Multistage Cyber-physical Attack and SCADA Intrusion Detection...2016/09/04 · Multistage...

transcript

Multistage Cyber-physical Attack and SCADA Intrusion Detection

Workshop on European Smart Grid Cybersecurity: Emerging Threats and Countermeasures Belfast, 26th August, 2016 Kieran McLaughlin, BooJoong Kang, Ivor Bradley, Andrew Wright Centre for Secure Information Technologies (CSIT) @QUB

Outline

Recent cyber-attacks & motivation IEC 61850 smart grid environment Multi-stage cyber-attack scenario Intrusion detection Lab demo

Recent Cyber-attacks

– “Black Energy” • Malware discovered on internet-connected HMIs (2011...2014) • Targeting HMI products from three vendors: GE, Siemens, BroadWin

– “Havex” Remote Access Trojan (RAT) • Targeting OPC communications (2014) • Client/server technology widely used in process control systems

Ref: Trend Micro

What is a RAT?

A Remote Administrator/Access Tool/Trojan is malware that allows the master complete control of the infected machine

RATs can have special features or plugins Well know are:

– PlugX know as Korplug or Gulpix or Thoper – DarkComet – PoisonIvy – Gh0St – Taidoor – Xtreme RAT

Ukraine Electric Grid Attack

The SCADA system was the target (2015)

BlackEnergy appears to have been the “dropper”

A final component made the cyber-physical effect

Analysis from SANS ICS blog 5

Recent Cyber-attacks

– German steel plant (2014) • ‘Spear phishing’ emails and social engineering techniques • Login credentials obtained • Access gained to the office network... and then to the production systems • Blast furnace could not shut down as normal • Caused “massive damage”

Attackers showed technical expertise

Take Away Message

Cyber attack but...

Physical impact

IEC 61850 PV Environment

IEC 61850 server (PV inverter)

IEC 61850 client (HMI)

IEC 61850 Communications standard for substations. Enables integration of protection, control, measurement and monitoring functions

IEC 61850 Smart Grid Environment

Attacker’s controller

Attacker’s web server

Internet

SCADA network

Enterprise network

IEC 61850 client

PV inverter

Windows 7 Office PC

Linux machine E.g. historian

Physical electrical systems

Internet

SCADA network

Enterprise network

IEC 61850 client

PV inverter

Windows 7 Office PC

• Phishing email • Looks genuine • Simple - often successful

Internet

SCADA network

Enterprise network

IEC 61850 client

PV inverter

Windows 7 Office PC

• Infected PC contacts malicious server

• Malware payload downloads and installs

• SPARKS demo with DarkComet, PlugX

Internet

SCADA network

Enterprise network

IEC 61850 client

PV inverter

Windows 7 Office PC

• Attacker ‘pwns’ a PC in the enterprise network

Internet

SCADA network

Enterprise network

IEC 61850 client

PV inverter

Windows 7 Office PC

• Uses “remote desktop” functions of RAT (like Ukraine)

• In this case, the attacker finds a vulnerable web-based historian used by the operator

• Runs known exploit

Internet

SCADA network

Enterprise network

IEC 61850 client

PV inverter

Windows 7 Office PC

• From RAT controller, attacker is able to establish a connection from Windows machine to historian

Internet

SCADA network

Enterprise network

IEC 61850 client

PV inverter

Windows 7 Office PC

• From the RAT controller, the attacker instructs the Linux machine to download another attack payload

• Custom code that allows directed attack against IEC 61850

Internet

SCADA network

Enterprise network

IEC 61850 client

PV inverter

Windows 7 Office PC

• The attacker now begins sniffing the IEC 61850 SCADA commands between the IEC 61850 client and the PV inverter

• Could carry out reconnaissance and learn about the system

Internet

SCADA network

Enterprise network

IEC 61850 client

PV inverter

Windows 7 Office PC

• Communication between IEC 61850 client and PV inverter intercepted and modified

Internet

SCADA network

Enterprise network

IEC 61850 client

PV inverter

Windows 7 Office PC

Attack 1: • Modify the max power limit

of the PV inverter • E.g. change 100% to 40% Attack 2: • Shut down the PV inverter

Multi-stage Cyber-attack Scenario

Phishing email & social engineering

Install Remote Access Trojan (RAT) in office PC

Network mapping & lateral movement

Exploit vulnerability & pivot to SCADA network

Deploy SCADA attack payload

Attack physical system functions

More than one way to skin a RAT... – Multiple options for each stage of a multi-stage

attack

• Waterhole attacks • Infected software • Stolen/insecure

username and password credentials

• Compromise from the internet

• Office PC • Third party remote

maintenance • Engineer’s laptop • BYOD

• Well known tools like nmap

• Havex, Stuxnet sniffed traffic

• RAT can keylog credentials

• Vulnerable operating system

• Vulnerable services on SCADA server, data historian, etc.

• Vulnerable network devices

• Variety of known and unknown vulnerabilities in SCADA devices and software – CVEs

• e.g. GE, Siemens, BroadWin

• Inherently vulnerable SCADA protocols

• Devices vulnerable to freeze, shutdown, etc.

Observations (1/2)

BlackEnergy, Havex and steel mill attacks: – Control systems are being specifically targeted – Malware / intruders aim to identify specific control system

communications and devices – Attackers have technical knowledge of underlying control systems,

physical systems & communications >> not ‘script kiddies’ – Trajectory is towards selective intrusions and tailored attacks

We need to: – Better understand the physical consequences of cyber-attacks – Develop and embed resilience measures to mitigate impact

Observations (2/2)

Prediction: 2010s the decade when open and standard –but obscure– SCADA protocols become known by attackers

Our work contributes to mitigating the impact of resultant attacks in the SCADA domain

No Standard Protocols

Proprietary and Industrial

Protocols

Open Protocols

Promoting Standard Protocols

1970s 1980s 1990s 2000s

Closed, centralised, without standards Open, distributed, standards based

2010s..?

A brief history of SCADA communication protocols*

21 * Modified from: Ten, Chee-Woo, et al. “Cybersecurity for electric power control and automation systems." 2007 IEEE International Conference on Systems, Man and Cybernetics. IEEE, 2007.

Outline

Recent cyber-attacks & motivation IEC 61850 smart grid environment Multi-stage cyber-attack scenario Intrusion detection Lab demo

Objectives for SCADA IDS

Current approaches: – Security generally lacks awareness of power systems properties – SCADA protocols lack consideration for cyber security – Lack of deep analysis at SCADA application layer – NIST recommends further research on above

Our aims are therefore: – Combine SCADA and power systems knowledge to effectively

monitor application layer data – SCADA protocol verification, stateful analysis, and functional

whitelisting to support intrusion detection in IEC61850 use-case – Collaborative approach towards supporting Resilient Control with

SCADA IDS information

Multi-Attribute SCADA IDS Concept

Whitelist & Signature

Whitelist – Alerts on any traffic not specified as allowed

Signature – Detect known attacks – Can comprise part of stateful analysis

• E.g. Complicated attacks with multiple packets

alert tcp any any -> 10.55.55.111 102 (msg:"Write Request with Low Active Power Limitation"; sid:10000007; pcre:"/\xa0.*\xa5.\xa0.*DRCC1\$SP\$MaxWLimPct\$setMag\$f .*\x08((\x41(\x20\x00\x00|([\x00-\x0f]|[\x10-\x1f])..)|\x40...)|([\x00-\x0f]|[\x10-\x1f]|[\x20-\x2f]|[\x30-\x3f])...)$/")

Example signature for PV inverter attack

‘Characterisation’ of Environment

Critical State Analysis – System description and critical state representation – State evolution monitor – Critical state detection, e.g. $MaxWLimPct <10%

Example: turbine in a factory – If the temperature is greater than 99 and the turbine rotates at

less than 1000 rpm

PLC[10.0.0.10:502].HR[1] < 1000, → Alert : 4

PLC[10.0.0.22:502].IR[1] > 99

Carcano, A. et al. (2011). A Multidimensional Critical State Analysis for Detecting Intrusions in SCADA Systems. IEEE Transactions on Industrial Informatics, 7(2), 179–186.

Deep protocol analysis, MMS Request / Response Meta-data about network traffic and payload content

‘Characterisation’ of Environment

Stateful Analysis

Correlated Rules

Unsupervised Learning Model

Yoo, H. et al. (2014). Novel Approach for Detecting Network Anomalies for Substation Automation based on IEC 61850. Multimedia Tools and Applications, 1–16.

Single MMS Packet

Multi-Attribute SCADA IDS

Network Traffic

Whitelist Generation

Signature Generation

Stateful Rule Generation

Protocol Violation

Rule Generation

Machine Learning

System Configurations

3rd Party Signature DB

Protocol Standards

Normal Data

Attack Data

Whitelist

Signatures

Violation & Stateful Rules

Models

ELK (Elasticsearch, Logstash, Kibana)

SPARKS ‘MMS Scanner’

MMS device detection – Port scan (102)

Information gathering – Send valid requests

• Domain name, attributes Attacker

– Attribute manipulation • Known or random values

Therefore, to characterise normal network behaviour we must include all these SCADA-specific parameters IEC 61850-8-1

Lab Demo

Let’s ROCK

Multistage Cyber-physical Attack and SCADA Intrusion Detection...2016/09/04 · Multistage...

Documents