Organizer
Partner Company
SCADA Strangelove or: How I Learned to Start Worrying and Love Nuclear Plants
Sergey Gordeychik
Positive Technologies
Abstract
Modern civilization unconditionally depends on information systems. It is paradoxical but true that ICS/SCADA systems are the most insecure systems in the world. From network to application, SCADA is full of configuration issues and vulnerabilities. During our presentattion, we will demonstrate how to obtain full access to a plant via:
- a sniffer and a packet generator
- FTP and Telnet
- Metasploit and oslq
- a webserver and a browser
About 20 new vulnerabilities in common SCADA systems including Simatic WinCC will be revealed in the report.
Releases:
- modbuspatrol (mbpatrol) - free tool to discover and fingerprint PLC
- Simatic WinCC security checklist
- Simatic WinCC forensic checklist and tools
- close to real life attack scenario of a Simatic WinCC based plant
Speaker Info
Sergey Gordeychik, CTO, Positive Technologies. Sergey has developed a number of training courses, including "Wireless Networks Security" and "Analysis and Security Assessment of Web Applications," published several dozens of articles in various titles and a book called "Wireless Networks Security." He is the Science Editor of the SecurityLab.ru portal, a member of the Web Application Security Consortium (WASC) Board of Directors and the RISSPA Council of Experts. Sergey Gordeychik is the Director and Scriptwriter of the Positive Hack Days forum.