Pwning into Power System Center

Pwning into Power System Center

Speakers: Omkar Joshi, Lead Offensive Security Engineer, Koopa Software

Conference: Hacktivity

YouTube: https://www.youtube.com/watch?v=gXWZJ4_Lzu0

Overview

In this compelling Hacktivity presentation, Omkar Joshi, a seasoned red teamer, unveiled the critical findings from a recent engagement against a nation-state electricity provider. Titled "Pwning into Power System Center," the talk detailed how his team uncovered multiple zero-day vulnerabilities within a widely deployed industrial control system (ICS) product, enabling them to gain complete control over power substations. This research transcends typical IT security, delving into the highly sensitive realm of SCADA (Supervisory Control and Data Acquisition) and OT (Operational Technology) environments, where disruptions can have catastrophic national implications.

Joshi meticulously walked the audience through the elaborate red team exercise, from initial access via social engineering and network sniffing to sophisticated privilege escalation techniques that bypassed robust security controls. The core of their discovery revolved around a critical flaw in a "Power System Center" product, allowing a low-privileged, read-only user to achieve super-admin status and manipulate critical infrastructure components. The implications are profound, highlighting severe vulnerabilities in systems underpinning essential services and underscoring the urgent need for rigorous security assessments in critical infrastructure. The disclosed zero-days are currently in the process of receiving an ICS advisory from CISA, emphasizing their global impact.

Background

▶ Watch: Introduction: Pwning Power System Center & Zero-Days (0:00)

Historically, managing and troubleshooting issues within power grids and substations often necessitated physical presence at remote locations. This approach, while cumbersome, inherently provided a degree of physical isolation from cyber threats. However, with the advent of centralized management solutions, the landscape of OT security has evolved dramatically. The product under scrutiny in this engagement, an unnamed Power System Center originating from the US/Canada, represents this modernization trend. It acts as a central hub, connecting and managing all SCADA, IoT, and OT devices across various substations and power grid stations. This centralization offers significant operational efficiencies, allowing remote management and reducing the need for on-site personnel.

Despite the operational benefits, this shift introduces a new, complex attack surface. The Power System Center, typically deployed within a secure data center behind firewalls and isolated networks (often through VLANs or virtual implementations), is designed with stringent security assumptions. These include segregation of duties, least privilege, and Windows-based authentication to ensure that only authorized personnel can access and control critical infrastructure components. The environment is considered highly isolated, making direct intrusion challenging. However, as Joshi's team demonstrated, these layers of defense can be circumvented, particularly when older, less frequently patched systems or human vulnerabilities are present. The inherent criticality of such systems, responsible for providing electricity to an entire nation, means any compromise could lead to widespread blackouts and national emergencies, making the security of these platforms paramount.

Key Findings

▶ Watch: Initial access: MITM, Responder, and credential capture (9:45)

The red team engagement yielded several critical findings, exposing a chain of vulnerabilities that collectively allowed for complete compromise of the power system:

1. Initial Access through Social Engineering and Network Poisoning: The team gained initial access by combining MITM (Man-in-the-Middle) techniques with a crafted phishing email. They utilized the well-known tool Responder to perform LLMNR/NBT-NS poisoning and exploit WPAD/SMB mistyping vulnerabilities. A carefully designed email containing a malicious \\sharefolder link bypassed existing email security (DMARC/SPF policies were found to be inadequate or non-existent), leading an unsuspecting employee to click.
2. Credential Compromise: Clicking the link resulted in the capture of an NTLM hash. Although hash cracking can be challenging, the team successfully brute-forced the password, revealing a valid user credential. This demonstrated that even with password policies in place (e.g., 12 characters, alpha-numeric), brute-forcing remains a viable attack vector against weaker or common passwords.
3. Endpoint Security Bypass: After obtaining limited access to a Windows endpoint, the team faced Microsoft Defender (and other Microsoft security controls). They meticulously crafted and tweaked custom payloads, including making "one-byte" changes and altering encoding, file types, and binary structures, to bypass the antivirus and establish a reverse shell connection to their command-and-control (C2) machine.
4. Discovery of the Power System Center Web Interface: With a foothold established, the team performed extensive internal network scanning and enumeration. They identified a web server hosting the Power System Center, which was accessible only via Windows-based authentication.
5. Critical Privilege Escalation (Zero-Day): Despite having valid credentials, the initial access to the Power System Center was restricted to a "read-only" role. However, by consulting product documentation, the team identified undocumented API endpoints. Crucially, they discovered that by directly hitting these API endpoints with Windows authorization, they could bypass the UI's role-based access controls and escalate their privileges from a read-only user to a super-admin. This was identified as a significant zero-day vulnerability.
6. Substation Control and Impersonation: With super-admin privileges, the team gained full control over the Power System Center. This allowed them to connect to SCADA endpoints, fetch device information, and critically, delete or modify entire substations within the system. Furthermore, they discovered an impersonation vulnerability, where actions performed by the attacker would be logged under the identity of another legitimate user, obscuring the true source of malicious activity.
7. Multiple Zero-Days Reported: The engagement resulted in the discovery of multiple zero-day vulnerabilities, which have been reported to the vendor through the electricity provider. The process of obtaining an ICS advisory from CISA (cisa.gov) is currently underway, indicating the significant and widespread impact of these findings.

Technical Deep Dive

▶ Watch: Privilege escalation: Read-only to super admin via API (19:45)

The red team's success hinged on a methodical, multi-stage attack chain, beginning with initial reconnaissance and culminating in full control over critical infrastructure.

Initial Foothold and Credential Acquisition:

The first objective was to establish a foothold within the corporate network. The team employed MITM (Man-in-the-Middle) techniques using the open-source tool Responder. Responder is notorious for its ability to perform LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service) poisoning. In an unpatched or misconfigured network, Responder can answer name resolution requests for non-existent hosts, tricking clients into sending authentication attempts (NTLM hashes) to the attacker's machine.

Complementing this, the team exploited WPAD (Web Proxy Auto-Discovery Protocol) and SMB (Server Message Block) mistyping. Many Windows environments are configured to query for a WPAD configuration file or attempt to connect to mistyped SMB share paths. The ingenious part of the attack was a crafted email. This email, designed to look legitimate by leveraging the absence of robust DMARC (Domain-based Message Authentication, Reporting, and Conformance) and SPF (Sender Policy Framework) policies, contained an embedded link to a non-existent SMB share, formatted as \\malicious-share. When an employee clicked this link, their system attempted to resolve the share path. Responder intercepted this request, provided a malicious response, and captured the user's NTLM hash.

The captured NTLM hash presented the next challenge. While Pass-the-Hash attacks are often effective, the team opted for brute-forcing the password. Despite the organization having a password policy requiring 12 characters, alphanumeric characters, and special symbols, the brute-force attack eventually succeeded after several hours, yielding the plaintext password for a valid user. This highlights that even strong policies can be undermined by common or predictable password choices.

Internal Reconnaissance and Persistence:

With a compromised credential and limited access to a Windows endpoint, the next step was to gain persistent access and escalate privileges. The environment was protected by Microsoft Defender and other Microsoft security controls. To bypass these, the team engaged in extensive payload crafting. This involved iterative tweaking of payloads, making "one-byte changes," experimenting with different encoding schemes, and altering file types and binary structures. Tools like Metasploit Framework's msfvenom, Cobalt Strike, and Empire were likely used as a starting point, but the final payloads were heavily customized to evade detection. This process was a trial-and-error, as the Blue Team (SOC) was actively monitoring and blocking initial attempts. Eventually, a highly obfuscated payload successfully bypassed Defender, establishing a reverse shell to the red team's C2 machine. The SOC did receive a low-priority alert for an HTTPS connection, but it was not flagged as highly anomalous or malicious, demonstrating the stealth of the final payload.

From the compromised machine, the team initiated internal network scanning. The environment was a "black box," meaning they had no prior information about subnets, IP ranges, or device lists. Through scanning, they discovered various web servers and eventually identified one hosting the Power System Center.

Power System Center Exploitation and Privilege Escalation:

Accessing the Power System Center's web interface required Windows-based authentication. The previously compromised credentials allowed the team to log in, but they were initially granted only "read-only" permissions. This role severely restricted their ability to interact with critical functionalities.

This is where the team leveraged product documentation. They meticulously reviewed the vendor's documentation, identifying various API endpoints that were not directly exposed or accessible through the standard web UI for read-only users. The critical discovery was that by directly sending requests to these API endpoints with the compromised Windows authorization token, they could bypass the UI's role-based access control (RBAC) mechanisms. This vulnerability allowed them to escalate their privileges from a "read-only" user to a super-admin. This direct API access technique completely subverted the intended security model.

With super-admin privileges, the team gained unrestricted access to the Power System Center. They could now:

• Connect to SCADA endpoints within the isolated OT network.
• Fetch sensitive information about connected devices.
• Critically, modify or delete entire substations from the system. This capability implied the power to disrupt electricity supply to vast regions.
• Exploit an impersonation vulnerability, where actions performed by the attacker would be logged as if they were executed by another legitimate user (e.g., "John has performed the action, not Omkar"). This made forensic analysis and attribution extremely difficult.

The successful exploitation of these vulnerabilities demonstrated a profound lack of secure design, where API endpoints designed for back-end functionality lacked proper authorization checks, allowing a low-privileged user to achieve full control over critical national infrastructure.

Demo / Proof of Concept

▶ Watch: Defensive strategies: Gap analysis, people, process, technology (27:00)

While no live demonstration was conducted during the talk, Omkar Joshi explicitly stated that the red team engagement was an authorized project. The team was able to replicate the entire attack chain and the resulting impact within a controlled, isolated environment provided by the electricity provider. Crucially, the speaker confirmed that the findings and the ability to shut down or manipulate substations were verified to be reproducible in a production-like setting. The primary goal of the red team, which was to "mess up with the power stations or substations," was successfully achieved, demonstrating the severe real-world implications of these vulnerabilities. The absence of a live demo was attributed to the highly critical nature of the environment and the sensitivities surrounding the zero-day disclosures.

Defensive Implications

▶ Watch: Q&A: Blue team detection and red team evasion tactics (39:30)

The findings from this red team engagement offer critical lessons for defenders, particularly those responsible for critical infrastructure and OT environments. The attack chain highlights that even highly isolated and regulated systems are vulnerable to a combination of social engineering, network-level exploits, and application-layer flaws.

1. Comprehensive Attack Surface Management: Defenders must meticulously identify and understand their attack surface. This includes not only digital assets (networks, systems, applications, APIs) but also physical entry points. The concept of attack vectors – the actual mediums or tools used (e.g., phishing, malware, compromised credentials, supply chain attacks) – must be continuously analyzed. Organizations should conduct regular Gap Analysis across People, Process, and Technology (PPT) to identify weaknesses.

• People: Lack of security awareness, susceptibility to social engineering.
• Process: Inadequate patch management, weak incident response, poor configuration management.
• Technology: Unpatched systems, insecure configurations, default credentials, vulnerable APIs.

1. Robust Defense in Depth Strategy: A multi-layered security approach, or Defense in Depth, is paramount. This involves implementing proactive controls at every layer:

• Perimeter Security: Strong firewalls, intrusion prevention systems.
• Host-Based Protection: Advanced EDR (Endpoint Detection and Response) solutions, not just basic antivirus.
• Network Segmentation: Strict VLANs and network access controls to isolate critical OT networks from IT networks and prevent lateral movement.
• Identity and Access Management (IAM): Strict enforcement of least privilege and segregation of duties. This case showed a failure in API-level privilege enforcement, even when UI-level RBAC was present.
• Zero Trust Architecture: Implement a "trust but verify" model, where no user or device is implicitly trusted, even if they are internal or have authenticated. Every access request must be continuously validated.

1. Enhanced Employee Security Awareness: The initial compromise relied on an employee clicking a malicious link. This underscores the need for continuous and effective security awareness training, focusing on:

• Recognizing phishing attempts, especially those leveraging SMB shares or less obvious malicious links.
• Understanding the risks of mistyping network paths or responding to unexpected prompts.
• The "people" aspect is often the weakest link, even in highly technical environments.

1. Secure Software Development Lifecycle (SSDLC) and Continuous Testing:

• Shift Left: Integrate security practices early and throughout the entire SDLC (Software Development Lifecycle). This includes threat modeling, secure coding practices, and automated security testing (SAST, DAST, SCA).
• Regular Penetration Testing and Red Teaming: Automated tools, while valuable, cannot replicate the ingenuity and adaptive nature of human attackers. Organizations must conduct time-boxed penetration tests and red team exercises regularly, ideally before production releases and at least annually. These exercises should mimic real-world adversaries and assess the effectiveness of all layers of defense, including the SOC's detection capabilities. The speaker emphasized that manual pen testing is irreplaceable for finding complex, chained vulnerabilities like those discovered.

1. Adherence to Regulatory Compliance and Standards: Organizations in critical infrastructure are often subject to stringent regulatory frameworks (e.g., PCI DSS for payment systems, GDPR for data privacy, HIPAA for healthcare, NIST CSF, NERC CIP for critical infrastructure, and Swift for banking). These standards often mandate regular security assessments, vulnerability scanning, and penetration testing (e.g., PCI DSS requirement 11.3 for annual pen tests). While compliance doesn't guarantee security, adhering to these requirements provides a baseline for good security posture and often forces organizations to identify and address weaknesses proactively.

Key Takeaways

• Critical infrastructure products, even if certified, can harbor severe zero-day vulnerabilities. Assumptions about their inherent security due to vendor reputation or certifications should be critically re-evaluated through independent testing.
• Simple social engineering, combined with network-level attacks, remains a highly effective initial access vector. Robust DMARC/SPF, combined with continuous employee awareness training, is crucial.
• Privilege escalation vulnerabilities, especially those bypassing UI restrictions via direct API endpoint manipulation, pose an extreme risk. Thorough security testing of all API endpoints and their authorization mechanisms is vital.
• A holistic defense strategy encompassing People, Process, and Technology (PPT) is indispensable. Gaps in any one area can undermine the entire security posture.
• Manual red teaming and penetration testing are irreplaceable for uncovering complex, chained vulnerabilities that automated tools often miss. These exercises provide realistic assessments of an organization's defensive capabilities.
• Product documentation, intended for legitimate users, can be a goldmine for attackers. Vendors must ensure that documentation does not inadvertently expose sensitive implementation details or attack surfaces without adequate warnings about security implications.

About the Speaker(s)

Omkar Joshi describes himself as a perpetual learner with over 10 years of experience in the security domain. He is a passionate red teamer who enjoys "breaking things" and continually seeks to learn from both mentors and juniors. Joshi holds numerous certifications, reflecting his commitment to continuous professional development. He currently leads the offensive security team at Koopa Software, a product-based company focused on P2B (procure-to-pay) solutions. He credits Cyber Arch Consulting for their collaboration on this specific red team engagement for the nation-state electricity provider. Beyond offensive security, Omkar Joshi also emphasizes the importance of understanding defensive strategies, believing that a complete security assessor must be proficient in both offensive and defensive approaches.