in web applications,  in different simple mechanisms that you can exploit to actually directly even not go into  the PLCs or field level you can impact the process itself.  What we don't cover in this talk is actually what's like havoc or disaster could be caused  by attacking such systems because it's actually not that bad.  I mean, if we are talking about things like blackouts of the cities or things like this,  this is not what you can do with attack on such system because the distribution of the  power in the grid is not the, according to the threat model, is not the problem of the  power generation.  It should be like another regulator who should watch for enough capacity in the network to  fill the electricity to the customers.  So what we are really speaking here is how we can impact the, for example, the turbine,  the turbine itself, for example.  But we had no access to the real turbine.  They're big expensive and we haven't found anyone willing to provide us one, so we would  destroy it.  But the point is we have an educated guess, like PLCs, they control a lot of parameters  of this turbine and the turbine is like a big mechanical monster that is actually self-degrading  by working and putting it into different like uncomfortable operating modes will degrade  it even faster or it will break it.  And it's not easy.  You can have a spare PLC or some other device, you won't have a spare turbine.  So the impact is there, but it's not like very huge.  So what we tried to do with this research mostly is like to understand how we can help  the power plant operators out there and we have to find out all the issues and analyzing  like this infrastructure on the customer side.  We understood that all of the installations are actually the same and we can write a very  simple do-it-yourself assessment and hopefully even like engineers on the power plants can  test themselves.  It is very easy like set of steps on two or three pages.  You connect to application network, you connect to the automation network, you run the tests,  you get the results and afterwards you talk with Siemens or you can fix something by yourselves  and basically you don't have to hire like expensive consultants to do the job.  You should be able to do it by yourself.  I hope that you will be able to do it.  Of course, to summarize the whole situation around DCSs, it is if you have seen other  industrial solutions like SCADA stations, anything actually, you would find a lot of similarities  and the whole, it will have the same pain points as all other solutions.  There is a good document from the IAC 62443 which describes how like power plant operator  or asset owner should talk to the system integrator and in the vendor with the vendor in terms  of what security they should require and how they should control it.  We urge any power plant operator to read this standard and to require security from their  vendors and system integrators because nowadays it depends from vendor to vendor.  The vendor is more interested in the security of the plant or some regulator and nobody  knows how to act.  This is the document where, which describes how you should talk with all other entities.  Of course, read the slides or read the white paper in January, call Siemens, update all  systems, change your passwords and configurations.  This is actually very easy to, at least to shrink the attack surface.  A lot of things inside SPPAT-3,000 network is a modern Windows boxes and it's kind of  easy to set up some form of monitoring.  You should talk to your security operations center.  They would be able to look for some logs.  Most of the impact that we showed, it was the impact from the Java applications and  you won't be able to monitor this with security events and Windows, but at least it's still  some form of detection process inside your network.  Again, finally to summarize, it is not like a problem of one DCS from Siemens.  There are exactly the same issues for other vendors not mentioned here.  We will release a lot of things today, tomorrow and in January.  Basically like the big white paper about everything that we found out with recommendations, what  to do with the word lists, with the do-it-yourself security assessments, with a lot of tools.  One of the tools would help you to do the research and other tools would help you, for  example, if you're using intrusion detection systems like IDSS, you would be able to parse  the protocols and maybe write some signatures for that.  We work closely with Siemens.  We want to say thank you for the Siemens product search.  They did a great job in communications between us and the product team that develops the  products of the Siemens SPPAT-3,000 itself.  The main outlines from the vendor response is that if you are power plant operator, you  should hurry and install a new version 8.2 SP2.  There are Siemens is trying to educate and raise awareness inside their customers that  first of all, they should change passwords, that there are critical vulnerabilities and  they should do something with it.  There is not all the problems are fixable by Siemens themselves.  There is an operator is viable for some of the activities to do to the security by themselves.  That's actually it.  Thank you.  Thank you very much.  Thank you, Congress.  If you have any questions, please welcome.  Thank all of you for this excellent talk.  We have a short three minutes for questions.  If you have questions, please line up at the microphones and hall.  If you are using hearing aids, there is an induction loop at microphone number three.  Do we have questions from the internet?  Yes.  A question from our signal angel, please.  We have a question.  With the vulnerabilities found, could you take over those plans from the World Wide Web  without further manding the middle attacks?  Can you please repeat?  A little bit louder, please.  Sorry.  With the vulnerabilities found, could you take control over those plans without worldwide  from public internet without further manding the middle attacks?  Actually no, this is some form of good news.  As those systems are exclusively supported by one system integrator, by Siemens, they  are more or less protected from the external access.  Of course, there would be external access, but it's not that easy to reach it.  Of course, we're not talking about internet.  We're talking about some corporate networks or things like this.  Next question, microphone three, please.  Yes, hello.  I also have a power plant on my planet and it's kind of bad for the atmosphere, I figured.  My question is, can you skip back to where the red button is to switch it off?  I'm asking for a friend.  When I thought about that, these materials can be used in this way.  Specifically, if you have operators or engineers friends on the power plant, you can talk to  them.  Do we have any more questions from the internet?  No questions, any questions from the hall?  I guess not.  Well then, thank you very much for this talk and a warm round of applause.  Thank you.
36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_0_59.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_60_107.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_108_251.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_252_503.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_504_1139.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_1140_1295.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_1296_1679.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_1680_2735.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_2736_3971.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_3972_5087.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_5088_5147.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_5148_7595.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_7596_7823.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_7824_8771.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_8772_10235.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_10236_10703.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_10704_11675.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_11676_12767.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_12768_14063.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_14064_14135.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_14136_14387.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_14388_15503.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_15504_17891.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_17892_18131.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_18132_18263.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_18264_21239.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_21240_21419.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_21420_21527.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_21528_24155.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_24156_24383.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_24384_24767.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_24768_25895.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_25896_26063.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_26064_26123.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_26124_26399.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_26400_26555.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_26556_26999.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_27000_28883.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_28884_29135.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_29136_30311.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_30312_30731.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_30732_31487.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_31488_32411.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_32412_33899.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_33900_34955.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_34956_36203.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_36204_36395.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_36396_41387.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_41388_41891.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_41892_43943.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_43944_46043.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_46044_48863.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_48864_50411.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_50412_50555.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_50556_50651.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_50652_50723.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_50724_50903.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_50904_51695.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_51696_51791.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_51792_53915.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_53916_55619.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_55620_56099.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_56100_56255.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_56256_59027.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_59028_59231.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_59232_60851.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_60852_62363.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_62364_63131.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_63132_63707.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_63708_64391.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_64392_65291.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_65292_65651.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_65652_70655.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_70656_72767.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_72768_73379.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_73380_76511.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_76512_76655.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_76656_77399.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_77400_77807.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_77808_81263.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_81264_83951.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_83952_88967.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_88968_89255.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_89256_89711.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_89712_90131.png 36c3-10689-eng-deu-fra-On_the_insecure_nature_of_turbine_control_systems_in_power_generation_hd_90132_90310.png
One of the obvious critical infrastructures we have nowadays is power generation. If there's no power, we're pretty much screwed. Our next speakers will take a very close look at common industrial control systems used in power turbines and their shortcomings. So please give a warm round of applause to Reptap, Moradek and Kors. Good morning Congress. Thank you for waking up in the morning. We will talk about the security of power plants today, specifically about automation systems that are used in the power plants. You might think that this is another talk about how insecure the whole industrial things around us are, and more or less it is. So for years we are, we and our colleagues speak about problems in industrial security. We are happy to say that things are getting better, but it's just that the temper is a little bit different and feels a little bit uncomfortable. So anyway, we will speak about how power plants are built, what is the automation inside, what are the vulnerabilities, and the high level overview of what you can do with this. But at first a little bit of introduction. We are security consultants. We work with a lot of industrial things like PLCs, RTUs, SCADES, DCSS, whatever it is. We were doing this for too long. For so long that we have a huge map of contacts with a lot of system integrators and vendors, and throughout the time we are not just doing the consultancy work for some asset owner, for example for a power plant, we also talk to other entities and we try to fix things all together. We work at Kaspersky and actually the whole research was done not just by me, Rado and Alexander who are here, but also with the help of Evgenia and two Sergays. Things, yeah. So things that are very important to note is that everything that we will discuss right now is reported to a respective vendor basically a long time ago. You can see like vendors here, but more or less we will speak only about one vendor today. It is Siemens, but we would like you to understand that similar security issues can be found in all other industrial solutions from other vendors. You would find some of the findings, not for example that seller and it doesn't require like weeks of work to find them out and this would be true specifically for all other vendors which are not mentioned in the talk. Jokes aside, we will share security issues of real power plants out there and it might look like we are kind of irresponsible guys, but in fact this is the other way around. I mean that to do some kind of research with these systems that are working in the power plants you need to get access to them, you need time to do this research, you need to have some knowledge to do this research and all these resources they are limited for guys like us for penetration testers, for auditors, for power plant operators and engineers. But for the bad guys like the potential attackers or adversaries, this is actually their job. They have a lot of investments to do some research. So we assume that bad guys already know this and we would like to share some information with the good guys so they would be able to act upon this. So let's go to the talk itself, power plants. Power plants is like the most common way how humans get their power, their electricity, they are everywhere around us and I believe the closest one to Leipzig is called Lipimdorf power station and during this research when we were preparing an introduction we were surprised how many information about power plants you can get from the internet. It's not just for example a picture of the same power station on the Google Maps, it is a very good scheme of what you can see on the marketing materials from vendors because when they sell some system that automate power plant operations they sometimes start with building construction and on their websites you can find a schematic pictures of actually which building does what and where you will find some equipment, which versions of equipment are used in these systems. But if you don't have this experience you can just Google things and you will find out which systems are used for automation in power plants. For example for Lipimdorf it's some system that is called Siemens SPPAT2000 and P3000 which actually have another Siemens system inside called Siemens SPPAT3000. So it's a little bit confusing and it is and we are still confused. This is exactly the system that we will focus today, the Siemens SPPAT3000 and again it could be any other automation system but it just happened the way that we've seen this system more and more often than others. There is a way how you can actually see all the generation sites throughout the world thanks to the carbon monitoring communities. This is not just power plants, this is also like nuclear sites, wind generation, solar plants etc. And etc. They are all here marked by different fuel types of generation, for example there is a coil and gas power plants marked there. So the topic is really huge and what we will focus today in our talk is mostly the power plants which work on coal and gas. This is important to mention. The heart of each power plant is actually a turbine. We don't have a picture of a turbine on the slides but more or less I think everybody saw it on the airplane. They are very similar specifically in terms of size and mostly how they work. On different vendors' websites you can actually find a lot of information where those turbines are used and this is for example the map of the turbines from Siemens. Not all turbines specifically are used in power plants. So they have a lot of different applications like chemical plants, oil and gas, a lot of other things. But if you correlate this information from previous slides you would be able to identify which systems are used by which power plant and if you will Google more information you can actually tell the versions and the generations of the systems that are used on these power plants. This is important because of the vulnerabilities that we will discuss later on on the slide. So before we will speak about what is the automation on power plants we should understand a little bit how they work. So we will go from right to left and it's very easy. A little notice throughout the talk we will simplify a lot of things for two reasons. One of them to make it more suitable for the audience and another thing we don't really understand everything by ourselves. So the first thing you should get is a fuel. Fuel could be for example a coil or a gas and you will just put this inside the combustion chamber where you would put it, set it up on fire actually and it will generate a lot of pressure which will go to the turbine and because of the pressure the turbine will begin to rotate. The turbine will have a shaft which will drive the electricity generator which obviously will generate electricity and put it on the power grid. So it is important from now on to understand that when we generate some electricity on the power plant we put this power not just for for example for this congress center or for some city we put it in a big thing called power grid where other entities will sell this electricity to different customers. There is also a very interesting point about like when we do generate this pressure and the combustion chamber is on fire we have a lot of excessive heat and we have two options like one of them is to safely put it in the air with condensing towers. This is option number one and another option is we can do some form of recuperation for example we would take this heat we will warm water the water will produce steam and we will put this steam in the steam turbine and produce additional electricity this is kind of an optimization of some form. So what is the automation in this process? The automation systems that are used on the power plants are usually called distributed control systems or DCSs and everything that I just described actually is automated inside those systems. The vendor of the solution want to simplify all things for the operator because we don't want like hundreds of people working on the power plant we just want like maybe dozens of people working there and they want to simplify the whole process of like they don't care about where they get this gas or coal how much they need it they just should be able to stop the generation process started and the control one main thing which is called how much power we should produce to the power grid so like how many megawatts of electricity we should produce. This describes actually the complexity hidden inside these solutions because there are a lot of small things happening inside and we will discuss it a little bit later. As I said this DCSs they are not exclusively used on the power plants there are a lot of other sites that would use the same solutions the same software and hardware. The DCS is not just like a software that you can install it's a set of hardware and software there is input output models sensors etc etc as I said sometimes they start from building construction like there is a field please build us a power station so it's a more complex projects most of the time. There are a lot of vendors that are doing it as I said we are focusing in this talk on the Siemens one. Just a short description of how simplified things are for operators of this DCS software. So for example if we would like to answer the question how we would regulate the output in megawatts of our power plant we would need to control basically three things again we are oversimplifying here. First of all you would control how many this is an example for the gas turbine so we would need to regulate how many gas we would put inside the combustion chamber we would control the flame temperature and we will control the thing that gets air inside the turbine. Basically three things that are controlled by simple PLCs in the whole system and you would be able for example to change 100 megawatts to 150 megawatts based on these settings. So the system itself that we are going to discuss is called Siemens SPPAT 3000 and actually again as all other DCS systems from other vendors this is a typical industrial system it has all these things called PLCs, RTUs, HMI servers, OPC traffic etc. etc. The only thing that is different specifically for Siemens SPPAT 3000 is that they have two main things called application server and automation server that this software running on this server is not what you will find on other installations. Like the fact that there are a lot of like if you would read the manuals for the systems from Siemens there would be a lot of different networks and highways and a lot of things like Siemens would state that there is no connection between the application network and external networks in practice and in reality you will find things like specific sensor network like monitoring of vibration for an object and some noises inside the turbine you will find the demilitarized zone because all in all like all power plant operators they won't have like on-site maintenance guys, engineers they would try to do a remote support they would need to install updates for operating system for their like signatures for their antiviruses they would need to push some OPC traffic so like information about the generation process outside either to corporate network or to some regulator because the whole energy market is regulated and there are different entities who would monitor how many electricity you are generating or they basically will tell you how many electricity you should generate because this is how many electricity was sold on the energy market. Basically the whole talk with this structure like this we will speak first about application server then automation server and then some summary it all started with the process called coordinated vulnerability disclosure we notified Siemens about some issues almost a year ago and like a month at the beginning of December Siemens published an advisory it was not an advisory just from the issues just from us a lot of other teams also contributed to it and this December this year's December doesn't mean that Siemens just released the patches when they the system as the PAT 3000 is exclusively supported so the system integrator for the system is Siemens itself so throughout the year after we notified them about some security issues they started to roll out patches and install updates on critical infrastructure they support and hopefully they did it with all the sensitive issues. There is a lot of things to discuss here we will skip because we are a little bit in a hurry things like not all vulnerabilities are the same and we use for example CVSS here to talk about like how critical the vulnerability is but it's actually not very applicable to the industrial sites you should understand what you can do with each vulnerability how you can impact the process and we will skip this part there's actually a kind of a threat model in the white paper that we will release later on like during January we will hold. So application server application server is this main is a main resource that you would find in the SPAT 3000 network like if someone will remotely connect to the system it would end up in application server if someone wants to start the generation process or to change some values it would be the application server if there are other servers that would for example try to communicate the application server they will actually start their work by downloading their software from application server and then executing it. So the first thing you might notice here is there are a lot of network ports available on this machine and actually this is like the first point there is a huge attack surface for the adversary to choose whether or not he would like to compromise some Siemens software or it's Windows software or it's another third party. Huge attack surface starting from the fact that all of the installation of this SPPA systems are kind of different so depending on the version and the generation you can find different Windows versions from I don't know 2003 to 2016 hopefully they are all updated right now but because the update process for such installations is a hard thing to do I mean you should wait for maintenance and it should be like maybe once in a half year or once a year you will always find some window where you can use some remotely exploitable vulnerabilities like eternal blue or blue keep are mentioned on this slide. There's tons of different additional software like old Cygwin that will allow you to do privilege escalation badly configured Tomcat and we have here this funny pie charts that show how configuration of different software is aligned with the best practices from CIS benchmarks those are basically security configuration hardening guides. The most important thing in the application server is a lot of Java software and in a minute rather will tell you about this. Surprise surprise one of the most notable problems in the Siemens SPPA 3000 is actually passwords. There are three important ranges the first to them is like what's all the installations before 2014 or maybe 2015 all passwords for the for all power stations were the same and you can easily Google them. We will also publish like the full word list in the white paper. After this years Siemens started to generate the unique passwords for all power plants but until this year it was kind of hard to change this password so you need to be aware of how to do this you need to know the process you maybe need to contact your system integrator to do this starting up from this December it would be much easier specifically to change passwords so it's in the past even if you know you have these issues you are not able to simply change all these things. Along with the passwords you can find like the full diagrams and integrator documentation that can like show you how the system is built how it's operating specific accounts etc. And of course this was not published by Siemens those some power plant operators who thought it would be a good idea to share this information. So as I said the most important thing of the application server is a bunch of Java applications and please welcome Radu who will share the details about this. Hi everyone let's look how SPF software works on an application server operator can communicate with systems through a thin client and fed client. A thin client acts as Java player inside internet explorer browser and communicate with server through HTTPS so it can be outside of application network and its communications can be constrained by firewall. In opposite in case of fed client software should be installed on operator machine and client directly communicates with RMI registry to find services and after that directly communicates with this RMI services. So fed client should belong to application network. Illustration of SPF architecture was kindly provided by SPPA through the URL. Not to be missed let's divide it into spaces in red zone the items that process request from thin client and redirect them to RMI services. And in green zone there are RMI services which act as network services on dynamic TCP ports. SPPA consists of containers each container can encapsulate inside one or more RMI services. All type of containers are represented on illustration and all of them have self-explanatory names. Before we go deep inside internals of SPPA let me introduce some tools which used in this research. First of all all JARs files inside SPPA are up to skated with commercial product but the security measure can be easily bypassed by public available tool, the investigator. Sometimes it is useful to see how ledger search where communicates with system. It helps to understand architecture of system and workflow of clients. In case of SPPA RMI detector was written. It represents RAL TCP streams in human readable formats. Inside it use method read object from JavasDK. And it is known that this method is unsafe to insecure digitalization. So be careful not to be exploited through remote pickup. The first pillar of SPPA is patch web server according it config folder auto software config can be accessed by unauthorized user. In fact this folder contains some sensitive information of system for example files PC system configuration data XML and files inside AFC contain start up options and configuration of all containers either application network or automation network. Else configuration of oriental application in Tomcat also can be accessed using this vulnerability. And about Tomcat. There are three web applications registered remote diagnostic viewer, manager and orient. According to configurations of Tomcat and Apache web server as orient serverlets can be accessed through HTTPS. And in the file web.xml there are list of all serverlets of orient application and the list is really huge. So some of these serverlets have attractive name for attacker for example browserlet. In fact it allows an authorize user, listing directories of operation system. Right in case of exploitation another serverlet is more attractive. File upload serverlet allows unauthorized file upload with system right. Parameters base dir and target name fully control the name of the file. So this vulnerability can be easily transformed to remote code execution. You can override some start up scripts of SPPA or simply inject the SPL in Tomcat web application and get remote code execution with system right. Else there are some serverlets which contains word service factory in the names. In fact they redirects HTTP request to RMI services. Right they passed parameters for HTTP request and search desirable RMI service according to parameter service URL and further invoke call to the public method of security service and the name of the method defined in serialized object in the data section of HTTP request. There are parameters of this calls also defined in this object. So now we have situation when theme client and fed client can access RMI services. But in case of fed client it can also directly communicate with RMI registry. So if application server missed some important data security updates it contains insecure digitalization vulnerability and using public to your serial we can simply exploit it and get code execution with system right again. The next task will be to list all available RMI services of SPPA system. This first step we simply use class locate registry of Java SDK and get big list of services. All but one are the mix RMI services. I assume that they perform some general interface for common for control and manage containers of SPPA. And first investigation we only choose lookup service. In fact this service looks like some collection of another RMI services using its public method list. We get the name of all available services and using the name and public method lookup we get the reference of RMI service. All RMI services in this step implement interface service factory. So according this we can assume that this is again collection of another RMI services but in fact it doesn't have public method to get the name of the service. So we need to decompile. So we need to decompile the class and find some factory methods which create RMI service for example create admin script and inside we can find the name of created service. As it can be guessed it's admin service. So using public method get service and this name we finally get the reference to next level RMI service. And in final step we get the reference to RMI services which perform real job of SPPA. But it's this RMI service also contains a lot of public methods for an authoritative user. So to sum up which refers registry and at each level we found a lot of RMI services and the last item also contains a lot of public methods. So the attack surface of SPPA system is really huge. So now when we list all available RMI services the next question is how does authentication of client request performs on the system. To answer this question let's look how client request to security service process on system. First of all client gets the reference to security service using some client ID. Further PC service factory try to get valid session using this client ID in session method manager. If session manager will failed in his task the exception will be throat and client will be failed. But if it succeeds valid session ID will return to PC service factory. And further in its turn instance of security service will be created in factory method and value of session ID will be stored in a login ID inside security service. And finally client will get the reference to security service. Further he can call some public method of it. But this methods can perform privilege checks of user using login ID in security manager. So to sum up we have two security measures in this system but there is a question how user client can perform login operation if he doesn't have any valid client ID. In this case at start up of the system session manager will be added an anonymous session with client ID equals zero and client will use this client ID and perform login operation. But attacking can also use this feature and simply bypass first log. So to sum up there is only one security measure on the system and it fully delegated to met it of remote services. But amount of remote services is huge. Amount of public methods is really huge and so it become really difficult to manage security service of system according to this information. So we know all inputs of system. We know all possible security measures of system. So it's time to find vulnerabilities. In the list of remote services there is one which looks some attractive. It's admin service. It can be accessed with anonymous session inside it has public method run script. This method doesn't perform any privilege checks so we can call it without any credentials and so on. But first step this method create instance of class loader using bytes from arguments and in fact this step will load arbitrary Java class. This class should implement interface admin script and defined method execute and this method execute will be called by run script of remote services. For this case we create Java class that simply run OS command from arguments of run script and we get code execution on system with system right. Of course there is more powerful post exploitation of this vulnerability than simply run OS command. You can, this vulnerability allows inject arbitrary Java class inside running SPPA application. So you can use some Java reflection to patch some variables of system and have influence of on technological process of SPPA. Also privilege check inside methods of remote service can be bypassed with second vulnerability in session service. This service has public method get login sessions. In fact this method return session data of all login users on system. This information includes user names, IP and client ID. So if in this amount this client ID of user that has some admin privileges, attacker can use this client ID to get reference to security service and this reference will be with some more privileged session. Further, attacker can call public method of security service, get all users and get all private information about all users of the system and password hashes also included in this private information. So to sum up, we have two, both of these vulnerabilities can be accessed through HTTPS and firewalls. Rules can be bypassed. In general all communication with remote services are encrypted. So user names and password hashes are transferred in plain text. This is more critical for Fed client case. So moreover password hashes doesn't perform any, doesn't have any session protection mechanism so if attacker can perform man in the middle attack against some user of this pipeline and capture the traffic between this user and application server, he can get valid username and password hash of the system and simply reuse this credentials and perform login operation on the system. Moreover, he also can change the password of this user. I talk a lot about user names and password hashes so it's time to understand how these items are organized on the system. Alex? Hello everyone. Let's continue our discussion about application server. On the previous slide you can see how remote authentication works. And now I'm going to tell you about how it's organized locally. After the system gets started, it begins to read two files, user1.xml and pdata1.exe to get user list and the password respectively. The user1 file is a simple xml while pdata1 has a slightly more difficult structure. It's a gzparkive encoded in base 64, the right driver civilization object in the gzparkive containing a specific xml. The field of the xml presents on the slide. They are used to calculate hash value and check password during the authentication. On the bottom of the slide you can see password check algorithm in pseudocode. The graph is typical for the script hash scheme like in your Linux and Linux machine. It has a number of iterations, soles and the only one thing that was added is hard code itself which is the same for all user. The tool to extract password hashes and the parameters from the pdata1 file has been developed. On the slide you can see its output. The tool can be used during the password auditing to check password, the check week or dictionary password and the hash calculation parameters. The tool is available at the link below. It draws a line and applications analysis. First as we have seen, attack surface is really huge and includes a lot of different components. Secondly, it's about remote connections. Whether the SPPA has no remote connections according to vendors or someone else who told you it, you should check it anyway. The last thing is attacker has an opportunity to impact power generation process. For example, it can start stop generation, change some output value or get some additional information about generation process and all this action can be done from application server. It's all about application server and let's start discussion about automation. The main goal of the automation server is to execute real-time automation functions and tasks. Depending on the power plant project architecture and its features, the role of the automation server can be different. We have distinguished three roles. The first one is automation role. There may be slight confusion because the term is used both for server and for its role. But analyzing automation server configuration and publicly available information, we have found that whatever the role is, almost the same hardware and software are used and we have decided to use this kind of classifications. It seems less confusing to us. At the same time, it's different from the vendor classification. Anyway, meaning automation role, having automation role means that the server is responsible for interaction with input output modules, which control and monitor power plant equipment such as turbine, electric generator, some other. The second role is communication. In this role, this role is used for connection the third-party software and system. In other words, it's just a protocol conventer supporting such protocols as Modbus, IEC, 101, 104 and some other. In the last role is the migration role. This role is used to connect previous versions of SPPA T3000 and other legacy systems such as SPPA T2000 or Teleperum ME. Automation role in automation server can be run on CMATIC 7 PLC and an industrial PC. Now let's talk a little more about each role. Let's start with automation role based on PLC. PLC will directly control devices like walls in turbine and access to them. Access to them is a game over for any security discussion. They usually represent the lowest level in different reference models such as Purdue model for example, any configuration changes and updates for PLC require to stop technological process. So these devices always have security misconfiguration firmware without security updates and unsecure industrial protocols. In case of SPPA, they are S7 protocols LPC data. We have a lot of information about S7 protocols in the Internet but not so much about PLC data protocol. So we had to deal with it and analyze ourselves. It's not a special protocol for SPPA when you program your CMATIC PLC and need to exchange some data between them in real time. You use this protocol. It's quite simple protocol and maybe its description is available somewhere in the Internet but we couldn't find it. So just a case show you its structure. Anyway there are no security mechanisms in this protocol. So only obstacle while do the main in the middle attack to spoof data is the sequence number which we can get from a packet and just fasts the implementation. For protocol analysis we have developed a de-sector which is available at the link below. During the security assessment of PLC configurations, one of the main things which we check is unauthorized access to reading and writing PLC memory. Security of unauthorized access is determined by position of the mode selector of the PLC and some other configuration parameters. During the previous research conducted one of our colleague Daniel Parnichev, the privilege matrix has been obtained. They show unsecured states and configurations of PLCs. The tool for gathering information from the PLC over the network and its analysis has been developed by Daniel and also available in our repository. Now let's talk about application server based on industrial PC. It's just a Linux box. During the start it tries to download some additional files from the application server. This file includes jar files, bar scripts, some configuration protocols files and some other. In order to execute jar files, the PTC per virtual machine is used. It's a runtime Java machine widely spread in industrial, IOT and military area. PTC per contains a head of time compilation mechanism. As a result jar files contains byte code transformation. That's why regular decompiles fails with them. To solve this problem we have written a PHP script to perform reverse transformation. After that regular decompiles have been successful. Running jars open RMI services on the automation server and some there extension. For example in case of migration server, the Orion RPC services which are extension of classic Java RMI services are used. On the slide you can see the list of these services. The security issues of automation server based on industrial PC are presented on the slide. Firstly as you can see there is a possibility to spoof downloaded files from application server. The files downloaded over HTTP and there are no security mechanism during the process. Secondly it's about default credentials. You can get access over SSH to server with user CM admin and password CM. Next it's vulnerabilities in Orion RPC services. These vulnerabilities allow to perform sensitive data explosion and remote execution. And finally the last group is vulnerabilities found in the software used to fill a migration role for communication with SPP 80 2000 also known as TXP system. With a number of issues on immigration server with old TXP you are not in magic position will be. A few words about Orion RPC vulnerabilities. They are in runtime engineering service. This service contains request runtime container method where the first argument defines the action to be executed. Using the action read file it's possible to get content of any file from the system. Using the write config file it's possible to write any information to the server. And for example it can be a JAR file which execute a shell comment from the comment line and using some SPPA specific functions you can execute these JAR files later. That's all about automation server. To sum up automation server can be based on PLC or industrial PC. In case of PLC it's the simple PC, it's the usual PLC with known security issues. In case of industrial PC it's just a Linux box which try to download some additional files from the application server and some of them execute with per virtual machine. So far we haven't mentioned any network equipment using distributed control system. In the research we saw a wide variety of network devices and network infrastructure including switches, firewalls and more rare devices such as data diet for example. We try to summarize all this information and got a common SPPA network topology. We have shown in a couple of places of network devices but the same devices can be found in other vendors distributed control system. Network devices in industrial network usually have a lot of security issues. The reason for this is that most of them don't require any configuration before start and can be run out of the box. And that's why the things like guestable SNMP community string with credentials for different services firmware with publicly available exploits and just a lack of security configurations. All the things are usual for network devices and they are usual security issues for industrial network. I think that's all. Now Gleb to sum up our discussion. So the topic of power plants is huge. The system is huge and we try to cover this and that sort of small things in the talk and everything can be summed up on this slide. These are just vulnerabilities as you can see problems in Java, in web applications, in different simple mechanisms that you can exploit to actually directly even not go into the PLCs or field level you can impact the process itself. What we don't cover in this talk is actually what's like havoc or disaster could be caused by attacking such systems because it's actually not that bad. I mean, if we are talking about things like blackouts of the cities or things like this, this is not what you can do with attack on such system because the distribution of the power in the grid is not the, according to the threat model, is not the problem of the power generation. It should be like another regulator who should watch for enough capacity in the network to fill the electricity to the customers. So what we are really speaking here is how we can impact the, for example, the turbine, the turbine itself, for example. But we had no access to the real turbine. They're big expensive and we haven't found anyone willing to provide us one, so we would destroy it. But the point is we have an educated guess, like PLCs, they control a lot of parameters of this turbine and the turbine is like a big mechanical monster that is actually self-degrading by working and putting it into different like uncomfortable operating modes will degrade it even faster or it will break it. And it's not easy. You can have a spare PLC or some other device, you won't have a spare turbine. So the impact is there, but it's not like very huge. So what we tried to do with this research mostly is like to understand how we can help the power plant operators out there and we have to find out all the issues and analyzing like this infrastructure on the customer side. We understood that all of the installations are actually the same and we can write a very simple do-it-yourself assessment and hopefully even like engineers on the power plants can test themselves. It is very easy like set of steps on two or three pages. You connect to application network, you connect to the automation network, you run the tests, you get the results and afterwards you talk with Siemens or you can fix something by yourselves and basically you don't have to hire like expensive consultants to do the job. You should be able to do it by yourself. I hope that you will be able to do it. Of course, to summarize the whole situation around DCSs, it is if you have seen other industrial solutions like SCADA stations, anything actually, you would find a lot of similarities and the whole, it will have the same pain points as all other solutions. There is a good document from the IAC 62443 which describes how like power plant operator or asset owner should talk to the system integrator and in the vendor with the vendor in terms of what security they should require and how they should control it. We urge any power plant operator to read this standard and to require security from their vendors and system integrators because nowadays it depends from vendor to vendor. The vendor is more interested in the security of the plant or some regulator and nobody knows how to act. This is the document where, which describes how you should talk with all other entities. Of course, read the slides or read the white paper in January, call Siemens, update all systems, change your passwords and configurations. This is actually very easy to, at least to shrink the attack surface. A lot of things inside SPPAT-3,000 network is a modern Windows boxes and it's kind of easy to set up some form of monitoring. You should talk to your security operations center. They would be able to look for some logs. Most of the impact that we showed, it was the impact from the Java applications and you won't be able to monitor this with security events and Windows, but at least it's still some form of detection process inside your network. Again, finally to summarize, it is not like a problem of one DCS from Siemens. There are exactly the same issues for other vendors not mentioned here. We will release a lot of things today, tomorrow and in January. Basically like the big white paper about everything that we found out with recommendations, what to do with the word lists, with the do-it-yourself security assessments, with a lot of tools. One of the tools would help you to do the research and other tools would help you, for example, if you're using intrusion detection systems like IDSS, you would be able to parse the protocols and maybe write some signatures for that. We work closely with Siemens. We want to say thank you for the Siemens product search. They did a great job in communications between us and the product team that develops the products of the Siemens SPPAT-3,000 itself. The main outlines from the vendor response is that if you are power plant operator, you should hurry and install a new version 8.2 SP2. There are Siemens is trying to educate and raise awareness inside their customers that first of all, they should change passwords, that there are critical vulnerabilities and they should do something with it. There is not all the problems are fixable by Siemens themselves. There is an operator is viable for some of the activities to do to the security by themselves. That's actually it. Thank you. Thank you very much. Thank you, Congress. If you have any questions, please welcome. Thank all of you for this excellent talk. We have a short three minutes for questions. If you have questions, please line up at the microphones and hall. If you are using hearing aids, there is an induction loop at microphone number three. Do we have questions from the internet? Yes. A question from our signal angel, please. We have a question. With the vulnerabilities found, could you take over those plans from the World Wide Web without further manding the middle attacks? Can you please repeat? A little bit louder, please. Sorry. With the vulnerabilities found, could you take control over those plans without worldwide from public internet without further manding the middle attacks? Actually no, this is some form of good news. As those systems are exclusively supported by one system integrator, by Siemens, they are more or less protected from the external access. Of course, there would be external access, but it's not that easy to reach it. Of course, we're not talking about internet. We're talking about some corporate networks or things like this. Next question, microphone three, please. Yes, hello. I also have a power plant on my planet and it's kind of bad for the atmosphere, I figured. My question is, can you skip back to where the red button is to switch it off? I'm asking for a friend. When I thought about that, these materials can be used in this way. Specifically, if you have operators or engineers friends on the power plant, you can talk to them. Do we have any more questions from the internet? No questions, any questions from the hall? I guess not. Well then, thank you very much for this talk and a warm round of applause. Thank you.
found in all other industrial solutions from talk. Jokes aside, we will share security issues power, their electricity, they are everywhere throughout the world thanks to the carbon huge and what we will focus today in our talk is a lot of information where those turbines are identify which systems are used by which power go from right to left and it's very easy. A little notice throughout the talk we will systems. The vendor of the solution want to generation process started and the control one Surprise surprise one of the most notable method execute and this method execute will be we have developed a de-sector which is available at the link below. During the security assessment vulnerabilities allow to perform sensitive data container method where the first argument defines using distributed control system. In the research for example. We try to summarize all this topic of power plants is huge. The system is huge with attack on such system because the security they should require and how they should how you should talk with all other entities. Of problem of one DCS from Siemens. There are