Us 21 A Broken Chain Discovering OPC UA Attack Surface and Exploiting The Supply Chain

A Broken Chain:
Discovering OPC-UA
Attack Surface and Exploiting the Supply-chain
By Eran Jacob
#BHUSA @BlackHatEvents
Who am I?
Eran Jacob
Security Research Team Leader
@EranJacob
linkedin.com/in/eranj
Roman Dvorkin Alon Zini

linkedin.com/in/roman-dvorkin linkedin.com/in/alon-zini-3b9698185
Agenda
Supply-chain
Intro Exploitation
The Attack Fuzzing

Surface
Automation Protocols
Manufacturing Critical Infrastructure Buildings, Traffic..
Automation Protocols
OPC Classic
Open Platform Communications
- Data Access
- Alarms and Events
- Historical Data Access
Distributed Component
Object Model Firewall unfriendly Security
OPC Unified Architecture
Cloud
Cloud/IT
ERP
3.
MES
2. SCADA
Relay Broker
1. HMI Controller Controller
OT 4.
Field Devices Field Devices
OPC Unified Architecture
Cloud
Cloud/IT
ERP
3.
MES
2. SCADA
Relay Broker
1. HMI Controller Controller
OT 4.
Field Devices Field Devices
Motivation for Research
• The “next-thing” in industrial
communication
• Highly adopted
• Significant potential impact
Discovering the Attack Surface
02 or at least some of it..
Mapping the surface
Specifications Communication
Stack
.NET Standard
.NET legacy
ANSI C legacy
JAVA legacy
Mapping the surface
Specifications Communication
Stack
.NET standard
.NET legacy
ANSI C legacy
JAVA legacy
Mapping the surface
Specifications Communication Commercial
Stack SDKs
.NET standard
.NET legacy
ANSI C legacy
JAVA legacy
** This mapping is based on our best effort & knowledge; some #BHUSA @BlackHatEvents
vendors or relations may be missing or inaccurate **
Mapping the surface
C / C++
.NET
Mapping the surface
C / C++
Mapping the surface
C / C++
Mapping the surface
C / C++
TB5STACK.dll uastack.dll uastack.dll

Mapping the surface
.NET
Mapping the surface
Specifications Communication Commercial
Stack SDKs
.NET standard “The vast majority of

.NET legacy OPC UA products are
ANSI C legacy based on these
JAVA legacy commercial OPC UA
SDK/Toolkits”
OPC Foundation
** This mapping is based on our best effort & knowledge; some vendors or relations may be missing or inaccurate **
Mapping the surface
Specifications Communication Commercial Products
Stack SDKs
.NET standard
.NET legacy
ANSI C legacy
JAVA legacy
Chain of Dependency
Stack SDKs
.NET standard
.NET legacy
ANSI C legacy
JAVA legacy
Pervious Work
Active 2017 2018, 2020 2021 …

OPC Foundation German Office for Kaspersky Claroty Academic papers
Security Working Information
Group Security (BSI) 2021
o Practical Pitfalls for Security in
OPC UA
2020
o Assessing the Security of OPC
UA Deployments
o …
03 Exploiting the supply chain
Chain of Dependency
Stack SDKs
.NET standard
.NET legacy
ANSI C legacy
JAVA legacy
OPC UA Connection
Client Server
HEL Hello
Acknowledge ACK
Transport
OpenSecureChannelRequest
OPN Secure Channel: Confidentiality, Integrity, App
OpenSecureChannelResponse Authentication
OPN
MSG CreateSessionRequest
CreateSessionResponse MSG
Session: User Authentication & Authorization
MSG ActivateSessionRequest
ActivateSessionResponse
MSG
MSG …
MSG
…
MSG Messages: Read, Write, Call…
MSG
CLO CloseSecureChannelRequest
Reading the Reference
Complex Datatypes
Variants, Extension Objects, Structures
Flexible Encoding
Binary, XML, JSON
Pre-security messages
(OpenSecureChannel, GetEndpoints , FindServers…)
https://tyk.io/great-api-documentation-requires-code-examples/
Chain of Dependency
Stack SDKs
.NET standard
.NET legacy
ANSI C legacy
JAVA legacy
Object
Breaking the .NET Stack
• NET doesn’t like deep function calls… Inner Object
• The reference alerts of such risk when describing nested data types.
XML/Binary
• A related issue was already found in the past (CVE-2018-12086):
Nested Data Types
Variant Extension Object
(UNION) (Structure Container)
OPC UA Structure
Array/Matrix Built in data type
XML/Binary
Diagnostic Info Data Value
Inner diagnostic info Variant
Variant
(UNION)
Unlimited Nesting Built in

XML OPC UA Decoder Array/Matrix
data type
Extension Object
(Structure Container)
Nested Structures
- Extension Objects! OPC UA Structure
- VERY useful for pivoting our way to vulnerable parts of the stacks
- Used in messages before channel or session security (in both directions) XML/Binary
Client Server
HEL Hello
Acknowledge ACK
Transport
OPN
Session: User Authentication & Authorization
MSG
MSG …
MSG
…
MSG Messages: Read, Write, Call…
MSG
CLO CloseSecureChannelRequest #BHUSA @BlackHatEvents
Extension Object
Nested Structures
OPC UA Structure
OPN XML/Binary
Extension Object
Nested
-
Structures
Chunks. OPC UA Structure
XML/Binary
Client Server
HEL Hello
Acknowledge ACK Transport connection
OPN
Session: User Authentication & Authentication
MSG
MSG …
MSG
… Messages: Read, Write, Call…
MSG
MSG
Extension Object
Nested
-
Structures
Chunks. OPC UA Structure
XML/Binary
Client Server
HEL Hello
Acknowledge ACK Transport connection
OPN Secure Channel: security mode = NONE
OpenSecureChannelResponse
OPN
MSG FindServersRequest
FindServersResponse FindServers
MSG
.NET Stack Vulnerability
6 years old 0 day
CVE-2021-27432
Client -> Server
Main Site
Remote Site 1 Remote Site 2
PC
Loss of visibility & control Loss of visibility & control
OPC UA SERVER SCADA OPC UA SERVER
(OPC UA client)
PLC HMI PLC

Server -> Client
Main Site
Remote Site 1 Remote Site 2
PC
Loss of visibility & control Loss of visibility & control
OPC UA SERVER SCADA OPC UA SERVER
(OPC UA client)
PLC HMI PLC

Unified Automation .NET SDK
Stack SDKs
.NET standard
.NET legacy
ANSI C legacy
JAVA legacy
Unified Automation .NET SDK
Stack SDKs
.NET standard
.NET legacy
ANSI C legacy
JAVA legacy
XXE. Again. CVE-2021-27434
• Code refactoring reintroduced the vulnerability

• Exploitable over Extension Object decoding
*XXE = XML External Entity #BHUSA @BlackHatEvents

SDK XXE Vulnerability Impact
Client -> Server
IT Network
OT Network
OPC UA SERVER
PLC HMI PLC

Softing C++ OPC UA SDK
Stack SDKs
.NET standard
.NET legacy
ANSI C legacy
JAVA legacy
Softing C++ OPC UA SDK
SDK interface (API) TB5CPP
SDK-level processing TB5OT Softing’s SDK C++ objects
TB5UTIL
Stack-level processing TB5STACK Foundation’s ANSI C stack structures
From Binary to Objects
TB5STACK
Binary Message
SDK C++
Objects
TB5OT
C Structures
https://www.flaticon.com/free-icon/documents_160085
Extension Object
Foundation’s Extension Object

Looking at the Legacy ANCI C stack OPC UA Structure…
decoded Extension Objects are stored in a specific structure XML/Binary
ID of the contained structure

Encoding of the BODY
BODY UNION
Foundation’s ExtensionObject
Zooming into the ExtensionObject body union
Int32, Byte*
Int32, Byte*
Object* , EncodableType*
Foundation’s ExtensionObject
MUST be validated
ID of the contained structure
Encoding of the BODY MUST be validated
BODY UNION
Setting C++ Objects
TB5STACK
Binary Message
SDK C++
Extension Object Struct Objects
TB5OT
TypeID: X/Y/Z..
Encoding: EncodeableObject
Body: decoded object
C Structure
Skipping Internal Structure Decoding
1. XML..
2. Type-ID encoding
Setting C++ Objects
TB5STACK
Binary Message
SDK C++
TB5OT
TypeID: X/Y/Z..
Encoding: XML/Binary
Body: ByteString object
C Structure
Setting C++ Objects
TB5STACK
Binary Message
SDK C++
TB5OT
TypeID: X/Y/Z..
C Structure
A word about PubSub
Option: Publish/Subscribe in the Cloud
Subscriber : Client
Subscriber : Client
Subscriber : Client
Publisher/Sender : Server
Subscriber : Client
Subscriber : Client
Subscriber : Client
Relay Broker
Publisher/Sender : Server
Subscriber : Client
Subscriber : Client
Subscriber : Client
Option: Secure Multicast
Subscriber : Client Subscriber : Client
Subscriber : Client Subscriber : Client Publisher/Sender : Server

Variant
(UNION)
Exploiting the Object Setters Built in

Array/Matrix
data type
Network Message
DataSetMetaData (DiscoveryResponse)
FieldMetaDataArray
KeyValuePair
Variant
ExtensionObject
Subscriber : Client
Subscriber : Client Publisher/Sender : Server
Subscriber : Client
• Demo? Multicast pubsub, RT communication..
Setting C++ Objects CVE-2021-32994
TB5STACK
Binary
Message
Extension Object Struct SDK C++

Extension
TypeID: X/Y/Z..
Object Struct
TB5OT
TypeID: X/Y/Z..
7x TypeID: X/Y/Z.. XML/Binary

Encoding:
Encoding:
Body:XML/Binary
ByteString object
C Structure
https://www.123rf.com/photo_141980838_stock-vector-crumpled-cube-box-icon-black-illustration-of-damage-breakage-pain-damnification-contour-isolated-vec.html
Not a one-time mistake…
Products
Stack SDKs
.NET standard
.NET legacy
ANSI C legacy
JAVA legacy
Products
Integration
Configurations
with OPC UA SDK/stack
SDK Integration
Required Interfaces
ServerConfig, NodeManager, IOManager
Optional Interfaces
MethodManager, EventManager, HistoryManager
http://documentation.unified-automation.com/uasdkcpp/1.4.2/html/L1ServerSdkIntroduction.html
Fuzzing Products
IOManager:
* Read
* Write
…
* Monitor Items
Summary
Cloud
ERP
MES
SCADA
Relay Broker
HMI Controller Controller
Field Field
Devices Devices
Stay Safe!
Eran Jacob
@EranJacob
linkedin.com/in/eranj
Special thanks to
Matan Dobrushin Roman Dvorkin Alon Zini
@matan_dob linkedin.com/in/roman-dvorkin linkedin.com/in/alon-zini-3b9698185
and the rest of the team

Us 21 A Broken Chain Discovering OPC UA Attack Surface and Exploiting The Supply Chain

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Us 21 A Broken Chain Discovering OPC UA Attack Surface and Exploiting The Supply Chain

Uploaded by

Copyright:

Available Formats

A Broken Chain:

Roman Dvorkin Alon Zini

The Attack Fuzzing

Manufacturing Critical Infrastructure Buildings, Traffic..

1. HMI Controller Controller

1. HMI Controller Controller

TB5STACK.dll uastack.dll uastack.dll

.NET standard “The vast majority of

Active 2017 2018, 2020 2021 …

Diagnostic Info Data Value

Inner diagnostic info Variant

Unlimited Nesting Built in

Remote Site 1 Remote Site 2

PLC HMI PLC

Remote Site 1 Remote Site 2

PLC HMI PLC

• Code refactoring reintroduced the vulnerability

*XXE = XML External Entity #BHUSA @BlackHatEvents

PLC HMI PLC

SDK interface (API) TB5CPP

SDK-level processing TB5OT Softing’s SDK C++ objects

Foundation’s Extension Object

ID of the contained structure

Body: decoded object

Body: ByteString object

Body: ByteString object

Option: Secure Multicast

Subscriber : Client Subscriber : Client

Subscriber : Client Subscriber : Client Publisher/Sender : Server

Exploiting the Object Setters Built in

Subscriber : Client Publisher/Sender : Server

Extension Object Struct SDK C++

7x TypeID: X/Y/Z.. XML/Binary

HMI Controller Controller

and the rest of the team

You might also like