Every time I hear people tell me how it would take a nation state budget with an army of trained cyber warriors to design and infiltrate systems I wonder where they get their data from. Billy Rios has been kind enough to argue against this not only in theory but by demonstrating just how easy it was for him to find vulnerabilities in the Siemens SIMATIC system. Now he has released exploit details.
Nothing sophisticated here:
If a user changes their password to a new password that includes a special character, the password may automatically be reset to “100â€. Yes, you read that correctly… if a user has any special characters in their password, it may be reset to “100â€. You can read about these awesome design decisions (and many others) in the Siemens user manuals.
And again:
For those non-techies reading this… what can someone do with this non-existent bug? They can use this to gain remote access to a SIMATIC HMI which runs various control systems and critical infrastructure around the world… aka they can take over a control system without knowing the username or password. No need to worry though, as there are “no open issues regarding authentication bypass bugs at Siemens.â€
In his presentations he has pointed out that evaluation of the exploits is easy from the comfort of one’s own bedroom. In his latest post he also points to some (perhaps illegal) remote test options.
I’ve found MANY of these services listening on the Internet… in fact you can find a couple here: http://www.shodanhq.com/search?q=simatic+HMI
https://www.google.com/?#q=%22SIMATIC+HMI+Miniweb+on%22
A major tenet of my argument at the Dr. Stuxlove presentation was that we can do ourselves a serious disservice in risk management by overestimating the sophistication and talent of our adversaries. If the level of knowledge required to exploit a system is low then vendors will be under far more pressure to patch and fix.
Another interesting way of looking at this is to review the natural schism of resources in the security industry; there’s natural tension between remediation and investigation. Those monitoring for attacks may emphasize a presence of highly sophisticated adversaries because there is a direct link to their funding. If you put them into a complete risk equation and point out that vulnerabilities are easily fixed they will tell you that you just don’t understand how smart the people are that you are up against. Don’t be tempted to give them more money right away. That is the point at which you should ask them “define sophisticated”, which really means explain the details of vulnerabilities and the cost of remediation.
True security is to live a vulnerable lifestyle. When someone says driving a car safely is so sophisticated that you should spend millions on detection and investigation funds, you might be in a position to respond that wearing a seatbelt, installing airbags, brakes and suspension will work just fine for your risk management program. That is to say there is a balance of investment and overestimating the sophistication of threats may lead to less risk reduction than spending on innovation around the reduction of vulnerabilities.
Of course manufacturers first have to acknowledge that their emperor is naked — vulnerabilities are real.
For all the other vendors out there, please use this as a lesson on how NOT to treat security researchers who have been freely providing you security advice and have been quietly sitting for half a year on remote authentication bypasses for your products.
Since Siemens has “no open issues regarding authentication bypass bugsâ€, I guess it’s OK to talk about the issues we reported in May. Either that or Siemens just blatantly lied to the press about the existence of security issues that could be used to damage critical infrastructure…. but Siemens wouldn’t lie… so I guess there is no authentication bypass.
Siemens has faced embarrassing exposure of public security issues in the past, public disclosure of easy exploits, and has released advisories so it will be interesting to watch how this episode plays out.
Billy Rios is thus doing a great service by pointing our attention to something Americans should already be very familiar with. A Siemens SIMATIC is Unsafe at any speed: there are Designed-In Dangers in critical infrastructure systems.
