Security analysis of a commercial Synchro Phasor device Meeting DOTS-LCCI, Rome, May, 30-31, 2011 Department of Technologies University of Naples “Parthenope” Salvatore D’Antonio Luigi Coppolino Ivano Alessandro Elia Luigi Romano

Summary of our work Password Eavesdropping Weak Policies on Password selection/maintenance Unreliable channels: integrity, availability Poor input validation

New findings We have analyzed the Phasor Data Concentrator (PDC) Applications: Communication between the Synchrophasors and the PDC The implementation of the PDC application Architecture of a PDC application is not too different from that of a web application We claim that: Classic cyber attacks, like SQL Injections, are not limited to the web application scenario

PDC Applications and Web Applications 3

Syncrophasors communication with the PDC application: The IEEE C37 Syncrophasors communication with the PDC application: The IEEE C37.118 protocol 4 C37.118 is the IEEE standard for phasor data collection Current version issued in 2005 It is a light protocol 5 type of messages: Data Frame, Configuration Frame 1, Configuration Frame 2, Header Frame, Command Frame Configuration Frame contains ASCII Identifiers for the PMU and its Measurements No encryption No means of verification of the messages source

OpenPDC Open source platform for the development of PDC applications 5 Open source platform for the development of PDC applications Developed by Tennessee Valley Authority Used in NASPINet Three Adapter Layers: Input Adapter Action Adapter Output Adapter

An OpenPDC-based application 6 Uses Standard Adapters provided within OpenPDC: Input: C37.118 Output: MySQL Application uses information obtained from the C37.118 Configuration Frames to create the tables to store acquired measurement results

PDC adapter implementation 7 In the Standard OpenPDC MySQL Adapter: No input validation SQL statements are created appending values provided by the PMU

SQL Injection on an OpenPDC Application 8 An attacker might exploit: C37.118 vulnerabilities lack of encryption and source verification -> Man-in-the-middle attack OpenPDC vulnerabilities lack of input validation and sanitization -> Inject malicious SQL code in the Database

Exploitation Scenarios 9 “DROP” statement injection Destroy all the measurements data for a PMU “DELETE” statement injection Selectively erase some specific measurements “ALTER” statement injection Can be used to smartly swap the names of measurements tables Cheat the triangulation used to detect source of dangerous event like blackouts Deceive the monitoring operator

Conclusions 1/2 10 We analyzed some security issues of Phasor Data Concentrator Application Used the most close to realty scenario achievable: A Commercial Synchrophasor The IEEE standard protocol (C37.118) An application based on the most important PDC applications platform available Our findings: Cutting edge technologies may be affected by traditional security issues: lack of encryption of the communications lack of input validation and sanitization weak passwords Man-in-the-middle attacks dictionary attacks

Conclusions 2/2 As was also demonstrated by recent reports: 11 As was also demonstrated by recent reports: Symantec Intelligence Quarterly Report: October- December - Targeted Attacks on Critical Infrastructures [Stuxnet], December 2010 McAfee, Global Energy Cyber attacks: Night Dragon, February 2011 Classic IT security issues do affect critical infrastructures and will probably increasingly be relevant for these applications in the future.