0. Security analysis of a commercial Synchro Phasor device
Meeting DOTS-LCCI, Rome, May, 30-31, 2011
Department of Technologies
University of Naples “Parthenope”
Salvatore D’Antonio
Luigi Coppolino
Ivano Alessandro Elia
Luigi Romano

1. Summary of our work Password Eavesdropping
Weak Policies on Password selection/maintenance
Unreliable channels: integrity, availability
Poor input validation

2. New findings
We have analyzed the Phasor Data Concentrator (PDC) Applications:
Communication between the Synchrophasors and the PDC
The implementation of the PDC application
Architecture of a PDC application is not too different from that of a web application
We claim that: Classic cyber attacks, like
SQL Injections, are not limited to the
web application scenario

3. PDC Applications and Web Applications3

4. Syncrophasors communication with the PDC application: The IEEE C37
Syncrophasors communication with the PDC application: The IEEE C protocol 4
C is the IEEE standard for phasor data collection
Current version issued in 2005
It is a light protocol
5 type of messages:
Data Frame, Configuration Frame 1, Configuration Frame 2, Header Frame, Command Frame
Configuration Frame contains ASCII Identifiers for the PMU and its Measurements
No encryption
No means of verification of the messages source

5. OpenPDC Open source platform for the development of PDC applications5
Open source platform for the development of PDC applications
Developed by Tennessee Valley Authority
Used in NASPINet
Three Adapter Layers:
Input Adapter
Action Adapter
Output Adapter

6. An OpenPDC-based application6
Uses Standard Adapters provided within OpenPDC:
Input: C37.118
Output: MySQL
Application uses information obtained from the C Configuration Frames to create the tables to store acquired measurement results

7. PDC adapter implementation7
In the Standard OpenPDC MySQL Adapter:
No input validation
SQL statements are created appending values provided by the PMU

8. SQL Injection on an OpenPDC Application8
An attacker might exploit:
C vulnerabilities
lack of encryption and source verification -> Man-in-the-middle attack
OpenPDC vulnerabilities
lack of input validation and sanitization -> Inject malicious SQL code in the Database

9. Exploitation Scenarios9
“DROP” statement injection
Destroy all the measurements data for a PMU
“DELETE” statement injection
Selectively erase some specific measurements
“ALTER” statement injection
Can be used to smartly swap the names of measurements tables
Cheat the triangulation used to detect source of dangerous event like blackouts
Deceive the monitoring operator

10. Conclusions 1/2 10
We analyzed some security issues of Phasor Data Concentrator Application
Used the most close to realty scenario achievable:
A Commercial Synchrophasor
The IEEE standard protocol (C37.118)
An application based on the most important PDC applications platform available
Our findings:
Cutting edge technologies may be affected by traditional security issues:
lack of encryption of the communications
lack of input validation and sanitization
weak passwords
Man-in-the-middle attacks
dictionary attacks

11. Conclusions 2/2 As was also demonstrated by recent reports:11
As was also demonstrated by recent reports:
Symantec Intelligence Quarterly Report: October- December - Targeted Attacks on Critical Infrastructures [Stuxnet], December 2010
McAfee, Global Energy Cyber attacks: Night Dragon, February 2011
Classic IT security issues do affect critical infrastructures and will probably increasingly be relevant for these applications in the future.