1. 5 Network Communications Penetration Tasks
   1. 5.1 RF Packet Analysis
      1. 5.1.2 Spread Spectrum Recovery
      2. 5.1.3 Signal Demodulation
         1. 5.1.4 Network Traffic Extraction
      3. 5.1.5 RF Signal Transmission
   2. 5.2 Network Protocol Analysis
      1. 5.2.1 Network Protocol Traffic Capture
      2. 5.2.2 Network Protocol Cryptographic Analysis
      3. 5.2.3 Unknown Protocol Decoding
      4. 5.2.4 Network Protocol Fuzzing
      5. 5.2.5 Network Protocol Exploitation

5 Network Communications Penetration Tasks

This section pertains to the testing of network communications for the smart grid systems, such as field area networks. Primary targets include wireless medium, network protocols, network segmentation controls, etc. The overarching goal is to identify vulnerabilities that allow an attacker to control network traffic or to subvert a device through protocol manipulation. The following table will help map specific communications channels that should be considered for each Smart Grid product domain

Figure 5a below shows the overall process flow of the task sub-categories in this section. The figure shows the two task sub-categories may be performed in parallel. As in previous diagrams in this document, the colors represent the recommended likelihood that a utility should consider performing these task sub-categories, and the relative level of expertise required.

Figure 5a: Network Communications Subcategory Flow

Each subcategory below includes a similar diagram depicting the process flow and recommended likelihood to perform for each task.

Suggested Tools:

• Traffic capture and protocol decoder software such as Wireshark or tcpdump
• Hardware network taps
• Man-in-the-Middle tools such as Ettercap
• Protocol fuzzing tools such as Sulley
• Network packet generation such as Scapy
• Universal radio analysis kit, such as USRP2 with GNU Radio

5.1 RF Packet Analysis

This subcategory of penetration tasks focuses on the analysis of lower-layer RF communications such as frequency hopping, modulation, multiplexing, and data encoding in the Physical Layer and Medium Access Control Layer (PHY/MAC) of the Open Systems Interconnection (OSI) model.

It is usually assumed that network traffic can be extracted from captured RF communications. As a result, utilities often choose not to perform these sub-tasks and often skip to the next Network Protocol Analysis subcategory of tasks. However, some utilities may find this task subcategory useful to determine the level of effort it would take for an attacker to capture and decode their RF network traffic, especially when the utility knows of security weaknesses in the higher layer network protocols. For entities interested in this type of analysis, consider the following suggestions in each Smart Grid product domain.

Figure 5.1a: RF Packet Analysis Task Flow

5.1.1 RF Signal Capture

Level of Effort: Medium

Task Description: Use a tool (such as a USRP2) to capture the RF communications of the target field device. Discover of the frequencies used are usually straightforward by referencing the FCC or other regulatory license IDs printed on the outside of the transmitting device, through vendor documentation, or even patent fililings.

Task Goal: Obtain data for following tasks.

5.1.2 Spread Spectrum Recovery

Level of Effort: Extremely High

Task Description: If Spread Spectrum (SS) techniques are used on the signal, knowledge of the SS algorithm must be obtained either from documentation, through recovery in the disassembled firmware, or through capture of all signal components in the used spectrum. Use of a tool such as GNU Radio to capture and discover the algorithm is possible, but very time consuming.

Task Goal: Obtain data for following tasks.

5.1.3 Signal Demodulation

Level of Effort: Medium

Task Description: Use a tool such as GNU Radio to demodulate the signal. If spread spectrum technologies are used, this greatly increases the level of effort of this task.

Task Goal: Obtain data for following tasks.

5.1.4 Network Traffic Extraction

Level of Effort: Medium

Task Description: Use a tool to decode and extract communications payload from RF capture.

Task Goal: Obtain data for following tasks.

5.1.5 RF Signal Transmission

Level of Effort: Medium to High

Task Description: Use a tool to transmit RF signals at the appropriate frequencies and hopping patterns to either replay captured data, impersonate the target field device, or attempting to cause denial of service scenarios.

Task Goal: Identify vulnerabilities in the RF signaling.

5.2 Network Protocol Analysis

This subcategory of penetration tasks focuses on analysis of network protocols above the PHY/MAC layer or from layer two and above in the OSI model.

Figure 5.2a: Network Protocol Analysis Task Flow

5.2.1 Network Protocol Traffic Capture

Level of Effort: Low

Task Description: Use a tool to capture sample communications. Attempt to cause known actions that result in communications between devices, such as firmware updates, and capture this communication individually to facilitate later analysis. Obtain samples of all target functionality.

Task Goal: Obtain data for the following tasks.

5.2.2 Network Protocol Cryptographic Analysis

Level of Effort: Medium

Task Description: If the traffic capture uses a known protocol, identify the negotiated cryptographic algorithm and key length to determine if any known vulnerabilities exist. If traffic capture is using an unknown protocol and is not readable, extract payloads from the captured network traffic and perform an entropy analysis to determine if the data is encrypted. High levels of entropy among the payload bytes often signify that encryption is being used, and weaknesses in cryptographic implementations can often be determined by variations in that entropy.

Task Goal: Determine if cryptography is being used and identify any vulnerabilities.

5.2.3 Unknown Protocol Decoding

Level of Effort: High to Extremely High Task Description: If traffic capture is using an unknown protocol, reverse engineer the network captures in an attempt to understand the protocol. Analyze each capture in light of the actions performed to initiate that traffic. For instance, if analyzing a traffic capture of a firmware update, try to identify the firmware being sent in the payload. Additionally, analyze actions such as initial registration between devices to determine if an authentication mechanism is being used.

Task Goal: Identify the purpose of blocks of data that could be used in later analysis.

5.2.4 Network Protocol Fuzzing

Level of Effort: Medium to High

Task Description: Use a tool to send both valid and invalid communications to both end points of the communications link individually, analyzing the results and identifying anomalies. This task includes items such as password guessing, invalid input testing, data enumeration, replaying data, susceptibility to Man-in-the-Middle (MitM) attacks, etc.

Task Goal: Identify vulnerabilities in the network protocol implementation.

5.2.5 Network Protocol Exploitation

Level of Effort: High to Extremely High

Task Description: Based on the findings from previous tasks, determine feasible attacks which can be launched on the field technician interface. For example, if devices are not required to authenticate themselves when joining a field area network, it may be possible to insert a ‘rogue’ node in the network or to harvest controlled devices away from their management server such as AMI headends or synchrophasor managers. Another example might be spoofing a firmware update or disconnect signal or perform an active MitM attack.

Task Goal: Create proof of concept attacks to demonstrate the feasibility and business risk created by the discovered vulnerabilities.

Table of Contents

• 1 Introduction
• 2 Penetration Test Scoping
• 3 Target System Setup
• 4 Embedded Device Penetration Tasks
• 5 Network Communications Penetration Tasks
• 6 Server OS Penetration Tasks
• 7 Server Application Penetration Tasks
• 8 End-to-End Penetration Test Analysis
• 9 Result Interpretation and Reporting