View
4
Download
0
Category
Preview:
Citation preview
© 2021 Martin Scheu | 1
Martin Scheumartin@sichere-industrie.ch06.February 2021
Industrial network monitoringwith ntopng
© 2021 Martin Scheu | 2
Agenda
• Industrial networks in a nutshell• Why monitor ICS networks?• Network and protocols• Why use ntopng?• Baselining• IEC 60870-5-104• User plugin
© 2021 Martin Scheu | 3
ICS Industrial Control System
SCADA Supervisory Control And Data Acquisition
OT Operational Technology
© 2021 Martin Scheu | 4
Relay Control PLC PLC + HMI
+ Servers
ICS Evolution
PLC + HMI + Servers + Extended Connectivity
PLC =Programmable Logic Controller
HMI =Human Machine Interface
’’Industrie 4.0’’
Office / ERP Internet / Cloud
© 2021 Martin Scheu | 5
Concept and Objectives
ActorIndustrialEnvironment Sensor
Industrial Control Security Objectives - AIC
Safetymandatory
veryimportant
Availability
IntegrityConfidentiality
Controlnot
importanthighly deterministic, predicable
© 2021 Martin Scheu | 6
Why monitor ICS networks?
Things which do not belong there
Performance
Health
Configuration Errors
© 2021 Martin Scheu | 7
ICS Network and protocols
© 2021 Martin Scheu | 8
Network
Controller - 1
Field I/O - 0
Local HMI - 2
Process control - 3
Enterprise - 4
Standards• Perdue model• IEC 62443
zones and conduits
TSN : Time sensitive network
Keep in mind:• Device CPU load• Latency / Jitter• East - West traffic
© 2021 Martin Scheu | 9
Fieldbus
IO
Data Link - 2
Network - 3
Transport - 4
Session - 5
Presentation - 6
Application - 7
Physical - 1
IEC 60870-5-104
PROFINET
DCP/RPC
UDP
IP
TCP
IP
TSN
DCOMRPC
Eth Eth Eth
CBA
TCP
IP
UA
Eth
OPCUA
C/CC/CC/C
TCP
IP
Eth
C/C
TSN
TSN: Time sensitive network
Ethernet based2 - wire
• PROFIBUS• IEC 60870• Modbus• CAN• IO-Link• HART
Safety
• ProfiSAFE• IO-Link Safety
Implemented as“black channel”
© 2021 Martin Scheu | 10
IEC 60870-5-104Protocol characteristics:
• Clear text, traditional controller / device protocol, published 1988
• Data exchange: long, single flows, running over days
• Connection check or keep alive communication: short, multiple flows
© 2021 Martin Scheu | 11
IEC 60870-5-104
Ethernet II
IEC104 payload
IP v4TCP
START with 0x68
ASDU
APDU lengthControl field 1Control field 2Control field 3Control field 4
0
1
2
3
4
5
01234
byte
67 5bit
APC
IAS
DU
APDU
..
n-1
n
Type IdentificationSQ
T
Originator Address (ORG)
ASDU address fields
Information object address fields (IOA)
6
7
8
9
10
11
0123467 5bit
ASDU12
13
14
15
..
n-1
byte
n
Number of Objects
Cause of transmission (CoT)
Object information
P/N
© 2021 Martin Scheu | 12
IEC 60870-5-104
..APDU #1APDU #2
APDU #n
Ethernet IIIP v4TCPMultiple
APDUs
Type Identification
SQ
T
Originator Address (ORG)
ASDU address fields
Information object address fields (IOA) #1
Data
Uni
t Id
entifi
erNumber of Objects
Cause of transmission (CoT)
Object information #1
P/N
Data
O
bjec
t #1
Information object address fields (IOA) #2
Object information #2
Data
O
bjec
t #2
Information object address fields (IOA) #n
Object information #n
Data
O
bjec
t #n
..
Multiple IOA’s inone APDU
© 2021 Martin Scheu | 13
why use ntopng?
© 2021 Martin Scheu | 14
IEC 104 Script language
Ease of use
Resource requirements
Setup and installation
no zeek script - huge very complicated
yes Lua + minimal easy
no Lua - minimal complicated
yes snort rules - minimal complicated
no n/a + huge complicated
PoC available zeek script - minimal complicated
Open-source network monitoring
© 2021 Martin Scheu | 15
Detection mechanism
Signature based
Risk based
Risk factor A Risk factor B
alert tcp any any -> any any (msg:"APT.Backdoor.MSIL.SUNBURST"; content:"T "; offset:2; depth:3; content:"Host:"; content:"freescanonline.com"; within:100; sid:77600852; rev:1;)
”detect IEC 104 traffic entering/exiting the network to $EXTERNAL_NET”
© 2021 Martin Scheu | 16
Baselining or how does normal look like?
© 2021 Martin Scheu | 17
IEC 60870-5-104
© 2021 Martin Scheu | 18
User pluginfunction script.hooks.protocolDetected(now)
local appProtoID = flow.getnDPIAppProtoId()
--RDP ID 88
if appProtoID == 88 then
local line5tuple = shortFlowLabel(flow.getInfo())
local line = line5tupletime .. " -RDP flow started"
print(line)log:write(line)flow.setCustomInfo("Flow logged")
local cli_score, srv_score, flow_score = 0, 0, 0local alert =alert_consts.alert_types.alert_rdp_flow_start.new
"Flow A Info","Flow B Info"
)
alert:set_severity(alert_severities.warning)alert:trigger_status(cli_score, srv_score, flow_score)
© 2021 Martin Scheu | 19
General use casesq Unusual or exceptional activities in a networkq Connection of a new device, disconnection of a deviceq Rogue DHCP, DNS, SMTP or NTP serverq Data packets from an unknown deviceq Data transmission between devices that have not previously communicatedq Data transmission via a protocol / port that has not been used beforeq Data transmission via an unusual protocol or
one not intended for the purpose at handq Events that occur at unusual timesq Use of unexpected addresses (public IP addresses, etc.)q Generally noteworthy events such as address or port scansq Changes in network quality, including high broadband usage,
increased round-trip times and smaller TCP window sizes
Source [3]: allianz-fuer-cybersicherheit.de
© 2021 Martin Scheu | 20
Use cases ICS protocol specificq Unusual error messagesq Unsupported function callsq Function calls that have not been used beforeq Flawed data packetsq Unknown function codesq Abnormal protocol behaviourq Unexpected transition from one protocol to another
q Values outside of defined rangesq Changes in frequency / periodicityq Changes in cycle timesq Changing variance within certain periods of time
requires DPI and ICS protocol understanding
ICS or network monitoring?
Source [1]: allianz-fuer-cybersicherheit.de
© 2021 Martin Scheu | 21
Give it a try!
© 2021 Martin Scheu | 22
Tooling
ntopng
https://studio.zerobrane.com/
https://www.wireshark.org/
https://packages.ntop.org/
© 2021 Martin Scheu | 23
SourcesPicture / Information
Link
[1] https://www.allianz-fuer-cybersicherheit.de/ACS/DE/_/downloads/BSI-CS/BSI-CS_134.html?nn=6656412
IEC 60870-5-104 https://www.ensotest.com/iec-60870-5-104/introduction-to-the-iec-60870-5-104-standard/
IEC 60870-5-104 https://www.uni-muenster.de/imperia/md/content/informatik/agremke/comparison_of_scada_protocols_and_implementation_of_iec_104_and_mqtt_in_mosaik.pdf
IEC 60870-5-104 https://infosys.beckhoff.com/english.php?content=../content/1033/tcplclibiec870_5_104/html/tcplclibiec870_5_104_telegrammstructure.htm&id=
Recommended