Here we are again with a new release of Scada Exposure research. First will be exposed the 2016-08 release summary and then there will be a comparison between this and the 2013-11 release.
Abstract
We found that 126'533 of ICS and SCADA devices are now exposed in public databases, at risk of attack. More than 4'000 are present in Switzerland and Italy alone. Switzerland is more exposed that Italy in proportion, with 867 exposed devices on a total of 2'864'000, compared to 3'296 of Italy on a total of 8'842'000.
All data gathered during our research is published for further study.
1 Introduction
Welcome to the second release of ScadaExposure, an observatory on international reachability of ICS and SCADA devices.
The 2016-08 release is focused on answering the following questions:
- Are ICS and SCADA devices correctly deployed and disconnected from public networks?
- How many devices are exposed in Switzerland?
- How many devices are exposed in Italy?
- How is the Switzerland compared to Italy and vice-versa?
- How is the exposure at the moment compared with the one of 2013-11?
- What companies in scada sector have gained market in three years? Which ones have missed it?
- Compared with the global trend, Italy and Switzerland are aligned or not?
- Which countries have more exposed enterprise-level ICS components?
- What is the possible impact?
2 Research method
We used the same set of 2013 with 95 dorks (search queries) against generic search engines (like Google and Bing) and specialized ones (like Shodan, who focus on indexing machines connected to the Internet). This represents the largest collection of search queries specialized in finding SCADA devices up to date. We did not only collected them, we improved the queries to get more and more solid results. For example some dorks were focusing on authentication banners, but in this way one will always and only get authentication protected devices, ignoring unauthenticated ones.
For each dork we performed several interrogations, dividing the results in three sets: Worldwide, to get the global presence of a particular device; CH, to limit the results to Switzerland; IT to limit the results to Italy. Switzerland and Italy were chosen as they are two neighbor nations and thus perfect for a comparative analysis.
To perform those interrogation we developed a Shodan API written in PHP for a fastest way to get the results, also looking to the future for making new releases every year. You can find the API source code here on github: Shodan-PHP-REST-API.
Having distinct sets for different nations allows statistical and proportional comparison. We will add more countries in the future.
Dorks were then categorized in a taxonomy of Producers (we call them Vendors), Products and Versions. A dork can be linked to a Vendor, Product or Version or can be completely generic (like "PLC"). This allow us to obtain subtotals for every entity and know the actual usage and exposure rate.
3 Analysis
It's known that ICS and SCADA systems are a link between the digital and physical world so the consequences of malfunctioning can be definitely serious. It's also a fact that in complex systems even the failure of non-critical components can cause unplanned collateral damages.
The research is focused on demonstrating that such systems are not "air gapped" (deployed on a different, separated network) as many suggests, instead such devices are often exposed to random attackers from the Internet. This means that devices, thought to be completely isolated from external attackers, must be re-engineered with modern threat models.
Using our set of dorks we discovered a total of 126'533 SCADA devices, categorized in 29 Vendors and 62 Products. Switzerland accounted for 867 ICS devices on a total of 2'864'000 devices(dork country:"CH") connected to Internet and indexed by our data sources. Italy accounted for 3'296 ICS devices on a total of 8'842'000 devices(dork country:"IT").
While Switzerland has 3 times less devices than Italy, we came to the conclusion that Italy has more exposed ICS devices in proportion. This means that the usage of SCADA elements is more pervasive and/or that their security is worse than in Switzerland. Speaking of absolute proportions Italy has 3.8 times more ICS devices than Switzerland, a number that is higher than 3.
Analysis between ICS/SCADA systems (Summary):
- 2.6% of world’s SCADA devices are in Italy;
- 0.7% of world’s SCADA devices are in Switzerland;
- Italian and Swiss SCADA devices represent the 3.3% of the global exposure.
Our data moreover allows a comparison of ICS devices in a country versus the global total.
Analysis between ICS/SCADA systems and non-SCADA systems (Summary):
- 0,04% of Italian exposed devices are SCADA;
- 0,03% of total Swiss exposed devices are SCADA;
- Italy is proportionally more exposed (+26.30%);
- In Italy every 2'680 devices scanned one is SCADA;
- In Switzerland every 3'300 devices scanned one is SCADA;
This means that randomly scanning 10 IP per second statistically you can find one exposed SCADA system every 10 minutes.
4 Conclusion
Now is time for answering the previously raised questions:
Are ICS and SCADA devices correctly deployed and disconnected from public networks?
They are in many occasions not.
How many devices are exposed in Switzerland?
Switzerland has 867 ICS devices exposed.
How many devices are exposed in Italy?
Italy has 3'296 ICS devices exposed.
How is the Switzerland compared to Italy and vice-versa?
Italy has more exposion (+26.30%) compared to Switzerland, although Italy has many exposed devices.
How is the exposure at the moment compared with the one of 2013-11?
Using the same set of dorks used in 2013 we found that those devices are less exposed now a days. We hope that the lesser exposure is real, but it could also mean that some old exposed devices were replaced by newer ICS not observed by our research. Then in the next releases we will add dorks for the newest ICS products avaiable and we will compare many different countries.
What companies in scada sector are the "Key Players" of the market?
ABB Ltd. (Switzerland)
Alstom (France)
Emerson Electric Co. (US)
General Electric Company (US)
Hitachi, Ltd. (Japan)
Honeywell International (US)
IBM Corporation (US)
ICONICS, Inc. (US)
Inductive Automation (US)
JFE Engineering Corporation (Japan)
Mitsubishi Electric Corporation (Japan)
Omron Corp. (Japan)
Rockwell Automation, Inc. (US)
PetroCloud (US)
Primex (US)
Scadata, Inc. (US)
Schneider Electric (France)
Siemens AG (Germany)
Tesco Controls Inc. (US)
Toshiba Corp. (Japan)
Xio, Inc. (US)
Yokogawa Electric Corporation (Japan)
Compared with the global trend, Italy and Switzerland are aligned or not?
Our research has highlighted a drop of approximately 75% in global terms, while Italy followed the global trend with a drop of approximately 80%, Switzerland has obtained less decrease compared to Italy with a drop of approximately 60%.
Which countries have more exposed enterprise-level ICS components?
United States (268,784)
China (121,022)
Hong Kong (69,731)
Australia (58,433)
Japan (40,564)
France (29,738)
United Kingdom (27,998)
Dominican Republic (20,495)
Canada (19,913)
Republic of Korea (14,011)
What is the possible impact?
In a perfect world none of the found systems should be accessible by untrusted networks. Yet, the security of ICS/SCADA is often not given the treatment it deserves. Small and medium businesses, as well as individuals, are completely reliant on vendors when it comes to the security of the Internet of Things, they don't even known how high is the risk to be attacked. Scada Exposure research reminds us that the “Security through Obscurity” principle cannot serve as a good basis to achieve effective protection from modern attacks.
5 Known limitations
We did not connect to the found devices, it was not within the scope of the research and we do not publish specific IP addresses of targets, attackers already actively exploit such information. Publishing it would not add value to our research.
There is no assertion that systems are still reachable from the public Internet or vulnerable at all. They were indexed at some point by our datasources, and thus already exposed to the Internet. This alone represent a violation of most common security best practices, especially when it comes to ICS devices. Only information that seemed accurate and truthful was included in our results.
Search queries used to identify devices are not perfect and may overlap, resulting in larger subtotals and totals than the unique IP count, this may change with future releases if more resources are found to implement the needed screening and filtering.
It's impossible to know what these systems are connected to, and thus it's impossible to know the actual Risk. That's why to effectively assess Risk, Penetration Tests are used. They are real "simulations" of attacks, in the sense that targets are actually attacked but the test is executed in order to avoid deliberate damage. Again, no attack was performed against these devices.
Used datasources do not spider every possible device, they should be used as a statistical indication only. It can be easily understood that devices that appear in such databases have an increased chance to be attacked.
There are actually much more publicly accessible devices than the ones indexed by out datasources. We think that this compensate know limitations. Again, we were only looking for a statistical evidence to get educated conclusions.
6 Who and Why
All the research for this release has been performed by Francesco Ongaro and Alex Salvetti from ISGroup SRL, including building a platform that will serve for future studies and hopefully the creation of a more open ICS security community.
We started this research on request from Florian Imbach, a journalist of Sonntagszeitung, and decided to take it further because of the risk connected to insecure SCADA deployments, the little awareness and a great gap to fill compared to IT systems's security.
Our observatory represent a source to where people can refer to, citing actual numbers instead of vague feelings. There is no other public research comparable to ScadaExposure at the moment.
If you are a citizen you should require secure systems. If you are a company you should invest in the security of your production equipment. If you are a producer you should re-evaluate your products from a security prospective. If you are a security company you should sponsor this project to improve the awareness and overall security of ICS systems and infrastructures.
If you just want to contact us just write to scadaexposure@isgroup.it.