针对PLC访问控制的安全分析

doi:10.3969/j.issn.1006-2475.2019.09.008

摘要/Abstract

摘要： 可编程逻辑控制器（Programing Logic Controller， PLC）是一种很常见的工业控制系统（Industrial Control System， ICS）设备，用于接收和处理输入设备的数据以及对输出设备进行控制。作为工业控制系统中的核心设备，PLC一直是攻击者的首选目标，例如针对ICS的“震网”病毒，其主要攻击目标就是PLC。目前，大多数针对PLC的攻击都源于PLC的未授权访问。为了提高PLC设备的安全性，本文对PLC访问控制问题进行研究，对几种访问控制模型进行讨论，其中基于密码的访问控制模型是本文研究的重点，通过使用流量分析和暴力破解的方法，对PLC基于密码的访问控制机制进行安全性分析，展示如何将密码存储在PLC内存中、如何在网络中拦截密码、如何破解密码等。并通过这些漏洞，对ICS系统发起更高级的攻击，例如重放、PLC内存损坏等。最后，针对上述安全问题，本文给出安全防护建议以及总结。

关键词: PLC, SCADA, 工业控制系统, 访问控制, 密码

Abstract: PLC is a very common ICS device that receives and processes data from input devices and controls the output devices. As the core equipment in industrial control systems, PLC has always been the target of choice for attackers. For example, the Stuxnet for ICS, its main target is PLC. Currently, most attacks against PLCs originate from unauthorized access by PLCs. In order to improve the security of PLC equipment, this paper studies the PLC access control problem and discusses several access control models. The password-based access control model is the focus of this paper. Through the traffic analysis and violent cracking methods, this paper analyzes the security of password-based access control mechanism, shows how to store passwords in PLC memory, how to intercept passwords in the network, how to crack passwords, and so on. And through these vulnerabilities, this paper launches more advanced attacks on the ICS system, such as replay, PLC memory corruption, and so on. Finally, in view of the above security issues, this paper gives recommendations and summary of security protection.

Key words: PLC, SCADA, industrial control system, access control, password

中图分类号:

TP29

缪思薇1，余文豪1，姚峰2，高婧3. 针对PLC访问控制的安全分析[J]. 计算机与现代化, doi: 10.3969/j.issn.1006-2475.2019.09.008.

MIAO Si-wei1， YU Wen-hao1， YAO Feng2， GAO Jing3. Security Analysis for PLC Access Control[J]. Computer and Modernization, doi: 10.3969/j.issn.1006-2475.2019.09.008.

参考文献［24］

［1］	NARAYAN J, SHUKLA S K, CLANCY T C. A survey of automatic protocol reverse engineering tools［J］. ACM Computing Surveys, 2015,48(3):1-26.
［2］	KOTTLER S, KHAYAMY M, HASAN S R, et al. Formal verification of ladder logic programs using NuSMV［C］// IEEE SoutheastCon 2017. 2017:1-5.
［3］	FORMBY D, SRINIVASAN P, LEONARD A, et al. Whos in control of your control system? Device fingerprinting for cyber-physical systems［C］// Network and Distributed System Security Symposium. 2016.
［4］	YOON K L, YANG J W, CHONG S C, et al. Perceptual sensitivity and response bias in social anxiety: An application of signal detection theory［J］. Cognitive Therapy and Research, 2014,38(5):551-558.
［5］	KOSCHER K, CZESKIS A, ROESNER F, et al. Experimental security analysis of a modern automobile［C］// Proceedings of the 31st IEEE Symposium on Security and Privacy. 2010:447-462.
［6］	SADEGHI A R, WACHSMANN C, WAIDNER M. Security and privacy challenges in industrial internet of things［C］// 2015 52nd ACM/EDAC/IEEE Design Automation Conference. 2015:54.
［7］	CHEN X, ANDERSEN J, MORLEY Z, et al. Towards an understanding of anti-virtualization and anti-debugging behavior in modern malware［C］// IEEE/IFIP International Conference on Dependable Systems & Networks. 2015:177-186.
［8］	COOPRIDER N, ARCHER W, EIDE E, et al. Efficient memory safety for TinyOS［C］// Proceedings of the 5th ACM International Conference on Embedded Networked Sensor Systems. 2007:205-218.
［9］	LANGNER R. Stuxnet: Dissecting a cyberwarfare weapon［J］. IEEE Security & Privacy, 2011,9(3):49-51.
［10］	CHANG K, SHIN K G. Distributed authentication of program integrity verification in wireless sensor networks［J］. ACM Transactions on Information and System Security, 2008,11(3):1-35.
［11］	MAJDALAWIEH M, PARISI-PRESICCE F, WIJESEKERA D. DNPSec: Distributed network protocol version 3 (DNP3) security framework［M］// Advances in Computer, Information, and Systems Sciences, and Engineering. Springer,Dordrecht, 2007:227-234.
［12］	JOON H, CHOONG S H, SEONG H J, et al. A security mechanism for automation control in PLC-based networks［C］// IEEE International Symposium on Power Line Communications & Its Applications. 2007:466-470.
［13］	JOHNSON R E. Survey of SCADA security challenges and potential attack vectors［C］// IEEE International Conference on Internet Technology & Secured Transactions. 2010:1-5.
［14］	CHIEN E, OMURCHU L, FALLIERE N. W32.Duqu:The precursor to the next Stuxnet［C］// USENIX Conference on Large-scale Exploits & Emergent Threats. 2012.
［15］	CHRISTIE R. Power Systems Test Case Archive［D］. University of Washington, 2000.
［16］	COOPER D, SANTESSON S, FARRELL S, et al. Internet X. 509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, RFC 5280［S］. 2008.
［17］	DAVIS K R, DAVIS C M, ZONOUZ S A, et al. A cyber-physical modeling and assessment framework for power grid infrastructures［J］. IEEE Transactions on Smart Grid, 2015,6(5):1.
［18］	DEFRAWY K E, FRANCILLON A, PERITO D, et al. SMART: Secure and minimal architecture for (establishing a dynamic) root of trust［C］// 2012 19th Annual Network and Distributed System Security Symposium. 2012:1-15.
［19］	CHECKOWAY S, MCCOY D, ANDERSON D, et al. Comprehensive experimental analyses of automotive attack surfaces［C］// Proceedings of the 20th USENIX Security Symposium. 2011.
［20］	GARCIA L, BRASSER F, CINTUGLU M H, et al. Hey, My malware knows physics! Attacking PLCs with physical model aware rootkit［C］// NDSS. 2017.
［21］	ETIGOWNI S, TIAN D, HERNANDEZ G, et al. CPAC: Securing critical infrastructure with cyber-physical access control［C］// Annual ACM Conference on Computer Security Applications. 2016.
［22］	MIYACHI T. Protecting industrial control systems［J］. Journal of the Institute of Electrical Engineers of Japan, 2012,132(6):354-358.
［23］	CHEREPANOV A, LIPOVSKY R. Blackenergy:What We Really Know About the Notorious Cyber Attacks［R］. VirusBulletin, 2016.
［24］	FALLIERE N, MURCHU L O, CHIEN E. W32. stuxnet dossier［R］. White Paper, Symantec Corp., Security Response, 2011,5(6):29.

[1]	韩冬松, 沙乐天, 赵创业. 基于蠕虫和代理的工控系统攻击建模[J]. 计算机与现代化, 2023, 0(10): 107-114.
[2]	莫严, 唐容川, 鞠昊, 孙绍飞, 王安. 面向工业互联网平台的商用密码改造[J]. 计算机与现代化, 2023, 0(06): 118-126.
[3]	杨骏, 王劲林, 倪宏, 盛益强, . 工控网络异常检测中基于灵敏度的动态迁移算法[J]. 计算机与现代化, 2023, 0(05): 46-51.
[4]	蒋星宇, 徐锐, 张若愚, 张志勇, . 工业控制系统网络资产探测技术研究[J]. 计算机与现代化, 2023, 0(02): 89-95.
[5]	古丽博斯坦·阿克木, 努尔买买提·黑力力. 支持动态策略变化的ABAC决策回收[J]. 计算机与现代化, 2022, 0(10): 47-54.
[6]	刘铮, 吴柯桦, 叶春晓. 增强安全的云存储数据访问控制方案[J]. 计算机与现代化, 2021, 0(10): 119-126.
[7]	李文全, 徐素萍. 基于地理信息的旅游资源信息库系统[J]. 计算机与现代化, 2021, 0(08): 100-103.
[8]	刘雪贞, 崔艳, 邓小飞, 彭杰. 支持权限管理的高效属性撤销机制[J]. 计算机与现代化, 2021, 0(07): 95-101.
[9]	赵微, 秦砺寒, 运晨超. 基于Portal认证技术的科技成果数据跨平台访问控制[J]. 计算机与现代化, 2021, 0(07): 102-106.
[10]	孙广成, 李洪赭, 李赛飞, 张晓薇. 基于区块链的物联网访问控制系统[J]. 计算机与现代化, 2020, 0(11): 100-108.
[11]	吴克河，陈鸿祥，李为 . 基于SM9标识密码的北斗安全传输协议研究[J]. 计算机与现代化, 2020, 0(02): 41-.
[12]	杨阳，曹彦. 基于危机事件的自适应访问控制模型[J]. 计算机与现代化, 2019, 0(08): 98-.
[13]	张芃,周良. 基于信任的动态多级访问控制模型[J]. 计算机与现代化, 2019, 0(07): 116-.
[14]	李艳梅1,殷新春1,2,邵梦丽2. 基于多基表示的滑动窗口椭圆曲线多标量乘算法[J]. 计算机与现代化, 2019, 0(01): 11-.
[15]	魏珊珊，韩庆敏，郭肖旺，张湾，贡春燕. 基于国密算法的PKI在工控系统中的应用研究[J]. 计算机与现代化, 2018, 0(11): 1-.