We are in the fourth and final tier of S4x15 registration. Seats 151-190 and they are going fast. 36 seats left at the time of this writing.
I’ve been heads down writing assessment reports, so haven’t had time to comment on the attack on Sony Pictures. Probably a good thing as I would have just added to much of what has been mostly speculation without facts. The most relevant aspect to ICS to watch is the response. We better understand the expected response to an actual war, in Thomas Rid’s definition. How companies and countries will react to attacks by ICS cyber weapons that cause economic damage, environmental damage and perhaps minimal loss of life is a wild guess at this point. How many people would have predicted capitulation if you ran the Sony Pictures scenario past them before it occurred.
The more relevant attack news this week came from a German BSI report on ICS attacks in Germany and neighboring countries. (Thanks to Stephan Beirer of GAI NetConsult for the tip and translation.) They discuss some incidents related to Havex, but the most interesting is the attack that damaged a steel plant. It was from the easy to accomplish attack vector of spearphishing people who have remote access to the ICS. “The results were massive damage to the system” (translated).
Less attention has been paid to the disturbance in the Austrian power grid covered in Section 3.4.2 of the BSI report. “The failure was probably due to a Control command issued during the commissioning of a gas system in Southern Germany … triggered errors and also reached Austrian power grid. … This caused major disruptions to Instrumentation and control system for network control. … The grid stability could during the incident be ensured only with great effort.” (translated) We are trying to find someone to speak to this report at ICSage and would appreciate any tips or referrals.
Threatpost and a handful of other news outlets are reporting on a worm actively exploiting the Shellshock bug against unpatched NASes. As an aside I find it a bit strange that the attackers are only performing clickjacking attacks — a much more obvious attack would be to use CryptoLocker or other data ransomware, since the current worm is targeting storage devices.
The question becomes, whose job is it to find and patch these kinds of bugs?
I hate to always say ‘the vendors,’ although that is my default response. Vendors however often don’t have the personnel to do reviews on code that they write themselves, let alone to review external code. Third-party components are usually open source and are often volunteer-driven.
I feel that a group of vendors would be well-served to get together and fund code reviews for commonly-used components. Those vendors could then share back those findings with the public, or, at their discretion, keep the findings internal to their group for proper patching. ‘Collaboratition,’ is a phrase often used in national labs for this kind of information-sharing — not ideal financially, but oftentimes it is the right thing to do (or the only way to get it to work).
Lightweight web servers seem like a good candidate for review, since so many embedded systems make use of them. We came up with our list of candidate servers based on devices in our lab, then searched for fingerprintable servers on Shodan to get a feel for their popularity overall. Results are rounded to the nearest 10,000 to help anonymize the actual software that we’re looking at:
Server A: 150,000
Server B: 100,000
Server C: 80,000
Server D: 60,000
Server E: 20,000
We then went ahead and did a cursory code review on every server that we could find code for. This review was just a really basic ‘grep’ analysis, looking for unsafe uses of unsafe C functions: blind strcpy() calls or strncpy() calls that use user-supplied lengths, uses of malloc() that never check for success, calls to sprintf() that never check lengths of input. Our ‘code quality’ analysis is a generalization based on how much of a headache we got looking at the code: the bigger the headache, the more unmaintainable the codebase is and the more it will cost to fix.
The big story of the week was from Bloomberg’s Robertson & Riley: Mysterious ’08 Turkey Pipeline Blast Opened New Cyberwar Era. While the headline isn’t correct, the sourcing is anonymous and some of the technical conclusions are wrong, this is a great example of what cyber weapons may be used for in the future. There may be, and I’d argue will be, many uses of ICS cyber weapons that will not be “war”. I’m looking forward to these discussions at ICSage.
Bedrock Automation has been in semi-stealth mode, if there is such a thing. They have been positioning a “clean sheet of paper” approach to ICS and ICS security. Building a new system from scratch. Details have been and are still very limited, but they released a white paper this week.
We have updated the ICS Village page on the S4x15 site. The network diagram is updated so now you will see that there will be Wonderware, Open BACnet stack, and Modicon PLC on the network. The next update will include an almost full list, we will keep a couple of surprises, of the software and hardware and the network.
Of more interest may be the example flags that have been released. Some of the wording is intentionally vague to not give too much away.
What is the Vendor Name on the BACnet Controller?
What is the Modicon PLC password?
Identify a specific tag value.
Identify the attacker from a provided firmware image.
Create an IDS Signature to detect an attack from a previous flag.
There is a lot of work to be done in preparing the ICS Village, but a status review this week has me very excited about the environment and competition that will be available to the attendees.
The South Beach Pool Party will be at the Surfcomber Hotel on Thursday after the S4 Technical Sessions. We are pleased to announce the entertainment for the party … The Aqualillies!
This synchronized swimming group will perform a few numbers in the great Surfcomber pool and then mingle and take pictures. They have performed at TED, Disney World, award shows and other great events.
The pool at the Surfcomber is the perfect venue for the party and this entertainment with balconies, the pool deck, and of course the ocean view at sunset.
I like the Aqualillies mission statement:
Our goal is to inspire people with beauty, grace, and spectacle, bringing to life the magic of the universe through synchronized swimming and dance. By following our dreams we hope to encourage others do the same: to free their imagination, seek out adventure, believe in themselves and their power to make the world a better place. We are reinventing water ballet for the new millennium!
We have some other fun surprises for this very unusual ICSsec event.
After the party you will be right in the heart of South Beach so you can grab dinner, more drinks, go to a club or just people watch. We will have a bus going back to the Trump at 11PM for those wanting to stay down in South Beach post party.
The registration count is at 126. This means there are 24 seats left at the tier 3 price and only 64 seats left in total. You need to book now if you want to get your spot at S4x15 Week.
S4x15 attendees have some choices for the Friday activity. There is the ICSage: ICS Cyber Weapons conference and now two one-day advanced training classes. We pick classes that will teach students with the right experience a new, leading edge skill in one day. These classes are typically being taught for the first time. The two classes this year are:
Instructors: Corey Thuen and Reid Wightman of Digital Bond
Corey has been digging into CANBus as part of his research project he will present in the S4 Technical Sessions. He learned a lot and wants to pass that along to the students.
There is no way to do this course without the right hardware. So there is a $100 hardware supplement so every student will have a BeagleBone with CANBus Cape they can use in the course and take home with them.
Why Should the Red Team Have All the Fun?
Instructors: Jim Gilsinn and Bryan Singer of Kenexis
Jim and the Kenexis team have developed a new ICS lab environment that they can bring on the road. So there will be some instruction focusing on defensive techniques and then the class will have a Red/Blue competition.
Each lab pod will have three students on each team and some of the lessons learned will be on the techniques and reasons why the various teams won and lost.
The 100+ that have already registered for S4x15 should have received an email on how they can switch from ICSage to the class or add the class if they want.
Seats for each class are limited and look closely at the required knowledge. You will be left behind if you don’t have the required knowledge.
This year we have a fun addition to the S4 Cocktail Party held on the Kovens Center deck overlooking the Intracoastal Waterway … drones. We are bringing in CineDrones to let attendees fly a drone through an obstacle course. They claim the drones are virtually indestructible, and I’m sure some first time pilots will put this to the test. We will have prizes for the best times on the course.
CineDrones will also pilot a drone overhead with a camera and display the events on screens inside and outside. Kovens does a great job with the food at this event, and it’s always fun to relax on the deck at sunset after a long day of hardcore ICSsec technical talks. The Welcome Party on Tuesday is sponsored by PFP Cybersecurity and Waterfall. It is a Cuban themed party down on the beach at the Trump International. We have cigar rollers, domino tables, Cuban food and drink and music, and some other fun surprises. This was a big hit even in unseasonably cold weather last year, so we decided to run it back for another year. The South Beach Pool Party is the big finish of the S4x15 social events on Thursday. We have some fun surprises for this that we will disclose next week. Stay tuned.
Kim will be doing a book signing at lunch on Friday and all attendees will be given a copy of her book.
Some of the other sessions added to the agenda in recent weeks include:
Kyle Wilhoit on The State of SCADA Malware. Kyle was involved in identifying and investigating the recent malware that has been searching for ICS applications. You also need to hear about his incubation concept and environment.
Dr. Chee-Wooi Ten will give a brief introduction into research on Simulating Multiple Substation Failures.
Mark Heard and Jonathan Pollet have been added to OTDay to show how to Use the NIST Cybersecurity Framework in Your ICS Program.
Sean McBride’s Finding SCADA Honeypots on Shodan article is a twist on the Internet connected ICS story. He finds 58 Conpots and 67 honeypots listed as Water Control Valve #27. Two points in this article. One, some basic analysis is required to weed out honeypots. And two, you need to add more reality and interaction to your SCADA Honeypot if you want it to be believable.
Wonderware released a new version of their SmartGlance mobile app. We regularly beat up these ICS mobile apps for promoting remote control from any untrusted phone anywhere in the world. It was refreshing to read the Wonderware press release that focused on making plant information available anywhere, not control.
Stephen Hilt and a team of volunteers are working furiously on the ICS Village for S4x15. The ICS Village at S4x14 had a large amount of ICS devices, 6 different vendor PLC’s, HMI, industrial switches, historians, …, and we allowed attendees to play and attack them at will. Of course, every year near needs to get better.
One thing we learned from our past ICS Villages and the recent Defcon ICS Village is that a lot of people are at a loss of what to do in the Village. So the ICS Village at S4x15 will have a capture the flag (CTF) competition with a ICS flags in five different categories.
The CTF will be scored and prizes will be awarded to the top individuals or teams.
We will be releasing information on the ICS Village every two weeks that will help attendees gather their tools and plan their attacks. To begin, the diagram below shows a simplified network diagram of the ICS Village. Some specific product names will be added in future updates.
The flags and scoring will be on a Jeopardy style board with the following categories. Each category will have different levels of difficulty with corresponding point values.
Reconnaissance. Example easy flag: identify a historian on the network. Example medium flag: pull tag names from a PLC.
Exploitation. Example medium flag: use Modicon password recovery to recover a super secret password. Example hard flag: downgrade software on a PLC.
Process. Example medium flag: modify an HMI display.
Forensics. Example easy flag: review firewall logs for signs of ICS specific malware. Example hard flag: Identify hacker identity via evidence left in firmware.
Protection. Example easy flag: write ICS signature for an earlier discovered flag.
If you would like to participate in the preparation or running of the ICS Village, or just have an idea for a flag, contact Stephen Hilt.