bugtraq - C4 SCADA Security Advisory - OSISoft PI Server Authentication Weakness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <D642040CD1E6408891F169A043C371A8@C43>
Date: Wed, 30 Sep 2009 17:24:38 +0200
From: "Eyal Udassin" <eyal.udassin@...security.com>
To: <bugtraq@...urityfocus.com>
Subject: C4 SCADA Security Advisory - OSISoft PI Server Authentication Weakness


Background
-----------------
Vendor product information, from www.osisoft.com :
The PI SystemT brings all operational data into a single system that can
deliver it to users at all levels of the company - from the plant floor to
the enterprise level. The PI System keeps business-critical data always
online and available in a specialized time-series database by:
.	Gathering event-driven data, in real-time, from multiple sources
across the plant and/or enterprise
.	Applying advanced analytical calculations and business rules to
Contextualize and Analyze this data
.	Configuring smart and thin client tools to distribute and visualize
knowledge/ information to display critical operational metrics and integrate
the user experience across different roles within the enterprise.

Description
----------------
Due to the sensitivity of SCADA-related vulnerabilities, we can only
publicly disclose that PI Server suffers from an encryption weakness in the
default authentication process. 
Details of this vulnerability will be disclosed only to legitimate parties
such as asset owners (utilities), after receiving the approval of the local
CERT or any other local official entity.

Impact
----------
An attacker can gain access to the PI Server databases, allowing him to:
1.	Gain access to confidential operational information
2.	Data tampering - permanent data loss or presentation of misleading
decision support data
3.	Attempt to find additional vulnerabilities in the server to carry
out the "corporate network to control center" attack vector mentioned in
C4's S4 2008 paper "Control System Attack Vectors and Examples: Field Site
and Corporate Network" (http://www.c4-security.com/index-5.html).

Affected Versions
-------------------------
PI Server - All versions

Workaround/Fix
-----------------------
According to the vendor, as of PI version 3.4.380.x the vulnerable
authentication mechanism is deprecated, therefore no fix is planned for
release for this vulnerability.

The vendor recommends the following procedures to mitigate the
vulnerability:
.	Enable the PI Server for Windows authentication and configure PI
Trust records
.	Use IPSec between the PI Server and the different client computers

Additional Information
-------------------------------
For additional information please contact us at info_at_c4-security.com.
Note that we will respond only to verified utility personnel and
governmental agencies. 
Details of this vulnerability will be disclosed only to legitimate parties
such as asset owners (utilities), after receiving the approval of the local
CERT or any other local official entity.

The CVE identifier assigned to this vulnerability by CERT is CVE-2009-209.

Credit
--------
This vulnerability was discovered and exploited by Eyal Udassin, Jonathan
Afek and Yaron Budowsky from C4 Security (http://www.c4-security.com).
C4 Security is a leader in SCADA security reviews, auditing and penetration
testing. 


Regards,

Eyal Udassin - C4
33 Jabutinsky St., The Twin Towers #1, Ramat Gan, Israel
eyal.udassin@...security.com / www.c4-security.com
+972-3-6134703