repdet

A deep dive into power generation process, industrial solutions and their security implications. Flavoured with vulnerabilities, penetration testing (security assessment) methodology and available remediation approaches.

The research studies a very widespread industrial site throughout the world – power generation plants. Specifically, the heart of power generation – turbines and its DCS – control system managing all operations for powering our TVs and railways, gaming consoles and manufacturing, kettles and surveillance systems. We will share our notes on how those systems are functioning, where they are located network-wise and what security challenges are facing owners of power generation. A series of vulnerabilities will be disclosed along with prioritisation of DCS elements (hosts) and attack vectors. Discussed vulnerabilities are addressed by vendor of one of the most widespread DCS on our planet. During the talk we will focus on methodology how to safely assess your DCS installation, which security issues you should try to address in the first place and how to perform do-it-yourself remediation. Most of the remediation steps are confirmed by vendor which is crucial for industrial owners.

Other people: @_moradek_ c0rs

For years SCADA StrangeLove team speaks about vulnerabilities in Industrial Control Systems. Now we want to show by example of railway the link between information security and industrial safety and demonstrate how a root access gained in a few minutes can bring to naught all the years of efforts that were devoted to the improvement of fail-safety and reliability of the ICS system. Railroads is a complex systems and process automation is used in different areas: to control power, switches, signals and locomotives. At this talk we will analyze threats and vulnerabilities of fundamental rail-road automation systems such as computer based interlocking, automatic train control and automatic train protection. No vendor names and vulnerabilities details will be released, for obvious reasons. By the way, all research based on hands-on security exercises and most of issues are confirmed and processed by vendors.

Other people: Sergey Gordeychik Aleksandr Timorin

SCADA StrangeLove team will present their research on ICS systems for the second time on CCC. Last year we showed current situation with security of industrial world and disclosed a big number of vulnerabilities found in Siemens ICS solutions. Part of vulnerabilities, we can say most notable one, wasn’t disclosed due to Responsible Disclosure. This time we already know. We will speak about several industrial protocols and their weaknesses. During this year we played with new industrial hardware and software – this patitially brings new “We don’t know yet” vulnerability details. Moreover, we’ll mention creepiest bugs undisclosed from last year, tell you about new ones and build attack vectors from them. At last, we will share our experience in pentesting ICS enviroments. Speakers: Gleb Gritsai and Sergey Gordeychik

1. Introduction 1.a. About SCADA StrangLove 1.b. We were here before c. Why we eat what we eat 2. ICS in internet – piece of cake 2.a. Massscan, zmap, sonar, etc. 2.b. One time scan isn’t sexy today – Continuous monitoring 2.c. Pizza Owens on the internets now 3. More protocols – more fun 3.a. Profinet/DCP 3.b. IEC104 – the bad and the bad 3.c. MMS – from reflash to tag 3.d. S7 saga continued 3.e. Every self-respecting ICS vendor must have own buggy protocol 4. “Darwin” bugs in ICS 4.a. Statistic and detailed analysis of vulnerabilities discovered by SCADASL team 5. Don’t try it at home - Pentesting ICS environment 5.a. Listen to the turbines 5.b. Sit in hardened rooms 5.c. Remember the exit paths 6. What we already know. Fixes and releases in 2013 7. Things we don’t know yet 7.a. Old friends: Siemens 7.a.i. New S7-1500 PLC 7.a.ii. Cookie monster to own all PLC’s 7.b. New friends 7.b.i. Invensys vulnerabilities 7.b.ii. ABB vulnerabilities and exploit demo 7.b.iii. Emerson vulnerabilities 8. Special 30C3 releases

Other people: sgordey