Security Issues and Mitigation in Ethernet POWERLINK
Total Page：16
File Type：pdf, Size：1020Kb
Security of cyber-physical systems: an old idea Security Issues and Mitigation in Ethernet POWERLINK Jonathan Yung, Hervé Debar and Louis Granboulan AIRBUS Group Innovations & Télécom SudParis February 10th, 2017 Recurrent issues in cyber-security I Name changes, keywords and buzzwords I Information systems security ! cyber-security I Intrusion detection ! anomaly detection I Big data I Artificial intelligence I Really represent persistent issues in IT I Security as an afterthought I Security as an overkill I Security without expectations I Security without specifications I ... Can we construct a better approach ? I Safety has clear pre-specified expectations. I Standardized constraints I Industrial control systems have clear specifications. I Control loop I Can we leverage these two old ideas for better security ? I Old keyword: Resilience Outline Introduction to Industrial Control protocols Ethernet POWERLINK Protocol Attacks Defense and Mitigation Detection and Protection Lessons learned ICS Industrial Control System System composed of devices producing data (sensors), and of devices which will act depending of this data (actuator) and of a program. ICS Industrial Control System System composed of devices producing data (sensors), and of devices which will act depending of this data (actuator) and of a program. Programming station HMI Data Historian Site A PLC PLC MTU Sensor Sensor Actuator Sensor Site B Site C Sensor Sensor RTU RTU Sensor IO Module Actuator Sensor Sensor Actuator Actuator Actuator Actuator Process network Control network Industrial Ethernet Protocols I Adaptation of the Fieldbus protocols on Ethernet. I Classified in three types: I Class 1 (soft real-time): MODBUS/TCP, EtherNet/IP I Class 2 (hard real-time): PROFINET (RT) I Class 3 (isochronous real-time): PROFINET IRT, Ethernet POWERLINK, EtherCAT Attack State of the Art Attack MODBUS/TCP (C1) EtherNet/IP (C1) PROFINET RT (C2) Eavesdropping Huitsing et al.[5] Bristow[4] Interruption Huitsing et al.[5] Digital Bond[3] Paul et al.[6] Queiroz[7] Modification Huitsing et al.[5] Antonioli et al.[2] Åkerberg et al.[1] Paul et al.[6] Insertion Huitsing et al.[5] Digital Bond[3] Åkerberg et al.[1] Goal of this presentation I Literature already presents attacks and mitigation measures... I ... but only for class 1 and/or 2 protocols. I The goal of this presentation is to: I test the security of a type 3 protocol: Ethernet POWERLINK I propose security improvements Outline Introduction to Industrial Control protocols Ethernet POWERLINK Protocol Attacks Defense and Mitigation Detection and Protection Lessons learned Architecture MN I It is specified by the EPSG (Ethernet POWERLINK Standardization Group). Hub I It uses the Master/Slave paradigm. CN Hub I A Slave can send a message only if asked by the Master. Hub CN Hub I It is composed of: I one master called Managing Node (MN) Hub I up to 240 slaves called Controlled Node (CN) CN Hub I The master and slaves are connected through Hubs. Cycle Structure Composed of three periods: Isochronous period I Isochronous period SoC MN → all I Asynchronous period PReq CN 1 MN → CN 1 I Idle period PRes CN 1 CN 1 → all ... PReq CN n MN → CN n Cycle PRes CN n CN n → all PRes MN MN → all Asynchronous period SoA MN → all ASnd MN or one CN → all Idle period Network Management I The Network Management (NMT) State init Configuration Machine describes a device behavior. is done not_active I The master can change the NMT state of a Does not receive slave through an ASnd command. any SoC or SoA pre_operational_1 A slave can ask the master to send an NMT I Reset All mandatory CN command to change the NMT state of a slave are identified or of the master. pre_operational_2 MN configuration OK CN lost All CN in ready_to_operate I The NMT states of an master are (non exhaustive list): ready_to_operate No error after a complete cycle I init operational I not_active I pre_operational_1 I pre_operational_2 I ready_to_operate I operational Network Management Reset The Network Management (NMT) State init I Configuration Does not receive is done any SoC or SoA Machine describes a device behavior. (SoC timeout) not_active I The master can change the NMT state of a SoC or SoA basic_ethernet slave through an ASnd command. pre_operational_1 Receives POWERLINK traffic I A slave can ask the master to send an NMT Reset SoC command to change the NMT state of a slave pre_operational_2 NMT-Enable-Ready Error or of the master. -to-Operate ready_to_operate I The NMT states of a slave are (non exhaustive NMT- Enter- NMT-Start-Node list): Pre- ope2 I init operational I pre_operational_1 NMT-Stop-Node I pre_operational_2 stopped I ready_to_operate I operational I stopped Outline Introduction to Industrial Control protocols Ethernet POWERLINK Protocol Attacks Defense and Mitigation Detection and Protection Lessons learned Attacker Model I Our attacks are on the Ethernet POWERLINK MN protocol. Hub I We consider an attacker connected to the CN Hub Ethernet POWERLINK network. Hub I We need physical access. CN Hub I We need a free port. I Attacker positions Hub CN Hub Attacker I Most likely position: end of bus (free port) I Inserted after the master (requires interruption) I Attacker capabilities I Listen to and analyze traffic I Sufficiently fast to impersonate any slave I With enough computational power for crypto operations I Acyclic command insertion I slave impersonation I master reset I master impersonation Attacks Description I Denial of service Send many SoCs I slave impersonation I master reset I master impersonation Attacks Description Measure time I Denial of service between two SoAs I Acyclic command insertion Wait for SoA Void ? Yes No Wait for ASnd Time to No send another ASnd ? Yes Send ASnd I master reset I master impersonation Attacks Description I Denial of service ASnd message Acyclic command insertion insertion: I stop slave I slave impersonation Wait for PReq Send PRes Wait for SoA SoA for the CN ? No Yes Send ASnd I master impersonation Attacks Description I Denial of service I Acyclic command insertion I slave impersonation CN impersonation I master reset Send PRes with PR=0b111 and RS=0b001 Wait for the ASnd for this PRes Send NMT request Attacks Description I Denial of service I Acyclic command insertion I slave impersonation I master reset I master impersonation MN reset Init MN state machine I one using B&R components for the master and slave I one using openPOWERLINK for the master on the same computer as the attacker, and B&R components for the slave Testbed for the implementation of the attacks I Composed of an master, a slave and an attacker MN (attacker is a computer, with Linux 3.13.0-95-lowlatency kernel). I Two testbeds implemented: CN Attacker I one using openPOWERLINK for the master on the same computer as the attacker, and B&R components for the slave Testbed for the implementation of the attacks I Composed of an master, a slave and an attacker X20CP1585 (attacker is a computer, with Linux 3.13.0-95-lowlatency kernel). I Two testbeds implemented: I one using B&R components for the master and slave X20BC0083 Attacker Testbed for the implementation of the attacks I Composed of an master, a slave and an attacker OpenPOWERLINK (attacker is a computer, with Linux 3.13.0-95-lowlatency kernel). I Two testbeds implemented: I one using B&R components for the master and slave X20BC0083 I one using openPOWERLINK for the master on the same computer as the attacker, and B&R components for the slave Attacker Results Attacks B&R components openPOWERLINK Denial of service OK OK Acyclic command insertion OK OK CN impersonation ~OK OK MN reset OK OK MN impersonation OK OK Outline Introduction to Industrial Control protocols Ethernet POWERLINK Protocol Attacks Defense and Mitigation Detection and Protection Lessons learned Summing Up the Attacks I The Master/Slave paradigm simplifies any DoS attacks. I we do not handle mitigation against DoS attacks here I The other attacks are due to weaknesses in the asynchronous period: I no basic authentication of the command I no verification that the ASnd and SoA are consistent I several ASnd can be accepted by a slave DLL State Machine Modification - master Wait SoC trigger SoC trigger → send SoC+PReq last PRes → send SoA, [ASnd] ASnd last PRes timeout → send SoA, [ASnd] Wait PRes Wait ASnd SoC trigger → send SoC + PReq PRes → send PReq PRes timeout → send PReq DLL State Machine Modification - master Wait SoC trigger SoC trigger → send SoC+PReq First correct ASnd Incorrect ASnd → error last PRes → send SoA, [ASnd] Extra ASnd → error last PRes timeout → send SoA, [ASnd] Wait PRes Wait ASnd SoC trigger → send SoC + PReq PRes → send PReq PRes timeout → send PReq DLL State Machine Modification - slave ASnd PReq PRes SoA SoC timeout PReq Wait_SoC SoC timeout PRes SoA ASnd SoA SoA → [ASnd] SoC SoC timeout Wait_SoA PReq→PRes SoC Wait_PReq PRes SoC ASnd DLL State Machine Modification - slave First correct ASnd PReq PRes SoA SoC timeout PReq Wait_SoC SoC timeout PRes SoA ASnd SoA SoA → [ASnd] SoC SoC timeout Wait_SoA PReq→PRes SoC Wait_PReq PRes SoC ASnd DLL State Machine Modification - slave Incorrect ASnd Extra ASnd First correct ASnd PReq PRes SoA SoC timeout PReq Wait_SoC SoC timeout PRes SoA ASnd SoA SoA → [ASnd] SoC SoC timeout Wait_SoA PReq→PRes SoC Wait_PReq PRes SoC ASnd NMT master State Machine Modification init Configuration is done not_active Does not receive any SoC or SoA pre_operational_1 Reset All mandatory CN are identified pre_operational_2 CN lost MN configuration OK All CN in ready_to_operate ASnd error ready_to_operate