There was carried out a comprehensive analysis and determined digital transformation tasks of the existing infrastructure for the fuel and energy market participants. Considering digital transformations of the existing infrastructure there were proposed ecosystem components for major participants of the fuel and energy market. A new concept of the attack vector on the infrastructure (in particular, the critical information infrastructure) was formulated on the basis of the information and energy approach and there was shown its relevance in the information security field of Automated Process Control System (APCS) and SCADA. Practical examples demonstrated how to get an attack vector on the infrastructure using the classical testing theory on the example of Web-Applications and Modbus serial communication protocol. The OWASP Web-Application Security Testing Guide was used as a guideline. It was proposed to deliberately limit the space of the attack vector on the infrastructure by the Descartes basis of information leaks and digital footprints. Separate Google Dorks have been developed for each manufacturer of embedded systems for APCS and SCADA. Penetration testing was performed as an example of APCS and SCADA on port 502 of the modbus protocol using Nmap.
The structure of information processing systems changes fundamentally which is now based on distributed information-computing networks, connected to global data networks, convergent, hyperconverged, neuromorphic and quantum computing systems. At the same time, regulatory requirements are toughen, especially, in terms of complex object security: physical, economic, fire, informational, psychological, intellectual property security, technogenic, security against terrorism, ecological safety and power security.
For the fuel and energy complex (FEC) – this is first and foremost Energy security doctrine of the
Russian Federation (Decree of the President of the Russian Federation 13.05.2019 № 216), new
version of the information security Doctrine (Decree of the President of the Russian Federation
05.12.2016 № 646), Federal law July 26, 2017 № 187-FL "On the Security of the Russian Federation
Critical Data Infrastructure, Federal law July 21, 2011 № 256-FL "On the safety of fuel and energy
complex facilities", Federal law July 27, 2006 № 149-FL "About information, information technology
and data security ". In these documents, the priority is given to the fuel and energy complex facilities
safety, including through continuous monitoring of object operation threats [
Considering the National Strategy for the development of artificial intelligence for the period up to 2030 (Decree of the President of the Russian Federation No. 490 of 10.10.2019), security issues of critical facilities of the fuel and energy complex should be solved using data mining, where the digitalization of business processes of the fuel and energy complex plays a central role.
In this regard, all fuel and energy market participants have to solve digital transformation problems of the existing infrastructure.
Experience shows that such an approach leads to the creation of its own artificial ecosystems that can solve a whole range of problems, including the safety of fuel and energy complex facilities. The example of such a system is the Sberbank ecosystem, where the services integration is achieved by the effective use of digital technologies, taking into account financial and economic goals of digital transformation. Major fuel and energy market players will have to similarly solve their digital transformation tasks of the existing infrastructure.
As ecosystem components for major players of the fuel and energy market, considering digital transformations of the existing infrastructure, we can distinguish the following transformation tasks: • digital means of labor, for example, digital birthplaces, digital seismic reflection, unmanned aerial vehicles, etc.; • digital tools, such as digital oil refineries; • smart employees who use the ecosystem to perform their job responsibilities effectively.
Due to the dynamic development of the facility and its environment, the components composition is not limited to the above.
Modern or large automated process control systems (APCS) are not possible without
supervisory dispatch control and data acquisition (SCADA) systems. APCS examples can be such
critical information infrastructures (CII) as: transport management systems and networks, power
supply management systems and networks, heat supply management systems and networks, fuel and
energy complex (FEC) management systems and networks, nuclear power plant management systems
and networks, etc. On the one hand, all these modern systems and networks are based on automatic
control principles [
There are several communication protocols that are used in APCS and SCADA. Unlike Ethernet or Internet Protocols (IP), automated control system uses several protocols that are often unique to the PLC-controller manufacturer. The most popular are Modbus, dnp, dnp3, fieldbus, Ethernet/IP, EtherCAT and profinet.
Primarily, such a wide specification determines the need to form a unique vector to directly
display the object and the environment state [
At the same time, we cannot assume that this information is identical to the equation given in the
work [
[k + 1] = Ф , , , [ ] + Г[ ] [ ] + [ ] [ ] [ + 1], where [k + 1], [ ] – the most accurate possible vectors evaluations of the object state and environment; Ф , , , – state transition function determined by the most accurately known parameters of the object state and environment; [ ] – vector evaluation of direct environmental impacts; Г[ ] [ ], [ ] [ ] – integral transformations of the most accurately represented controlling and disturbing influences.
(1)
Secondly, given specification of unique PLC-controllers for the manufacturer requires adequate
"unique" methods of information security (corresponding to the APCS and SCADA) from
destabilizing factors [
Finally, it is necessary to implement proposed information security methods in the projects on
information and integrated security of CII. Methodological basis of this approach was set out in [
Modbus – is a serial communication protocol originally published by Modicon (now Schneider Electric) in 1979 to be used with its PLC-controllers. In fact, Modbus became a standard communication protocol in APCS/SCADA.
As a methodological guide we use the OWASP Web-application security testing guide [
To form the information leaks basis we use the Shodan search engine which allows to identify
banners and information or parameters that they disclose [
Although there is no guarantee that all these IP-addresses work with Modbus, but most of them do, because 502 is a popular port, but not the only for Modbus. The protocol can be also identified by "Modbus Bridge", "ModbusGW", "HMS AnyBus-S WebServer", "title:'Carel pCOWeb Home Page'". However, SCADA systems are mostly used in the global Internet. They can be determined not only by the port, but also by the manufacturer. The "SCADA" query gives 2.925 results, but you can find 27 Schneider Electric servers with the "ClearSCADA" query.
Also, queries that can find APCS or SCADA have the following format: "port:2404 asdu address", "I20100 port:10001", «"port:789 product:""Red Lion Controls"""», "ISC SCADA Service HTTPserv:00001", «port:4800 'Moxa Nport'», "Reliance 4 Control Server", "Welcome to the Windows CE Telnet Service on HMI_Panel", "Schneider Electric EGX300", etc.
To form the basis of digital footprints we use Google dorks. It is well known that Google stores
and indexes the information which finds on websites. However, Google has its own language to
extract the information [
As an example we use Google Dork for PLC-controllers Siemens S7. It is almost the same
generation of controllers that was the target of the Stuxnet attack on Iran's uranium enrichment plants
in 2010, and probably, is the most complex attack on APCS in history [
There is no single Google Docs that would disclose every SCADA interface, instead, you need to learn about the manufacturer and used products. Each company creates its own embedded systems for automated process control systems. They use common protocols and procedures, but in general they are unique. In addition, each of these companies produces several products. To find these products used in APCS together with Google, we have developed separate Google Docs for each manufacturer and product. In Table 1, there is a short list according to manufacturers, products and developed Google Dorks.
We will conduct penetration testing for APCS and SCADA using Nmap. Nmap – is one of the
main hacker tools, security researcher and penetration tester. Although Nmap has lots of features,
including Nmap (NSE) scripts, it was started as a simple port scanner and remains the best port
scanner ever. Nmap is a representative of the active method to obtain the information [
As an aim, we chose shodan results by the search of "port:502 modbus", obtained earlier in Figure 1. Further, there is a fragment of the Nmap output in Figure 3.
As we can see, Nmap can identify nodes as HMS Anybus-CC Modbus-TCP (2-Port) 1.04.01 and detected each of the nodes. It provides the intruder with valuable information, not only identifying the PLC-controller and version, but also the communication protocol and structure. Since attacks require deep knowledge of the automated control system technology, this information is sufficient to create an attack vector on the infrastructure.
There was formulated a new concept of the attack vector on the infrastructure (in particular, critical information infrastructure) on the basis of the information and energy approach and demonstrated its relevance in the field of information security of APCS and SCADA. It was proposed to deliberately limit the space of the attack vector on the infrastructure by the Descartes basis of information leaks and digital footprints. We developed separate Google Dorks for each manufacturer of embedded systems for APCS and SCADA. Penetration testing was performed as an example of APCS and SCADA on port 502 of the modbus protocol using Nmap. We obtained practical results that are valuable for any specialist in the information security field, as they allow to create an information security subsystem and its components for an intelligent integrated security management system, such as the fuel and energy complex.