SCADA AND MOBILE: SECURITY ASSESSMENT OF THE APPLICATIONS THAT TURNS YOUR SMARTPHONE INTO A FACTORY CONTROL ROOM
No ratings
Presented at BlackHatMobileSecurity 2015 by
The days when mobile technologies were just a rising trend have passed, and now mobile devices are an integral part of our life. As a result, you may find them in places where they probably shouldn't be. But convenience often wins over security. Nowadays, you can monitor (or even control!) your ICS (Industrial Control System) from a brand-new Android or iOS smartphone. Just type the words 'HMI', 'SCADA', or 'PLC' into Google Play Store or ITunes App Store, and a surprisingly large bunch of results will appear. Moreover, many of these applications are developed by serious vendors, like Siemens, GE, Omron, etc., and allow accessing, monitoring, or controlling the HMI, PLC, DCS, or SCADA systems in your ICS infrastructure. Are they secure? Could an attacker do something bad if they get access to an industrial engineer's tablet? What kind of vulnerabilities can exist in these applications? What attack vectors are possible? To answer all these questions, we took a sample of "mobile apps for your SCADA, PLC, HMI" and assessed them. In this talk, found vulnerabilities, attack methods, and other potential risks will be shown. We will discuss whether it is SAFE to allow mobile applications to interact with your ICS infrastructure. Two attack scenarios will be shown: attacking ICS infrastructure via a compromised smartphone and penetrating mobile devices out of a compromised ICS environment (bottom-to-top attacks). Also, the detailed statistics of found flaws and security mechanisms usage will be shown.