Likes: 0
Just flipped on CNN, watching the masses snake through the streets of
Manhattan as correspondents state that this could be an affect of the
blaster worm.
Interesting but I don't see how an worm of this magnitude (smaller than that
of Slammer/Sapphire and others) could influence DCS and SCADA systems around
the US, particularly just in the North East.
Thoughts?
Cheers,
Geoff Shively, CHO
PivX Solutions, LLC
Are You Secure?
http://www.pivx.com
This email was origionaly posted to bugtraq early on in the 'crisis' but due
to obvious congestion and instability issues it wasnt posted for a while.
Since this post I have done much research on SCADA, DCS, and HMI
(Human Machine Interface) systems. These systems run primarily
on Windows and rely on RPC for remote monitoring. If this doesnt
sound like an overwhealiming coincidance than I dont know what does.
[ http://216.239.37.104/search?q=cache...t-div.web.cern
..ch/st-div/ST2001WS/Proceedings/Session42/Sollander.pdf+SCADA+
Windows+RPC&hl=en&ie=UTF-8
"The data transmission layer is used to transport data from the equipment
to at least one controlor monitoring application. This is usually done by
remote procedure calls (RPC) or a middle-wareover a TCP/IP network."
- CERN ]
There has been much talk about this on DShield and Full Disclosure if
anyone is interested in reading more.
Cheers,
Geoff Shively, CHO
PivX Solutions, LLC
Are You Secure?
http://www.pivx.com
----- Original Message -----
From: "Bernie, CTA" <cta@hcsin.net>
To: <bugtraq@securityfocus.com>
Cc: "Geoff Shively" <gshively@pivx.com>
Sent: Friday, August 15, 2003 11:09 AM
Subject: Re: CNN: 'Explores Possibility that Power Outage is Related to
Internet Worm'
> It is ridiculous to accept that a lightning strike could knock
> out the grid, or the transmission system is over stressed. There
> are many redundant fault, limit and Voltage-Surge Protection
> safeguards and related instrumentation and switchgear installed
> at the distribution centers and sub stations along the Power
> Grid that would have tripped to prevent or otherwise divert such
> a major outage.
>
> I believe that the outage was caused by the MSblaster, or its
> mutation, which was besieged upon the respective vulnerability
> in certain control and monitoring systems (SCADA and otherwise)
> running MS 2000 or XP, located different points along the Grid.
> Some of these systems are accessible via the Internet, while
> others are accessible by POTS dialup, or private Frame relay and
> dedicated connectivity.
>
> Being an old PLC automation and control hack let me say that
> there is a very good plausibility that the recent East Coast
> power outage was due to an attack by an MBlaster variant on the
> SCADA system at the power plant master terminal, or more likely
> at several of the remote terminal units "RTU". SCADA runs under
> Win2000 / XP and the telemetry to the RTU is accessible via the
> Internet.
>
> From what I recall SCADA based monitoring and control systems
> were installed at many water / sewer processing, gas and oil
> processing, and hydro-electric plants.
>
> I also believe that yesterdays flooding of a generator sub-
> facility in Philadelphia was also due to an MBlaster variant
> attack on the SCADA or similarly Win 2000 / XP based system.
>
> To make things worst, the Web Interface is MS ActiveX. Now lets
> see, how can one craft an ActiveX vuln vector into the blaster?
>
> Oh, and for the wardrivers, SCADA can be access via wireless
> connections on the road. puts a new perspective on sniffing
> around sewer plants.
>
> It is also reasonable to assume that we could have a similar
> security threat regarding those system (SCADA and otherwise
> based on MS 2000 or XP) involved in the control, data
> acquisition, and maintenance of other critical infrastructure,
> such as inter/intra state GAS Distribution, Nuclear Plant
> Monitoring, Water and Sewer Processing, and city Traffic
> Control. IMO
>
> I think we will see a lot of finger pointing by government
> agencies, Utilities, and politicians for the Grid outage, until
> someone confess to the security dilemma and vulnerabilities in
> the systems which are involved in running this critical
> infrastructure.
>
> Regardless of whether the Grid outage can be attributed to the
> blaster or its variant, this is not entirely a Microsoft
> problem, as it reeks of poor System Security Engineering
> practiced by the Utility Companies, and associated equipment and
> technology suppliers.
>
> Nonetheless, the incident will cause lots of money to be
> earmarked by the US and Canadian Governments, to be spent in an
> attempt to solve the problem, or more specifically calm the
> public.
>
> This incident should be fully investigated, and regulations
> passed to ensure that the Utility companies and their suppliers
> develop and implement proper safeguards that will help prevent
> or at least significantly mitigate the effects of such a
> catastrophe.
>
> Conversely, I do not want to see our Government directly
> involved in yet another "business", which has such a controlling
> impact over our individual lives.
>
> -
>
>
>
>
> On 14 Aug 2003 at 15:18, Geoff Shively wrote:
>
> > Just flipped on CNN, watching the masses snake through the
> > streets of Manhattan as correspondents state that this could be
> > an affect of the blaster worm.
> >
> > Interesting but I don't see how an worm of this magnitude
> > (smaller than that of Slammer/Sapphire and others) could
> > influence DCS and SCADA systems around the US, particularly just
> > in the North East.
> >
> > Thoughts?
> >
> >
> > Cheers,
> >
> > Geoff Shively, CHO
> > PivX Solutions, LLC
> >
> -
> ************************************************** **
> Bernie
> Chief Technology Architect
> Chief Security Officer
> cta@hcsin.net
> Euclidean Systems, Inc.
> ************************************************** *****
> // "There is no expedient to which a man will not go
> // to avoid the pure labor of honest thinking."
> // Honest thought, the real business capital.
> // Observe> Think> Plan> Think> Do> Think>
> ************************************************** *****
>
>
>
=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Op vrijdag 15 augustus 2003 00:18, schreef Geoff Shively:
> Just flipped on CNN, watching the masses snake through the streets of
> Manhattan as correspondents state that this could be an affect of the
> blaster worm.
>
> Interesting but I don't see how an worm of this magnitude (smaller than
> that of Slammer/Sapphire and others) could influence DCS and SCADA systems
> around the US, particularly just in the North East.
>
> Thoughts?
Well, it might be possible because the SCADA systems run on Windows 2000/XP=
=20
and some are connected to the internet.=20
<http://www.pbs.org/wgbh/pages/frontl...cyberwar/view/>
Includes some information about the power grid.
<http://www.automationtechies.com/sitepages/pid641.php>
Articles about SCADA systems.
Just my two cents.
=2D --=20
Yannick Van Osselaer
Public Key: wwwkeys.us.pgp.net
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux)
iD8DBQE/PSP093+qyX+enAERAtr2AKCMIzYQmcSYvASuFpmZpGXjoUUYPw CglTJ/
qecUpYGZlsv98pLGRsFYaW8=3D
=3DIx+2
=2D----END PGP SIGNATURE-----
On August 15, 2003 11:21 am, Geoff Shively wrote:
> This email was origionaly posted to bugtraq early on in the 'crisis' but
> due to obvious congestion and instability issues it wasnt posted for a
> while.
>
> Since this post I have done much research on SCADA, DCS, and HMI
> (Human Machine Interface) systems. These systems run primarily
> on Windows and rely on RPC for remote monitoring. If this doesnt
> sound like an overwhealiming coincidance than I dont know what does.
>
> [ http://216.239.37.104/search?q=cache...t-div.web.cern
> .ch/st-div/ST2001WS/Proceedings/Session42/Sollander.pdf+SCADA+
> Windows+RPC&hl=en&ie=UTF-8
>
> "The data transmission layer is used to transport data from the equipment
> to at least one controlor monitoring application. This is usually done by
> remote procedure calls (RPC) or a middle-wareover a TCP/IP network."
> - CERN ]
>
> There has been much talk about this on DShield and Full Disclosure if
> anyone is interested in reading more.
While I have bid on a power system network audit, I haven't specifically
done one, so this is conjecture.... but somewhat informed conjecture.
Re: SCADA vulnerabilities
Yes you might have SCADA vulnerabilities... but in the power system
SCADA is used for data collection and measurement only not control.
This is at least in western Canada, YMMV but I believe this is typical of
other systems. The power routing is still done by humans flipping
(really freaking big) switches - or starting turbines or turning hydro
valves. There are lots of physical procedures and safeguards in the
system too. And people think carefully about those decisions, because
the fines and regulatory penalties for being out of spec are measured
in tens of thousands of dollars per minute.
You might be able to interfere with the data going into the power
NOC and fool the operators into making the wrong phone calls.
But arguably you would need to know a lot about the design of the
system and specific procedures and policy to create an outage
this way.
As far as I know there are no (or few) network based feedback loops in
typical power system. Breakers pop at predetermined points, the system
parameters are fairly static. In the western Canadian system, operators
review power demand and capacity on an hourly basis, and make the
appropriate routing decisions (and output levels of variable output
plants) and adjust capacity by bringing plants on line or adjusting
network topology to keep system stability.
As an interesting factoid, in the directives list for power noc engineers,
the prime directive is network stability (crucial for interconnected systems
outside theirs) and delivering power to customers comes lower in the list.
Unlike the internet, the power system is a network that delivers a very stable
commodity 60Hz 110 volts. There are no router like components that
dynamically adjust paths, and capacity based on any measured
data. All the collection and info feeds back to a control center where a
human operator adjusts simulations first and then when that's checked
by another engineer on other simualtions the configuration is "downloaded"
into the system via telephone to regional operators. The dynamic components
are like breakers, primarily binary on/off devices with fixed trigger
parameters not things adjusted constantly by a processor based on
network input. Power system switches are big physical things typically
moved by burly technicians, rather than a packet sent remotely by a
distant button or software.
If the control network goes away the systems will default to preset stable
(but not necessarily optimal) presets in the equipment I'm aware of.
Similarly if communications outages occur, the regional operators
have fallback stances in "safe" configurations. Unlike the internet
reliability engineers and audits are a big concern in the power system
engineering. The engineers there do their best to make sure that
the result of any or all of the components failing does not equal
"no power for anyone". Also unlike the internet power engineers _do_
consider "What if" scenarios for any individual components failing.
While from my knowledge there could be areas of vulnerability
in power distribution that might concern me (none of which I will
discuss) if I was building an attack tree. However, network based
disruption does not rank very high on my concern list.
If I really wanted to create a power outage, my tool of choice would
be a chainsaw, not network packets :-).
(News at 11: Chainsaws Banned because of potential terrorist threat :-)
cheers,
--dr
(Caveats, and Disclaimers:
I used to be a vms admin and developer at a power company R&D lab in uni.
Interestingly, one of the things I worked on was outage crash dump loggers.
I have visited mutliple power NOCs and have some knowledge of their
procedures. My now retired father used to manage the power distribution
system in western Canada, and my conclusions are based on information
thusly gleaned over time. :-)
--
Top security experts. Cutting edge tools, techniques and information.
Tokyo, Japan November, 2003 http://www.pacsec.jp
pgpkey http://dragos.com/ kyxpgp
Quote