Exploiting and abusing web applications flaws in industrial and network communication devices

PLCS, data acquisition servers and industrial network communication gateways/routers often comes with a web server/web service enable, these web applications usually are being put in production with a lot of bugs and issues. Vulnerablities like stored XSS , path traversal,LFI, or RCE those are really easy to find in this devices but task needs to be done manually since automated tools/scanners usually crash the web application during the scan execution .In the worse scenario these web servers are being publish in the internet and remote attackers can take over these vulnerablilities in order to get access ,remote execution or persistance in browsers.

In this presentation, i,m going to demonstrate real cases about several vulnerablities found in web servers from PLCs, Weather stations and industrial gateways/routers from well known vendors in the industrial field , i will demostrate practical exploitation step by step about issues that i found and have been reported to every vendor affected, i will share tips and techniques to spot easy and quickly vulnerablities in these web appications in industrial devices.

Transcript

1. Exploiting and abusing web applications flaws in industrial and network communication devices Bertin B. Syscan (Sysmposion for Asia Security Network) Beijing China
2. Introduction
3. C.O.W Team Industrial Security Research @bertinjoseb @capitan_alfa
4. Overview -Introduction -Operational Technologies -Web applications and other services -The problem of internet connected devices -Technical analysis of the exploits/ vulnerabilities -HARDCORE DEMO TIME -Recommendations/Conclusions
5. Operational Technologies -Different world, in comparison to I.T -Fully Connected -Web applications for fun and profit. -Buggy Code -Unlimited research field and unknown ….. -You could cause a mess -Or kill someone… -Just be careful
6. What’s inside ? -PLCs,Industrial Network gateways, RTUs Weather stations,HMIs, Solar Power components -Javascript,HTML -Linux servers -Custom web servers -SNMP,MODBUS -Old school bugs -Buffer Overflows -Poor code implementation in Web applications -usually running as root -and ugly like web interfaces
8. Cross Protocol Injection In this scenario you don’t have access to the web server, but you can infect the web application with javascript code using another protocol available.
12. Let’s mix some features Usually in schnedier industrial equipment SNMP comes enable by default with read/write permissions, this is dangerous because the web application takes strings directly from the SNMP MIB in order to represent information values like the system name or the system location.
16. DEMO TIME
17. Netbiter Anti-web server CVE 2017-9097
18. DEMO TIME
22. Powador PROlog
23. DEMO TIME
24. Weather Stations
25. DEMO TIME
26. HMIs Buffer Overflow
36. DEMO TIME
37. Conclusions Q&A
38. Thanks !