Securing EtherNet/IP Using DPI
Firewall Technology

Technical Trackwww.odva.org

About Us
Erik Schweigert
Leads device firmware development atTofino Security
 BSc in Computer Science from VIU
Michael Thomas
Leads management/configuration softwaredevelopment at Tofino Security
 BSc in Computer Science from VIUTechnical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 2www.odva.org

Introduction
Industry has embraced technology like Ethernet andTCP/IP Increases efficiency, but also increases exposure tosecurity threats A simple, robust security solution is needed In this talk we will look at using Deep Packet
Inspection (DPI) technology for securing EtherNet/IPand CIP Protocols
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 3www.odva.org

Topics
The Common Industrial Protocol (CIP) Overview
II. Security Threats to EtherNet/IP Deployments
III. Possible Methods to Secure EtherNet/IP
IV. Analysis of EtherNet/IP for Deep Packet Inspection(DPI)
V. Implementing DPI for EtherNet/IP
VI. Field Usability of DPI for EtherNet/IP
VII. Case History
I.

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 4www.odva.org

The Common Industrial Protocol
General Overview

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 5www.odva.org

The Common Industrial Protocol
CIP can be used above varying network protocols
including DeviceNet, ControlNet, EtherNet/IP, andCompoNet
 EtherNet/IP uses the standard Ethernet layer ofTCP/IP CIP is based on abstract object modeling• Object classes• Services

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 6www.odva.org

The Common Industrial Protocol

Two types of Communication:• Class 1 implicit messaging – low jitter and latency(typically UDP)
• Class 3 explicit messaging – reliable connection based(typically TCP)The CIP layer is complex, but follows a consistentformat
 It can map itself to various functions, physicalentities, and productsTechnical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 7www.odva.org

Security Threats to EtherNet/IPImplementations

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 8www.odva.org

US ICS-CERT Security Advisories
Prior to Stuxnet:


5 security advisories

3 vendors involved

2011:


215 disclosed vulnerabilities

104 security advisories

39 vendors involved

2012

248 disclosed vulnerabilities2013~ 400 disclosed vulnerabilities

40% of disclosed
vulnerabilities included
working attack code
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 9www.odva.org

Security Threats to EtherNet/IPDeployments
Linking corporate and control systems together
increases exposures to threats Protocols like EtherNet/IP not secure by design The lack of authentication presents a vector for attack
 Threats can also stem from implementation issues
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 10www.odva.org

Lack of Command Granularity
July 2008 DHS warning to energy companies:“A vulnerability has been identified and verified within
the firmware upgrade process used in control systems
deployed in Critical Infrastructure and Key Resources(CIKR)… development of a mitigation plan is required toprotect the installed customer base and the CIKR of thenation.
Firmware Vulnerability Mitigation Steps [include]
blocking network firmware upgrades withappropriate firewall rules.”BUT traditional firewalls only provide complete
protocol allow or denyTechnical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 11www.odva.org

Methods to Secure EtherNet/IP

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 12www.odva.org

Methods to Secure EtherNet/IP
Security issues that are part of the current
EtherNet/IP standards and implementations are likely
to remain with us for at least the next decade Industry must explore methods to secure these
existing protocols and systems, independent of future
improvements to the specifications
 There are two primary technologies used in the IT
world to secure on-the-wire messages
• Encryption, signing and cryptographic techniques• Packet filtering

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 13www.odva.org

Encryption of Data and Virtual
Private Networks
One common method of securing communications isto use cryptographic techniques, such as encryptionbased tunneling Usually referred to as Virtual Private Network (VPN) VPN technologies create a secure ‘tunnel’ between two
end points over an untrusted networkTechnical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 14www.odva.org

Encryption of Data and Virtual
Private Networks
VPNs provide three key capabilities:• Privacy• Authentication• IntegrityLimitations:• Overhead of encryption – negative impact on time
sensitive communications• No data validation – Bad data in means bad data out• Reliable key or certificate management is challenging

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 15www.odva.org

Packet Filtering via Firewalls
A firewall is a device that monitors and controls traffic
flowing in or between networks
 Traditional IT firewalls apply filters at the TCP and IP
layers of a message, using Access Control Lists (ACLs)
to check three primary fields in a message:• Address of the computer sending the message• Address of the computer receiving the message• Application layer protocol contained by the IP message

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 16www.odva.org

Limitations of TraditionalFirewalls
IT firewalls do not allow for fine grained control This is an issue – as discussed, SCADA/ICS protocols
have no granularity• A data read message looks EXACTLY like a firmware
update message to IT firewall• If you allow data read messages, you are also allowing
programming or firmware upgrade messages to passthrough - This is a serious security risk

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 17www.odva.org

Firewalls and Deep Packet
Inspection
Deep Packet Inspection (DPI) is an extension totraditional firewall technology that can provide thefine grained management of EtherNet/IP traffic
 DPI allows the firewall to understand what tasks theprotocol is being used for (e.g. read, write, etc)
 It can interpret specific ICS protocols and apply filters
on fields and values that matter to control systems
 It can also check the validity of the messages – dothey conform to the specifications?
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 18
www.odva.org

What Deep Packet Inspection
Is and Is Not


DPI is:• The deterministic and repeatable filtering of packets
based on parsing at all layers• Think of it as Wireshark in real-time

DPI is not:• A signature based intrusion detection system (IDS) likeSNORT• An authentication mechanism

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 19
www.odva.org

Analysis of EtherNet/IP for Deep
Packet Inspection (DPI)

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 20www.odva.org

Analysis of EtherNet/IP for Deep
Packet Inspection (DPI)
Must understand the structure of the protocol in its
most basic form; that is bits and bytes
 For example, consider the field “Length” in an
EtherNet/IP message that is executing the Get
Attribute All service on an Analog Input object• What exactly does “Length” indicate?
• Is there a minimum or maximum that, if violated, might
indicate an attempted attack?
• Would these values change depending on the CIP object
or service involved?

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 21www.odva.org

EtherNet/IP Header Structure
The EtherNet/IP header is a 24 byte fixed length
header with a trailing optional data portion The “Command Specific Data” field encapsulates CIPTechnical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 22www.odva.org

CIP Messaging Structure
The CIP header has multiple static fields and arequest path that contains a set of CIP segments• This includes port segments, logical segments, networksegments, symbolic segments, data segments, and keysegments• Not every packet contains every type of segment.

There is always a CIP service executing some action
upon the logical class segment

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 23www.odva.org

CIP Messaging Structure
For DPI design, the logical object class is a main fieldof interest, with the logical segment encoding being
the most important The “logical segment” is an 8 bit field with

• The 3 highest bits denote the“logical segment type”• The following 3 bits denote the“logical type”• The last 2 bits denote the“logical format”– Used to identify the size of
the “logical value” that follows
the “logical segment” field

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 24www.odva.org

CIP Messaging Structure

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 25www.odva.org

Analysis of EtherNet/IP
SummaryThe architecture of the EtherNet/IP and CIP layers are
not trivial and contain many moving parts
 Session establishment utilizes a set of commands withvarying results and dynamic fields
 Session establishment spread over 3 layers, so DPI
engine must communicate between layers
 CIP in itself carries complexity based on the type ofconnection, whether it is using a message router orUnconnected Send affects the packet structureTechnical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 26
www.odva.org

Implementing DPI for EtherNet/IP

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 27www.odva.org

What’s Important?
How can you interpret this complexity and design ausable filter mechanism to ensure credible network
traffic in an efficient manner?
 Two main tasks for DPI:• Sanity Check – Does this message conform to spec?
• Identify critical fields or actions - What makes sense tofilter for security?
Pick carefully - You don’t want to sanity check or filter
absolutely every field or else:• Latency will be excessive• The end user will be confused with too many options• Configuration mistakes will occur

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 28
www.odva.org

Sanity Checking EtherNet/IP
Messages
There is no shortage of ways in which an attacker
could harm a PLC by sending malformed frames
 Sanity checking needs to protect against the mostdangerous field violations
 From the user’s perspective, sanity checking isexecuted ‘behind the scenes’ Must be a selectable option because in some cases avendor may fall short when attempting to adhere tothe specification
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 29
www.odva.org

Sanity Checking EtherNet/IPMessages

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 30
www.odva.org

Managing Sessions WhenPackets are Dropped

If a packet fails a sanity check, then it is dropped
Any message that is dropped is part of a TCP stream
If one message within a TCP stream is just silently
dropped, then the TCP sequence count in the frame
received by the target wouldn’t alignFor many HMIs this will cause a lockup until the TCP
timer resets the session (a long time)
To mitigate this, a TCP reset must be sent to bothparties to properly close and re-establish the session

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 31www.odva.org

Identifying Critical CIP Fields for
Filtering
Since CIP is an object based system with various CIP
services acting upon these objects, it makes sense tofilter on the fields that denote what object and service
is being invoked Users can then specify object and service pairs thatare safe for the firewall to allow (and block all others) The ODVA specification outlines a set of common
services and optional object specific services that anobject may adhere to. It also allows for vendor
specific services
 Each object supports a specific set of CIP servicesTechnical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 32
www.odva.org

Field Usability of DPI for
EtherNet/IP

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 33
www.odva.org

Field Usability of DPI for
EtherNet/IP
Customers rarely understand what is “on-the-wire”
 99% of the options are never used
 Must be easy to use, or customers will make mistakesTechnical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 34
www.odva.org

Field Usability of DPI for
EtherNet/IP
Start with the traditional IT Firewall as a platform Keeps all rules in one ACL style list
 Add DPI filtering to extend firewall filtering capabilities
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 35
www.odva.org

DPI Security Made Easy

2. SelectServer

3. Select
Protocol4. Select DPIPermission

1. Select Client

5. Select
AllowedServices

Technical Track© 2014 ODVA, Inc.

6. Select
Options

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 36www.odva.org

Advanced DPI Configuration for
EtherNet/IPProvide advanced CIP filtering for skilled customers

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 37
www.odva.org

Allow User Defined
Objects and Services

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 38
www.odva.org

Case History
Securing Pipeline Compressor Controls

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 39
www.odva.org

Securing Pipeline CompressorControls
Compressor packages are complex, high risk systems
 Monitoring of platforms is critical in remote locations
 Risk of rogue insiders and unpatched vulnerabilities(even with VPN)
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 40
www.odva.org

Read-only Controller Firewall
Firewall inspects each EtherNet/IP message to ensure
only data-read commands are allowed to the PLCs
 Requires no configuration, no network changes and nodisruption to monitoring or turbine operations
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 41www.odva.org

Conclusions
There is a need for an effective security solution for
IDS/SCADA systems
 Deep Packet Inspection of EtherNet/IP significantly
increases reliability and security
 There is a way to make use of EtherNet/IP DPI
without adding overwhelming complexity
 EtherNet/IP DPI is applicable to real world situations
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 42www.odva.org

Questions?

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 43www.odva.org