Sergey Gordeyhcik-Industrial CyberSecurity Mission Centric Approach-工业互联网安全论坛

employee

IndustrialCyberSecurity

MissionCentricApproach

SergeyGordeyhcik

SCADAStrangeLove

ResearchTeam

WWW.SCADA.SL

GroupofsecurityresearchersfocusedonICS/SCADA

AlexanderTimorin

DmitrySerebryannikov

SergeyDrozdov

AlexanderTlyapov

DmitrySklyarov

SergeyGordeychik

AlexanderZaitsev

EvgenyErmakov

SergeySidorov

AlexeyOsipov

GlebGritsai

SergeyScherbel

AndreyMedov

IlyaKarpov

TimurYunusov

ArtemChaykin

IvanPoliyanchuk

ValentinShilnenkov

DenisBaranov

KirillNesterov

VladimirKochetkov

DmitryEfanov

RomanIlin

VyacheslavEgoshin

DmitryNagibin

RomanPolushin

SergeyBobrov

YuriGoltsevYuriyDyachenko

tosaveHumanityfromindustrialdisasterandtokeepPurityOfEssence

CYBERSECURITY?

INDUSTRIALCYBERSECURITY

Functional

Safetyand

Reliability

Industrial

Safety

Information

Security

Thesecretsofcybersecurity,ValentinGpanovich,EfimRozenberg,SergeyGordeychik.RailwayStrategies,Issue130

/schofieldpublishingltd/docs/railway_strategies_issue_130_june_2

THREATS?

THREATS?

/story/four-cyber-attacks-on-uk-railways-in-a-year-10498558

/technology/2016/jan/07/ukrainian-blackout-hackers-attacked-media-company

INTERCONNECTEDWORLD

32C3,Hamburg,TheGreatTrainCyberRobbery

220,558ONLINE,17,042INENTERPRISES

/analysis/publications/75343/industrial-cybersecurity-threat-landscape/

ICSONLINE:CHINA

ICSONLINE:CHINA

/blog/2016/03/census-scanning-from-siemens-s7-plc-cpustatus/

GREATERCHINA

~10,000OF“SMART”POWERGRIDOBJECTS

•GREENENERGY

•SMARTGRID

•DIGITALSUBSTATIONS121,000KMOFRAILWAYS

•19,000KMOFHIGH-SPEEDLINES

•HIGHLYAUTOMATED

•NATIONALHIGH-SPEEDRAILGRID(4+4)

DIGITALSUBSTATIONTAKEOVER

CTF-STYLEWHITEHATINDUSTRIALCHALLENGE

/press/news/41213/

DIGITALSUBSTATIONTAKEOVER:GOALS

•FINDVULNERABILITIESINIEC-61850SUBSTATIONS

•CREATEEXPLOIT

•TRIGGERCYBER-PHISICALATTACK

RelayProtection

/press/news/41213/

VULNERABILITIESINRELAYPROTECTION

REMOTECODEEXECUTION?

•togetfirmware?

•togetdebugsymbols?

•todebug?

•..PowerPC

•no“operationsystem”

CONFIRMATIONCODE“311299”

Toaccessthisinformation,theconfirmationcode“311299”needstobeprovidedwhenprompted."

...Siemensdoesnotpublishofficialdocumentationonthesestatistics.ItisstronglyrecommendedtoworktogetherwithSiemensSIPROTECcustomercareorcommissioningexpertstoretrieveandinterpretthestatisticsandtestinformation..."

DEVICEMEMORY

/2015/12/now-declared-capabilities.html

CODEREUSE

Linux

VxWorks6.x

61850Stack

MisfortuneCookie

SSHserver

Kudos@repdet@k_v_Nesterov@samincube

RAILWAYCOMPUTERBASEDINTERLOCKING

RAILWAYGSM-RISSUES

VULNERABILITIESOF(U)SIM

•Remotedatarecovery(Kc,TIMSI)

–Chaneldecryption(includingA5/3)

–«Clone»theSIMandmobilestation

•SIM“malware”

•BlockSIMviaPIN/PUKbrute

•ExtendedOTAfeatures(FOTA)

KarstenNohl,https://srlabs.de/rooting-sim-cards/

AlexanderZaitsev,SergeyGordeychik,AlexeyOsipov,PacSec,Tokyo,Japan,2014

LOCALVENDORS

INDUSTRIALCYBERSECURITY

Functional

Safetyand

Reliability

Industrial

Safety

Information

Security

Thesecretsofcybersecurity,ValentinGpanovich,EfimRozenberg,SergeyGordeychik.RailwayStrategies,Issue130

/schofieldpublishingltd/docs/railway_strategies_issue_130_june_2

MISSIONCENTRICAPPROACH

Industrialsafety:directlyaffectphysicalsafety.

Economical:decreaserailroadtrafficcapacityorotherquantitativeeconomicalcharacteristics(traindelays,localpoweroutage)

Reliabilityandfunctionalsafetyimpact:ICScrashes,outofservice,etc.

COMPUTERBASEDINTERLOCKING

1

2

FORMALREQUIREMENTS

CBI:THREATMODEL

1.Safety(CyberPhysicalThreats)

•setalessrestrictivesignallight

•operateaswitchwithatrainpassingoverit

•setconflictingroutes…

2.Economics(freightefficiency)

•CBICPUcrash

•Blockingofcontrol

•Falseindication…

3.Reliabilityandfunctionalsafety

•CBICPUreboot

•Networkcrash…

Signallingcybersecurity:theneedforamission-centricapproach

ValentinGapanovich,EfimRozenbergandSergeyGordeychik

/index.php/signalling/signalling-cyber-security-the-need-for-a-mission-centric-approach.html

FULLPICTURE

LETDOITTOGETHER!

•GOVERNMENT

REGULATORYAUTHORITIES

LAWENFORCEMENTS

CERTS

•RESEARCHERS

•ICSVENDORS

•SECURITYVENDORS

•OPERATORSOFCRITICALINFRASTRUCTURE

#SCADASOS

Q:WTFSACADSOS?

A:SCADASOS-(un)Secure

OpenSmartGridsisopen

initiativetoriseawarenesson

insecuritiesofSmartGrid,

PhotovoltaicPowerStations

andWindFarms.

Q:Howtoparticipate

A:FindInternet-connectedPV