1. SCADA Security, DNS Phishing
Avesta Hojjati, Commuter science department
Advisor Dr Akbar Namin
Texas Tech University

2. What is SCADA?
Supervisory Control And Data Acquisition, type of Industrial Control System (ICS).
Computer based
Communication through IPv4 & IPv6
Uses PLC (Programing Logic Controller)
as the main operator

3. Main Areas of Concern
Security and authentication in the design, deployment and operation of existing SCADA networks
The premise that SCADA systems are secure because they use specialized protocols and have proprietary interfaces
The premise that SCADA networks are secure because they have been physically secured
The premise that SCADA networks are secure because they are not exposed to the Internet

4. SCADA Vulnerabilities
DoS (Denial of Service). Vulnerabilities found in FactoryTalk Services Platform and RSLinx Enterprise
November 2011: The cyber-security of the North American power grid is "in a state of near chaos," according to a report by a respected U.S. energy consultancy monitoring the industry's transition to wireless digital technologies.
Critical Remote Code Execution (CRCE). Vulnerabilities found in Modbus Serial Driver, product by Schneider Electric
September 2010: Iran admits that the Stuxnet worm had infected at least 30, computers in the country. The worm, which researchers have dubbed the most sophisticated malware ever, targets Windows PCs that manage large-scale SCADA systems at manufacturing and utility companies.)
Most SCADA protocols were never intended for use on publically accessible networks, and in some cases, not even on IP networks. MODBUS, a common SCADA protocol, was originally designed for use only within simple process control Networks to enable low speed serial communications between clients and servers

5. Point of Attack

6. CRCE Attack

7. CRCE Prevention

8. Securing SCADA Networks
Patch host operating systems, applications and SCADA components
Control application communications between SCADA networks and other networks
Control application communications within SCADA networks
Control what and who are allowed to interact with SCADA networks and systems
Monitor all networks closely and react quickly to viruses and attacks

9. What is DNS?
The DNS (Domain Name System)translates Internet domain and host names to IP addresses. DNS automatically converts the names we type in our Web browser address bar to the IP addresses of Web servers hosting those sites. (wiki)

10. DNS Phishing (Fake HTTP request)
Redirecting all incoming traffic to a fake server
Enables to launch additional attacks, or collect traffic logs that contain sensitive information
Capturing all in-bound
Allows the attacker to send on their behalf, using the
victim organization's domain and cashing-in on their positive
reputation

11. DNS Phishing (Fake HTTP request)
Taking over the registration of a domain
Attackers take over the registration of a domain and change the authoritative DNS servers
This was the type of attack used by the Syrian Electronic Army. They gained access to the domain registration accounts operated by Melbourne IT, changed the authoritative DNS servers to ns1.syrianelectronicarmy.com and ns2.syrianarmyelectronicarmy.com.
Cache poisoning
Attackers inject malicious DNS data into the recursive DNS servers operated by Internet Service Providers (ISPs). The damage cause by this attack is localized to specific users connecting to the compromised servers

12. DNS Phishing scenario

13. Demonstrating an attack using
Demonstrating an attack using BackTrack Using ARP spoofing Technique (Address Resolution Protocol)

14. Avoidance
Good security practices such as strong passwords, IP acceptable client lists (ACLs) and social engineering training will help guard against attack
DNSSTOP( Domain Name Server STOP)
A curses-based application that displays various tables of DNS statistics
DSC (Domain Statistics Collector)
DNS Statistics Collector is designed to collect and aggregate statistics from busy authoritative servers, such as those used by TLD (Top-Level Domain) and root server operators.
Traffic Gist
A network traffic statistics collection tool. Gist can collect statistics about live traffic and do postmortem packet capture analysis

15. Limiting Recursion to Authorized Clients
For DNS servers that are deployed within an organization or Internet Service Provider, the resolver
should be configured to perform recursive queries on behalf of authorized clients only.
These requests typically should only come from clients within the organization’s network address range.
We highly recommend that all server administrators restrict recursion to only clients on the organization’s
network.
BIND9
In the global options, include the following [10]: acl corpnets { /24; /24; }; options {   allow-query { any; };   allow-recursion { corpnets; }; };

16. References http://www.fastandeasyhacking.com/ (Armitage)
(Ettercap)
Siemens PLS Simulator (S7 Seriese)

17. Questions?