A participant will acquire practical experience of searching for vulnerabilities and analyzing SCADA security. The masterclass will cover both common network vulnerabilities, and exceptive cases that can be detected in the process of security assessment of real networks.

1. Master class(Positive Hack Days)«Analysis of SCADA security protection» Andrey Komarov(technical manager)

2. SCADA protection analysis – «what for», «how» and «why»? Regulations (USA, СК) Security «Compliance» audit Prevent security incidents in SCADA Detect and specify security threats in SCADA Improvement of software and hardwareсредств Actualize regulation rules Consider attacker’s actions and tendency Improve efficiency of used protection measures

3. Mismatches in regulations

4. All checks and coverage area System software (OS, ОСРВ) SCADA Application software Network software Data transferring channels Hardware

5. Used techniques Application software(SCADA,RTU) System software(OS, ОСРВ) Data transferring channels and techniques(Industrial Ethernet, Modbus, DNP3, Profibus, etc.)

9. Used instruments («Click and Hack» type) «/exploits/scada» «+» «CLICK and HACK» model «-» there are only 5 vulnerabilities «-» limited set of features «SCADA» «+» «CLICK and HACK» model «-» there are only 15 vulnerabilities

10. Used instruments (specialized utilities) Analysis of available NetDDE resources - Neutralbit’snbDDE tool Network DDE (NetDDE) is designed by Wonderware company and is an add-on to MicrosoftWindows DDE that implements data exchangebetween computers in LAN

11. Are there any difficulties? Web application vulnerabilities (SQL-injection) User ID = 1' or 1=(select top 1 password from Users)—Password = blank

12. Active and passive network “secret service” Available resources «The Registered Ports» chapter (Internet Assigned Numbers Authority)ibm-mqisdp 1883/tcpIBM MQSeries SCADAibm-mqisdp 1883/udpIBM MQSeries SCADApnbscada3875/tcpPNBSCADA pnbscada3875/udp PNBSCADA d-s-n 8086/tcpDistributed SCADA Networking Rendezvous Port Active detection - SNMP server scanning results;- detection of solution features (web servers, logged services) Passive detection - interception of network traffic to find specificrequests/responses;(application and network software);- detection of SCADA protocols in available network traffic (DNP3 over an Ethernet, Modbus-TCP);- direct analysis of productive protocols. (by special analyzers, analysis of signal propagation medium).

13. Detected SCASA object - SIEMENS SIMATIC

14. Testing of reliability Stress-test (ICMPPing Flood implementation)– «Reg Tiger Security» #denial of service, then recovery ( idle time - 1 minute)ping -f -s 60601 packets transmitted, 150 packets received, 75% packet loss #denial of service, then recovery (idle time - 1 minute)ping -f -s 600497 packets transmitted, 32 packets received, 93% packet loss #denial of service, without recovery (have to reload)ping -f -s 6000518 packets transmitted, 0 packets received, 100% packet loss #denial of service, without recovery (have to reload)ping -f -s 6000 819 packets transmitted, 0 packets received, 100% packet loss

16. «US Blackout»

17. Borrowed application software components in SCADA

18. Реализация отказа в обслуживании в отношении встроенного WEB-сервера

20. Реализация отказа в обслуживании в отношении встроенного WEB-сервера

21. Реализация отказа в обслуживании в отношении встроенного WEB-сервера

22. Denial of service implementation against imbedded web server

23. Thank you for your attention! http://ITDEFENCE.ruGroup inLinkedIn «Industrial Automation Security»We discuss SCADA security questions