Sicherheitsaspekte der Entwicklung eines Smart Meter Gateway. Armin Lunkeit 16. Mai 2013

Transkript

1 Sicherheitsaspekte der Entwicklung eines Smart Meter Gateway Armin Lunkeit 16. Mai 2013

2 Details Sicherheitsziele des Smart Meter Gateway Threat Modeling am Beispiel des SMGW Dynamic Analysis: Fuzzing Aktuelle Forschungsarbeiten OpenLimit SignCubes GmbH Page 2

3 Smart Meter Gateway Funktionalität Quelle: Protection Profile for the Gateway of a Smart Metering System (Smart Meter Gateway PP) Version 1.2, 18th March 2013 OpenLimit SignCubes GmbH Page 3

4 Smart Meter Gateway und Kommunikationsbeziehungen Quelle: Protection Profile for the Gateway of a Smart Metering System (Smart Meter Gateway PP) Version 1.2, 18th March 2013 OpenLimit SignCubes GmbH Page 4

5 Entwicklungsprozess für sichere Produkte Security by Design Architecture Analysis Threat Modeling Static Source Code Analysis Explorative Testing: Manual Auditing Penetration Testing Dynamic Analysis: Fuzzing BSI TR, PP Secure Design Secure Implementation Requirements Product Security Design Implementation Verification Release Product SMGW OpenLimit SignCubes GmbH Page 5

6 Threat-Modeling: Identifikation Bedrohungen und Schwachstellen Threat Identifikation STRIDE-Klassifizierung Tool-gestützte Threat-Analyse Sichtung der ermittelten Threats Verwendung von Threat-Tree s zur Betrachtung und Analyse vorgefundener potentieller Schwachstellen DREAD-Rating Aufstellung Attack Trees no End yes Prüfung Threat Mitigation Mitigated Threat? no Schwachstelle? no End yes End OpenLimit SignCubes GmbH Page 6

7 Threat Modeling: Analyse des Systems Identifikation vorhandener Schnittstellen (Beispiele): HAN LMN WAN Lokale Schnittstellen?? Identifikation der zu schützenden Ressourcen (Assets) (Beispiele): Authentisierungsdaten Meßdaten Zeitstempel / Zeitsynchronisation Identifikation Trust Level (Berechtigungen) Administrator und Anschlussnutzer haben unterschiedliche Berechtigungen OpenLimit SignCubes GmbH Page 7

8 Threat Model: Datenflussdiagramme (DFD s) Mai 21, 2013 External-powered Meter Batterypowered Meter Internal Meter Electricity Gas Water Heat Metered Value LMN Metered Value Metered Value SMGW Admin Time Synchronization Firmware Download Measured Values - Tariffs Network Status Wake-up Call Trusted Time Service... Smart Meter Gateway WAN Customer Information Security Module Authorized External Entity Prosumer Visual Display HAN Service Technician CLS Data Controllable Local System (CLS) Verteilnetzbetreiber (VNB) Messstellenbetreiber (MSB) Messdienstleister (MDL) Lieferant (LF) OpenLimit SignCubes GmbH Page 8

9 Threat Identifikation und Klassifikation Threat Kategorisierung mittels STRIDE Kategorie Spoofing Tampering Repudia7on Informa7on Disclosure Denial of Service Eleva7on of Priviledges Ziel des Angreifers Authen4fica4on Spoofing of user iden7ty Integrity Data Manipula7on Verifyability Successfully challenge the validity of the statement or contract Confiden4ality Unauthorized access to data Availability A>empt to make a resource unavailable Authorisa4on User expands limited access rights OpenLimit SignCubes GmbH Page 9

10 Threat Identifikation und Klassifikation Bewertung des Threats mittels DREAD Damage poten7al Reproducibility Exploitability Affected Users Discoverability Damage exploi7ng this vulnerability Investment to reproduce the A>ack Investment / Complexity to exploit How many Users may be a>acked? Complexity to iden7fy this Vulnerability OpenLimit SignCubes GmbH Page 10

11 Threat Identifikation: Attack Path Attack Path Threat #24 Read/Write CLS-Data for external market actors 24.1 Spy out a message 24.2 Spy out the communication channel 24.3 Side channel attack Confidentiality not tested Insufficient testing on confidentiality Man-in-themiddle Confidentiality not tested OpenLimit SignCubes GmbH Page 11

12 Threat Identifikation: Attack Path Mitigated Attack Path Threat #24 Read/Write CLS-Data for external market actors 24.1 Spy out a message 24.2 Spy out the communication channel 24.3 Side channel attack Confidentiality not tested Insufficient testing on confidentiality Man-in-themiddle Confidentiality not tested OpenLimit SignCubes GmbH Page 12

13 Fuzzing Test System Target System Identification Input Interfaces Code Coverage Proprietary Developed Fuzzer Proprietary Developed Attack Strings Fuzzer Target Target Processor ARM, AMD, IBM, Intel, Nvidia, PLC, Power PC, Qualcomm, Sun, Snapdragon, Target OS Android, CardOS, JCOB, Nucleus, OS X, QNX, Unix, VxWorks, Windows, S7, Monitor-Client Monitor/Debugger Expert Activities Expert Advice: Identification, Rating Proof of Concept Exploits Report Patch, Fix OpenLimit SignCubes GmbH Page 13

14 Erzielte Ergebnisse aus ca. 40 Projekten Verfahren Anzahl Zero- Day- Vulnerabili4es Anzahl verwendeter Tools Threat Modeling 112 (986 Threats) 1-2 Sta7c Source Code Analysis Penetra7on Tes7ng (76 bekannte Sicherheitslücken) 4 + Dynamic Analysis: Fuzzing 27 > 60 OpenLimit SignCubes GmbH Page 14

15 Aktuelle Forschung (Auszug) Forschungsprojekte zu Modellierungs- und Testverfahren mit Schwerpunkt IT-Sicherheit ( DIAMONDS will leverage systematic, model-based testing and monitoring approaches for security testing to enable highly secure systems by early testing and test automation. Advanced model-based security testing methods will allow the early identification of design vulnerabilities and efficient system/test design targeting security aspects. ( CORAS ( CORAS is a method for conducting security risk analysis. CORAS provides a customised language for threat and risk modelling, and comes with detailed guidelines explaining how the language should be used to capture and model relevant information during the various stages of the security analysis. In this respect CORAS is model-based. The Unified Modelling Language (UML) is typically used to model the target of the analysis. For documenting intermediate results, and for presenting the overall conclusions we use special CORAS diagrams which are inspired by UML. The CORAS method provides a computerised tool designed to support documenting, maintaining and reporting analysis results through risk modelling. OpenLimit SignCubes GmbH Page 15