Exploring Vulnerabilities in Smart Cities and Developing Simulation Environments - 2

☑️ Implementation of a Smart City Attack Scenario Using a Simulated Environment

Smart City Attack Conceptual Diagram

The smart city attack scenario involves an attacker infiltrating the internal network from an external source, exploiting vulnerabilities in various protocols to execute the attack.

Attack Sequence

1. The attacker scans for surveillance cameras accessible from the external network.

   

2. Vulnerabilities in the cameras are exploited to gain access to the internal network.

   

3. The attacker then leverages internal network protocols to target traffic lights, streetlights, and smart buildings.

1. Smart City Port Scanning

The attacker, aware of the smart city's public IP, identifies open ports. This process may reveal surveillance cameras exposed for external monitoring.

Port Scanning Using Nmap

Verifying Ports Using Shodan

▶️ Response Strategy

When accessing the smart city's public IP from external networks, it's crucial to restrict access to available ports. Web pages such as administration panels should not be publicly accessible.

However, if there's a need to view camera footage from external sources, encrypted communication should be applied to protect the transmission of video data. This ensures that unauthorized users are unable to view the footage.

2. Exploiting Camera Vulnerabilities for Internal Network Penetration

The attacker verifies the camera's version and analyzes firmware obtained from the firmware update page to identify vulnerabilities.

Utilizing vulnerability analysis tools, the attacker identifies an OS Command Injection vulnerability in the NTP settings of the firmware.

Leveraging this vulnerability, the attacker executes telnetd and connects via telnet to obtain the Wi-Fi SSID and password, thus penetrating the internal network.

▶️ Response Strategy

Vulnerabilities in functions that process data from web pages or user applications during CGI development can pose significant security threats. Therefore, it's crucial to apply secure coding practices during the development phase. Security should be reinforced through measures such as length validation and value verification.

3. Manipulation of Streetlight Signals

If a user permits anonymous access and grants both read and write permissions for the OPC UA server, every user connected to the network, including the OPC UA, would have unrestricted access to read and write data through the OPC UA.

Using tools like Wireshark, attackers can monitor network traffic and obtain the IP address of the OPC UA server.

By using the UaExpert tool, attackers can modify the data of P200, which is responsible for streetlight signals. They can manipulate the value at index 34 ([34]), the only true data involved in turning the streetlights on and off, thereby controlling the LED of the streetlights.

▶️ Response Strategy

When configuring the OPC UA server, only authenticated users should be allowed to manipulate the data, and permissions for anonymous users should be revoked. If there are challenges with account sharing, disabling permissions for anonymous users and granting only necessary permissions should be prioritized to prevent critical operations like write actions.

4. Changing Traffic Light Timing

Analysis of OPC UA data from streetlights revealed that Array[3] of D200 data contained the values 3, 1, 4, correlating with the current traffic light timing in the smart city.

The attacker then employed MQTT Explorer to verify the operational status of MQTT, a widely used protocol in the smart city. Within the MQTT data, they identified specific numbers resembling traffic light data being transmitted in the LW300 data of change_time.

Suspecting the fourth value as a verification number, the attacker initiated a brute-force attack.

Upon successful execution, the traffic light timing was observed to have changed to 1, 1, 1.

▶️ Response Strategy

As MQTT data is transmitted unencrypted, it's vulnerable to interception and manipulation by unauthorized users. To mitigate this risk, implement SSL communication during initial MQTT configuration. This prevents users on the same network from arbitrarily accessing data or publishing and subscribing to information from shared topics.

5. Traffic Light Control System Manipulation

The attacker verified that the HMI screen information matched the MQTT's read_plc D100 data. This knowledge enabled them to execute a Replay Attack, manipulating the data displayed on the HMI.

HMI data reception typically relies on timestamps (ts). By setting a timestamp later than the current HMI time, the attacker can force the HMI to receive only the latest (manipulated) data, disrupting the control system.

Publishing arbitrary values can cause discrepancies between displayed information and actual traffic light timings, potentially causing confusion at the control center monitoring traffic light status via HMI.

▶️ Response Strategy

Implement SSL encryption for data transmission to prevent unauthorized access. Additionally, introduce an authentication process to restrict arbitrary users from publishing or subscribing to data.

6. Building Management System LED Control

The attacker conducts port scans on various IPs within the internal network to identify devices with open BACnet ports. The port commonly used for BACnet in building management systems is 47808. To confirm this, the attacker engages in network sniffing.

Upon identifying that specific values in the sniffed BACnet data can manipulate the building's LED, the attacker can control the building management system through a Replay Attack.

Through the Replay Attack, the attacker can confirm that LED control is possible on the BACnet server.

▶️ Response Strategy

Encrypt BACnet data for secure transmission and implement user authentication for data transmission and reception. To prevent process inference, configure BACnet to use non-default, arbitrary ports.

Conclusion

Smart city security is a critical concern, necessitating robust personal data protection and network security measures. In smart city networks, where external attack points are limited, securing end-point devices is crucial. As internal network access is prerequisite for attacks like Replay or brute-force, minimizing external access points is advisable when designing smart city or smart factory systems.