KR102581422B1 - Vulnerability testing method and apparatus for serial communication apparaus - Google Patents

Abstract

The present invention relates to a vulnerability testing method and apparatus for serial communication devices. The testing method according to an embodiment of the present invention is a method performed in a test device that is connected to a target device through serial communication and tests vulnerabilities according to serial communication of the target device, including transmitting an attack packet to the target device. ; transmitting a normal packet containing a value within an allowed normal range to the target device; And when an abnormal state of the target device occurs, determining that the target device is vulnerable to the attack packet.

Description

VULNERABILITY TESTING METHOD AND APPARATUS FOR SERIAL COMMUNICATION APPARAUS}

The present invention relates to a vulnerability testing technology for serial communication devices, and more specifically, to a target device connected to serial communication of a protocol such as Modbus RTU (Modbus Remote Terminal Unit), to serial communication of the protocol. It is about technology for testing vulnerabilities.

The conventional vulnerability testing method is based on the TCP/IP protocol. In other words, after sending a specific TCP/IP protocol packet to a target device with an IP address from a remote location, a response TCP/IP protocol packet is received, and the received packet is inspected for TCP/IP protocol communication of the target device. A vulnerability test was performed according to .

However, in the case of a target device using a serial communication protocol such as Modbus RTU, the conventional vulnerability testing method described above cannot be applied. This is because, unlike the TCP/IP protocol method, when a target device using Modbus RTU receives abnormal data, it does not respond with an error message in most cases.

In other words, for target devices using the Modbus RTU method applied in actual industrial sites, only one-way serial communication (i.e., data reception) is provided for most types of packets. As a result, even if abnormal data is transmitted to the target device, the target device rejects or deletes the abnormal data, but does not respond to the sender with an error message, etc. upon receipt of the abnormal data, so the conventional vulnerability testing method This is difficult to apply.

Therefore, there is a need for a new vulnerability testing technology that can be applied to target devices that use serial communication protocols such as Modbus RTU.

In order to solve the problems of the prior art as described above, the present invention tests vulnerabilities according to serial communication of the protocol for target devices connected through serial communication using a protocol such as Modbus RTU rather than the TCP/IP protocol. The purpose is to provide the technology to do it.

However, the problem to be solved by the present invention is not limited to the problems mentioned above, and other problems not mentioned can be clearly understood by those skilled in the art from the description below. There will be.

A method according to an embodiment of the present invention for solving the above problems is a method performed in a test device that is connected to a target device through serial communication and tests vulnerabilities according to serial communication of the target device, transmitting an attack packet to; transmitting a normal packet containing a value within an allowed normal range to the target device; When an abnormal state of the target device occurs, determining that the target device is vulnerable to the attack packet.

The abnormal state may include a case where the target device stops working or lags, or the target device responds with a response packet with a value outside the allowed range.

The serial communication may be communication based on the Modbus RTU (Modbus Remote Terminal Unit) protocol.

The step of transmitting the attack packet may include continuously transmitting a plurality of attack packets to the target device, and the determining step may include the step of determining whether the target device responds to the plurality of attack packets when the abnormal state occurs. It may include a step of determining that there is a vulnerability.

The method according to an embodiment of the present invention is, when it is determined that the target device is vulnerable to the plurality of attack packets, dividing the plurality of attack packets into groups and using the attack packets belonging to the groups, The method may further include finding a vulnerable attack packet among the plurality of attack packets by repeating the steps of transmitting an attack packet, transmitting the normal packet, and determining the step.

The step of transmitting the attack packet may include generating and transmitting an attack packet having a value related to existing publicly disclosed vulnerability information (Common Vulnerabilities and Exposures, CVE).

The step of transmitting the attack packet stores information related to the setting value or operation of the target device, but generates a plurality of attack packets targeting all writable memory addresses of the target device, each with a value that changes outside the permitted range. This may include the step of continuously transmitting.

The attack packet is abnormal data in which the data length section has a value outside the allowed length range, abnormal data in which the data section has data of a length different from the data length section, and abnormal data in which the data section has a value outside the allowed value. The data, or data section, may contain abnormal data having a data type other than the permitted type.

The step of transmitting the attack packet may include transmitting attack packets to a plurality of memory addresses of the target device that store settings or operation-related information of the target device and are writable in different orders.

Existing vulnerability attacks that generate and transmit attack packets with values related to existing disclosed vulnerability information, and changes outside the permitted range targeting all memory addresses of the target device that store information related to the operation of the target device. A random attack that generates a plurality of attack packets with a value and transmits them sequentially, and a semantic attack that transmits attack packets in different orders to a plurality of memory addresses of the target device that store information related to the operation of the target device. At least two attacks selected from attack groups each including an attack may be performed in the step of transmitting the attack packet.

Performing the steps of transmitting the attack packet according to one attack among the attack group, transmitting the normal packet, and the determining step, and then transmitting the attack packet according to another attack among the attack group. The steps of performing, transmitting the normal packet, and determining may be performed.

Performing the steps of transmitting the attack packet according to one attack among the attack group, transmitting the normal packet, and the determining step, and then transmitting the attack packet according to another attack among the attack group. performing the steps of transmitting the normal packet and the determining step, and then performing the step of transmitting the attack packet according to the remaining attack among the attack group, transmitting the normal packet, and the determining step. can be performed.

A device according to an embodiment of the present invention includes a communication unit that performs serial communication with a target device; and a control unit that controls the operation of the communication unit and controls a vulnerability test according to serial communication of the target device.

After transmitting an attack packet to the target device, the control unit may control to transmit a normal packet containing a value within a normal range allowed to the target device, and thereafter, stop operation or lag of the target device. If this occurs or the target device responds with a response packet with a value outside the allowed range, it may be determined that the target device is vulnerable to the attack packet.

The present invention configured as described above can test the vulnerability of a target device connected through serial communication of a protocol such as Modbus RTU, according to the serial communication of the corresponding protocol, and test the vulnerability according to the conventional TCP/IP protocol method. There is an advantage in overcoming the limitations of

In addition, the present invention performs a complex attack that selects and attacks at least two from an attack group consisting of existing vulnerability attacks, random attack steps, and semantic attacks, to more closely identify vulnerabilities to various setting values or operations of the target device. There are benefits that can be confirmed.

The effects that can be obtained from the present invention are not limited to the effects mentioned above, and other effects not mentioned can be clearly understood by those skilled in the art from the description below. will be.

Figure 1 shows a conceptual diagram of the connection between a test device 100 and a target device 200 according to an embodiment of the present invention.
Figure 2 shows a block diagram of a test device and target devices 100 and 200 according to an embodiment of the present invention.
FIG. 3 shows a block diagram of the control unit 130 of the test device 100.
Figure 4 shows a flowchart of a test method according to an embodiment of the present invention.
Figure 5 shows the types of attacks performed in the test method according to an embodiment of the present invention.
Figure 6 shows an example of a memory address.
Figure 7 shows details of four vulnerabilities discovered in the experiment of the present invention.

The above purpose and means of the present invention and the resulting effects will become clearer through the following detailed description in conjunction with the accompanying drawings, and thus the technical idea of the present invention will be easily understood by those skilled in the art. It will be possible to implement it. Additionally, in describing the present invention, if it is determined that a detailed description of known technologies related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description will be omitted.

The terminology used herein is for describing embodiments and is not intended to limit the invention. In this specification, singular forms also include plural forms, as appropriate, unless specifically stated otherwise in the context. In this specification, terms such as “comprise,” “provide,” “provide,” or “have” do not exclude the presence or addition of one or more other components other than the mentioned components.

In this specification, terms such as “or” and “at least one” may represent one of words listed together, or a combination of two or more. For example, “or B” “and at least one of B” may include only A or B, or both A and B.

In this specification, descriptions under “for example” and the like may not exactly match the information presented, such as cited characteristics, variables, or values, and may be subject to tolerances, measurement errors, limits of measurement accuracy and other commonly known factors. Effects such as modifications, including, should not limit the embodiments of the invention according to various embodiments of the present invention.

In this specification, when a component is described as being 'connected' or 'connected' to another component, it may be directly connected or connected to the other component, but other components may exist in between. It must be understood that it may be possible. On the other hand, when a component is mentioned as being 'directly connected' or 'directly connected' to another component, it should be understood that there are no other components in between.

In this specification, when a component is described as being ‘on’ or ‘in contact with’ another component, it may be in direct contact with or connected to the other component, but there may be another component in between. It must be understood that it can be done. On the other hand, if a component is described as being 'right above' or 'in direct contact' with another component, it can be understood that there is no other component in the middle. Other expressions that describe the relationship between components, such as 'between' and 'directly between', can be interpreted similarly.

In this specification, terms such as 'first' and 'second' may be used to describe various components, but the components should not be limited by the above terms. Additionally, the above term should not be interpreted as limiting the order of each component, but may be used for the purpose of distinguishing one component from another component. For example, a 'first component' may be named a 'second component', and similarly, a 'second component' may also be named a 'first component'.

Unless otherwise defined, all terms used in this specification may be used with meanings that can be commonly understood by those skilled in the art to which the present invention pertains. Additionally, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless clearly specifically defined.

Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the attached drawings.

Figure 1 shows a conceptual diagram of the connection between a test device 100 and a target device 200 according to an embodiment of the present invention, and Figure 2 shows a connection diagram of a test device and a target device 100 and 200 according to an embodiment of the present invention. Shows the block configuration diagram.

Referring to FIG. 1, the test device 100 according to an embodiment of the present invention is connected to the target device 200 through serial communication to detect vulnerabilities according to the serial communication protocol applied to the target device 200. It is a testing device.

Meanwhile, unlike the prior art that performs a TCP/IP protocol-based vulnerability testing method, this test device 100 uses a serial communication protocol such as a Modbus RTU (Modbus Remote Terminal Unit) in the target device 200. In this case, a vulnerability testing method is performed to apply to the corresponding serial communication protocol.

In particular, when the serial communication protocol of Modbus RTU is applied, even if abnormal data is transmitted to the target device 200, the target device 200 rejects or deletes the abnormal data, but does not receive the abnormal data. Since most error messages, etc., are not responded to by the sender, it is difficult to apply the vulnerability testing method according to the prior art.

To solve this, the test device 100 is a device for testing vulnerabilities to the serial communication protocol of the Modbus RTU applied to the target device 200, and may be an electronic device capable of computing or a computing network. .

For example, electronic devices include desktop personal computers, laptop personal computers, tablet personal computers, netbook computers, workstations, and personal digital assistants (PDAs). , a smartphone, smartpad, or mobile phone, or an electronic device separately manufactured for vulnerability testing, but is not limited thereto.

Additionally, the target device 200 is a device that is subject to a vulnerability test and is capable of serial communication based on the serial communication protocol of Modbus RTU. For example, the target device 200 may be a device used for various industrial control purposes, such as a programmable logic controller (PLC) device, or a protection relay device including a smart distribution electric device, but is not limited thereto.

These test devices and target devices 100 and 200 may include a communication unit 110, a memory 120, and a control unit 130, as shown in FIG. 2 .

The communication units 110 and 210 are configured to communicate with other devices. That is, the communication unit 110 of the test device 100 and the communication unit 210 of the target device 200 are connected to each other and can perform serial communication based on a serial communication protocol such as Modbus RTU. To this end, the communication units 110 and 210 include components for serial communication. For example, the serial communication configuration may be connected by RS485, RS423, RS422, RS232, or USB, but is not limited thereto.

That is, the communication unit 110 of the test device 100 can transmit attack packets, normal packets, etc. to the communication unit 210 of the target device 200 through serial communication when performing the test method according to the present invention, which will be described later. , Later, a response packet, etc. may be received from the communication unit 210 of the target device 200 through serial communication.

The memories 120 and 220 store various information necessary for the operation of the test device 100 and the target device 200. For example, information stored in the memory 120 of the test device 100 includes existing vulnerability information (Common Vulnerabilities and Exposures, CVE), information about attack packets, information about normal packets, and the test method according to the present invention, which will be described later. Related program information may be included, but is not limited to this. Additionally, information stored in the memory 220 of the target device 200 may include, but is not limited to, information related to various setting values and operations for the target device 200.

For example, the memories 120 and 220 are classified into hard disk type, magnetic media type, CD-ROM (compact disc read only memory), and optical recording media type depending on their type. Media type, Magneto-optical media type, Multimedia card micro type, flash memory type, read only memory type, or RAM type. (random access memory type), etc., but is not limited thereto. Additionally, the memories 120 and 220 may be a cache, a buffer, a main memory, an auxiliary memory, or a separately provided storage system depending on their purpose/location, but are not limited thereto.

The control units 130 and 230 may perform various control operations of the test device 100 and the target device 200. For example, the control unit 130 of the test device 100 controls the operation of the communication unit 110 and memory 120, which are the remaining components of the test device 100, and performs a vulnerability test according to serial communication of the target device 200. In other words, the control unit 130 can control the performance of the test method according to the present invention, which will be described later, using the information stored in the memory 120. In addition, the control unit 230 of the target device 200 Can control unique functions of the target device 200, such as industrial control, while controlling the operations of the remaining components of the target device 200, such as the communication unit 210 and the memory 220.

For example, the control units 130 and 230 may include a hardware processor or a software process executed on the processor, but are not limited thereto.

Meanwhile, the test device 100 and the target device 200 may additionally include an input unit (not shown) or a display unit (not shown).

At this time, the input unit generates input data in response to the user's input and may include various input means. For example, the input unit includes a keyboard, key pad, dome switch, touch panel, touch key, touch pad, and mouse. , menu button, etc., but is not limited thereto.

Additionally, the display unit displays various image data on the screen and may include a non-emissive configuration or an emissive configuration. For example, the display unit may include a light emitting diode (LED), a liquid crystal display (LCD) panel, a light emitting diode (LED) display panel, or an organic light emitting diode (OLED) display panel. , a micro electro mechanical systems (MEMS) display panel, or an electronic paper display panel, but is not limited thereto. Additionally, the display unit may be combined with the input unit and implemented as a touch screen or the like.

FIG. 3 shows a block diagram of the control unit 130 of the test device 100.

Referring to FIG. 3, the control unit 130 of the test device 100 uses an attack packet generation unit 131, a normal packet generation unit 132, and a vulnerability determination unit to control the performance of the test method according to the present invention, which will be described later. It may include part 133. For example, the attack packet generation unit 131, the normal packet generation unit 132, and the vulnerability determination unit 133 may be hardware components of the control unit 130 or may be software processes performed in the control unit 130. It is not limited to this.

Hereinafter, the test method according to an embodiment of the present invention will be described in more detail.

Figure 4 shows a flowchart of a test method according to an embodiment of the present invention.

The test method according to an embodiment of the present invention is a method for testing the vulnerability of the target device 200 due to serial communication in the test device 100 connected to the target device 200 through serial communication, as shown in FIG. 4 As described above, it may include S100 to S300.

S100 is a step in which the attack packet generation unit 131 of the control unit 130 generates an attack packet and transmits it to the communication unit 210 of the target device 200 through the communication unit 110. That is, the attack packet is a packet that changes the settings of the target device 200 or causes the target device 200 to perform a specific operation, and may include normal or abnormal data.

At this time, normal data refers to data where each section of the packet has a value within the normal range allowed depending on the type of the packet. Additionally, abnormal data refers to data where each section of a packet has a value outside the normal range allowed depending on the type of the packet. That is, depending on the type of attack, which will be described later, the attack packet may contain normal data or abnormal data.

For example, abnormal data may occur if the data length section has a value outside the allowed length range, the data section has data of a different length than the data length section, or the data section has a value outside the allowed , a data section may have a data type other than the permitted type, but is not limited to this.

That is, when performing an attack on an existing vulnerability, which will be described later, the attack packet generator 131 may generate an attack packet containing abnormal data. Additionally, when performing a random attack to be described later or a semantic attack to be described later, the attack packet generator 131 may generate an attack packet including normal data or an attack packet including abnormal data.

However, in S100, the attack packet generator 131 may generate and transmit one attack packet or generate and transmit a plurality of attack packets depending on the type of attack, which will be described later. This will be explained in more detail in the random attacks described later.

Thereafter, S200 is a step in which the normal packet generation unit 132 of the control unit 130 generates a normal packet and transmits it to the communication unit 210 of the target device 200 through the communication unit 110. In other words, a normal packet is a packet that changes the setting value of the target device 200 or causes the target device 200 to perform a specific operation but includes normal data. For example, a normal packet transmitted from S200 may be a packet for changing a setting value or performing a specific operation related to the memory address of the memory 220 of the target device 200 that was attacked by an attack packet transmitted from the previous S100. , but is not limited to this. For example, if an attack packet related to the memory address of A in the memory 220 of the target device 200 is transmitted in S100, in S200, the attack packet related to the memory address of A in the memory 220 of the target device 200 is transmitted. Normal packets containing normal data can be transmitted.

However, the target device 200 may be able to respond to a specific type of packet received from the test device 100 according to the specifications of the control unit 230. In this case, the normal packet generator 132 may generate the type of packet responded to from the target device 200 as a normal packet and transmit it.

Afterwards, S300 determines whether the vulnerability determination unit 133 of the control unit 130 is vulnerable to an attack packet of S100 on the target device 200 based on the state of the test device 100 according to the reception of a normal packet of S200. This is the step. That is, if the target device 200 is in an abnormal state, the vulnerability determination unit 133 may determine that the target device 200 is vulnerable to the attack packet of S100. On the other hand, when the target device 200 is in a normal state, the vulnerability determination unit 133 may determine that the target device 200 is not vulnerable to the attack packet of S100.

At this time, the abnormal state of the target device 200 is when the target device 200 stops operating or lags, or the target device 200 responds with abnormal data (i.e., a value outside the allowed range). This may include cases where a response is made with a packet. In particular, this vulnerability determination can be performed in various ways depending on whether the S200 can respond to normal packets.

For example, there are cases where the test device 200 is unable to respond to normal packets from S200 due to the provision of the control unit 230 with low specifications. In this case, if an abnormal state such as an outage or lag phenomenon occurs in the target device 200, the vulnerability determination unit 133 may determine that the target device 200 is vulnerable to the attack packet of S100. On the other hand, if an abnormal state such as outage or lag does not occur in the target device 200 and the target device 200 operates normally, the vulnerability determination unit 133 determines whether the target device 200 responds to the attack packet of S100. It can be judged that there is no vulnerability.

Additionally, due to the provision of a high-specification control unit 230, etc., there are cases where the test device 200 is able to respond to normal packets of S200. In this case, if an abnormal state occurs in which the target device 200 responds with a response packet with abnormal data, the vulnerability determination unit 133 may determine that the target device 200 is vulnerable to the attack packet of S100. there is. On the other hand, if a normal state occurs in which the target device 200 responds with a response packet with normal data, the vulnerability determination unit 133 may determine that the target device 200 is not vulnerable to the attack packet of S100. .

Figure 5 shows the types of attacks performed in the test method according to an embodiment of the present invention.

Meanwhile, in S100, the attack packet generator 131 may generate various attack packets depending on the type of attack and transmit them to the target device 200. At this time, the type of attack packet may be divided depending on the type of attack. That is, referring to FIG. 5, the type of attack may include an existing vulnerability attack, a brute force attack, or a semantic attack. Accordingly, the attack packet generator 131 may select at least one attack type from an attack group consisting of existing vulnerability attacks, random attacks, and semantic attacks and generate an attack packet according to the attack type.

<Exploiting existing vulnerabilities>

An existing vulnerability attack is an attack in which the attack packet generator 131 creates and transmits an attack packet with values related to existing vulnerability information (Common Vulnerabilities and Exposures, CVE) that has been disclosed. That is, the CVE is a list of publicly known security flaws in the serial communication protocol of the target device 200 or Modbus RTU, can be downloaded from a server that provides it, and is already stored in the memory 120.

The attack packet generated with reference to this CVE is a memory address in the memory 220 of the target device 200 that stores information related to changing or operating the setting value of the target device 200, and is a particularly writable memory address (hereinafter, “ It may be a packet related to the “target memory address”).

After S100 according to this existing vulnerability attack is performed, S200 and S300 may be performed sequentially. At this time, when an existing vulnerability attack is performed, there is a relatively high possibility that an abnormal state will occur in the target device 200, so it may be desirable for the control unit 130 to perform a control operation to check vulnerabilities according to the existing vulnerability attack one by one. .

That is, S200 and S300 are performed after S100, which transmits one attack packet for an existing vulnerability attack, is performed, and then S100, which transmits another attack packet for an existing vulnerability attack, is performed, and then S200 and S300 are performed. It can be. This process can be performed for all existing exploits.

<Random attack>

A random attack is an attack in which the attack packet generator 131 generates and transmits a plurality of attack packets by targeting target memory addresses of the memory 220 of the target device 200. At this time, random attacks may be performed on all target memory addresses.

That is, multiple attack packets are generated for one target memory address and transmitted sequentially, and this transmission process is performed for each target memory address in turn. At this time, multiple attack packets transmitted to one target memory address may include abnormal data. After S100 according to this random attack is performed, S200 and S300 may be performed sequentially.

However, not only are there many target memory addresses, but there are also many attack packets for each target memory address. Accordingly, when performing S100, if attack packets of random attacks are transmitted one by one and S200 and S300 are performed separately for each, it may take a considerable amount of time. To improve this, it may be desirable to continuously transmit random attack attack packets to the target device when performing S100.

For example, in order to check vulnerabilities for target memory addresses one by one, S100, which sequentially transmits random attack attack packets targeting one target memory address, is performed, and then S200 and S300 are performed, and then S200 and S300 are performed. S200 and S300 may be performed after S100, which continuously transmits random attack packets targeting a memory address, is performed. This process can be performed for any target memory address.

Alternatively, S200 and S300 are performed after S100, which transmits attack packets of a random attack targeting a plurality of target memory addresses, and then transmits attack packets of a random attack targeting a plurality of other target memory addresses. S200 and S300 may be performed after S100 is performed. This process can be performed for any target memory address.

Alternatively, S200 and S300 may be performed after S100, which transmits random attack packets targeting all target memory addresses, is performed.

Meanwhile, when an abnormal state occurs in S300, the vulnerability determination unit 133 determines that the target device 200 is vulnerable to attack packets resulting from a random attack of S100. However, in this case, it is necessary to specifically check which attack packet among the attack packets resulting from the random attack of S100 has the vulnerability.

To this end, the attack packet generator 131 divides attack packets (that is, attack packets resulting from random attacks with vulnerabilities) transmitted in the previously performed S100 into groups. Thereafter, S100 to S300 are repeatedly performed while transmitting attack packets for each group using attack packets belonging to each group. As a result, the control unit 130 can specifically find and confirm which attack packet has the vulnerability among the attack packets resulting from the random attack with vulnerability.

For example, in attack packets transmitted from S100, the data length section has different values outside the allowed length range, or the data section has data of a different length than the data length section, but the data length section has different lengths. It may have data, the data section may have a different value than the allowed value, or the data section may have a data type other than the permitted type, but the data section may have a different data type, but is not limited to this.

<Semantic attack>

A semantic attack is an attack that targets multiple target memory addresses, creates attack packets for these target memory addresses, and transmits them in various orders to check vulnerabilities according to the transmission order. In other words, even if a vulnerability does not occur in a brute force attack, a vulnerability may occur if the order of the attack on target memory addresses is changed, and a semantic attack is an attack to check such cases.

To this end, the control unit 130 may select (set) a plurality of target memory addresses corresponding to the target of the semantic attack. Of course, this selection may be performed by a user's input through an input unit (not shown).

That is, when a semantic attack is performed, after the target of the semantic attack is selected, attack packets are transmitted in the first order to the target memory addresses of the selected target (e.g., after transmitting the attack packet to the first target memory address) S100 is performed by transmitting an attack packet to the second target memory address, and then S200 and S300 are performed sequentially. Next, attack packets are transmitted to the target memory addresses of the selected target in a second order different from the first order (e.g., after transmitting the attack packet to the second target memory address, attack packets are transmitted to the first target memory address). As a result, S100 is performed, and then S200 and S300 are performed sequentially. In this way, attack packets are transmitted in various orders to the target memory addresses of the selected target, so that vulnerabilities according to the attack order of the target memory addresses can be confirmed.

However, in this semantic attack, each attack packet transmitted for each target memory address in S100 may include abnormal data or normal data.

For example, in one sequence (first sequence or second sequence) of S100, an attack packet of normal data may be transmitted first, and then an attack packet of abnormal data may be transmitted. Alternatively, in one sequence (first sequence or second sequence) of S100, an attack packet of abnormal data may be transmitted first, and then an attack packet of normal data may be transmitted. Alternatively, an attack packet of normal data may be transmitted in the first sequence S100, and an attack packet of abnormal data may be transmitted in the second sequence S100. Alternatively, an attack packet of abnormal data may be transmitted in the first sequence S100, and an attack packet of normal data may be transmitted in the second sequence S100. Alternatively, attack packets of normal data may be transmitted in all S100s of the first and second sequences. Alternatively, attack packets of abnormal data may be transmitted in all S100s of the first and second sequences.

Of course, if all attack packets include normal data, vulnerabilities that occur when the target device 200 performs a plurality of normal operations in various orders according to attack packets of normal data can also be checked.

Figure 6 shows an example of a memory address.

That is, referring to FIG. 6, the target memory addresses of A and X may be selected as the target of a semantic attack. At this time, as a result of performing S200 and S300 after performing S100 in the first order of transmitting the attack packet to A and then transmitting the attack packet to X, no vulnerability occurs. However, if the order is different, after transmitting the attack packet to

For example, when Enter is input after the menu button is input (first order), the target device 200 operates in a normal state, but when the menu button is input after Enter is input (second order), the target device 200 ) may operate in an abnormal state.

To check this abnormal state, a semantic attack can be performed by setting the menu button input operation and the Enter input operation as targets. That is, as a result of performing S200 and S300 after performing S100, which transmits attack packets of normal data for each operation in the first order, the target device 200 operates in a normal state and is therefore vulnerable according to the first order. It is confirmed that there is no . On the other hand, as a result of performing S200 and S300 after performing S100, which transmits attack packets of normal data for each operation in the second order, the target device 200 operates in an abnormal state and is therefore vulnerable according to the second order. It is confirmed that there is.

<Combined attack>

Meanwhile, the test method according to an embodiment of the present invention can perform a complex attack in which at least two attacks are selected from an attack group consisting of an existing vulnerability attack, a random attack stage, and a semantic attack. In the case of such complex attacks, there is an advantage of being able to more closely check vulnerabilities to various setting values or operations of the target device 200.

That is, the control unit 130 performs S100 according to the first attack in the attack group, then sequentially performs S200 and S300, and then performs S100 according to the second attack in the attack group, and then performs S200 and S300. Can be performed sequentially.

For example, the control unit 130 may perform S100 according to an existing vulnerability attack, then sequentially perform S200 and S300, and then perform S100 according to a random attack, and then sequentially perform S200 and S300. Alternatively, the control unit 130 may perform S100 according to a random attack, then sequentially perform S200 and S300, and then perform S100 according to a semantic attack, and then sequentially perform S200 and S300.

If all attacks are performed in the attack group, the control unit 130 performs S100 according to the first attack among the attack group, then sequentially performs S200 and S300, and then performs S100 according to the second attack among the attack group. After performing S100, S200 and S300 can be performed in sequence, and after performing S100 according to the remaining third attack in the attack group, S200 and S300 can be performed in sequence.

For example, the control unit 130 performs S100 according to an existing vulnerability attack, then sequentially performs S200 and S300, then performs S100 according to a random attack, and then sequentially performs S200 and S300, and then After performing S100 according to the semantic attack, S200 and S300 can be performed sequentially.

<Experiment>

An experiment according to the present invention was performed. For this purpose, a test device 100, an embedded system implemented as RTOS (Real Time Operating System) using FreeRTOS, was prepared. In a thread in an RTOS, an application is assigned its own work when executing a test startup. However, because the memory size is small and CPU performance is low, a packet generation module was implemented externally. The generated packet is transmitted to the JIG (middle section) and again to the JIG of the target device 200.

A protection relay device including a smart distribution electrical device was selected as the target device 200. However, among the IED categories, electrical devices with more mesh structures than simple electrical devices (e.g. basic power distribution devices, basic relays, etc.) were selected as the target device 200. The mesh structure means not only a hardware-based implementation, but also an RTOS-based software implementation that uses commands used through HMI.

To test the target device 200 using the Modbus RTU protocol, the target device 200 is connected to the test device 100 using a USB or serial port. When connected, the Ethernet switch inside the test device 100 converts raw packets into acceptable packets.

The vulnerability was confirmed by performing an attack on all writable memory addresses of the target device 200. First, to attack existing vulnerabilities, the attack packet structure was implemented by referring to the list of CVEs published on the exploit-DB website. If no vulnerability is found after performing an existing vulnerability attack referring to this list of CVEs, the test device 100 performs a random attack. During a brute force attack, test device 100 generates Modbus RTU packets that flip the values of each section. If the random attack fails, the test device 100 performs a semantic attack.

These semantic attacks are performed similarly to unit tests. First, the test device 100 selects a target from among writable memory addresses, transmits an attack packet of normal data to the first target of the target device 200, and then transmits an abnormal attack packet to the target of the next address. do. The test device 100 performed a semantic attack on all sequences of cases for the target until there were no attackable memory addresses remaining.

Figure 7 shows details of four vulnerabilities discovered in the experiment of the present invention.

As a result, as shown in Figure 7, a total of 4 vulnerabilities, that is, 1 critical vulnerability and 3 weak vulnerabilities, were discovered. One critical vulnerability occurs in PLC. This vulnerability resulted in dumping of addresses with read-only permissions. Basically, RS485 communication needs to check the data length section when communicating. For this reason, RS485-based communication is difficult to perform buffer overflow attacks. The remaining weak vulnerabilities are related to fast packet sending, and cannot handle more than its own processing capacity. The target device 200 where such an attack occurs cannot accept commands other than the attack packet.

The present invention, configured as described above, can test the vulnerability according to the serial communication of the protocol for a target device connected through serial communication of a protocol such as Modbus RTU, and thus the vulnerability according to the conventional TCP/IP protocol method. There is an advantage in overcoming the limitations of testing. In addition, the present invention performs a complex attack that selects and attacks at least two from an attack group consisting of existing vulnerability attacks, random attack steps, and semantic attacks, to more closely identify vulnerabilities to various setting values or operations of the target device. There are benefits that can be confirmed.

In the detailed description of the present invention, specific embodiments have been described, but of course, various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention is not limited to the described embodiments, but should be defined by the claims described below and equivalents to these claims.

100: test device 200: target device
110, 210: Communication unit 120, 220: Memory
130, 230: Control unit

Claims (12)

A method performed in a test device that is connected to a target device through serial communication and tests vulnerabilities due to serial communication of the target device,
transmitting an attack packet to the target device;
transmitting a normal packet containing a value within an allowed normal range to the target device; and
When an abnormal state of the target device occurs, determining that the target device is vulnerable to the attack packet,
Existing vulnerability attacks that generate and transmit attack packets with values related to existing public vulnerability information (Common Vulnerabilities and Exposures, CVE), and multiple memories of the target device that store information related to the setting values or operation of the target device. A random attack that targets an address and continuously transmits a plurality of attack packets with values that change outside the permitted range, and a plurality of memory addresses of the target device that store information related to the operation of the target device. A method in which at least two attacks selected from an attack group each including semantic attacks that transmit attack packets in different orders are each performed in the step of transmitting the attack packets.
According to paragraph 1,
The serial communication method is communication based on the Modbus RTU (Modbus Remote Terminal Unit) protocol.
According to paragraph 1,
The step of transmitting the attack packet includes sequentially transmitting a plurality of attack packets to the target device,
The determining step includes determining that the target device is vulnerable to the plurality of attack packets when the abnormal state occurs.
According to paragraph 3,
If it is determined that the target device is vulnerable to the plurality of attack packets, dividing the plurality of attack packets into groups and using attack packets belonging to the groups to transmit the attack packets for each group, and transmitting the normal packets to each group. The method further includes the step of finding a vulnerable attack packet among the plurality of attack packets by repeating the transmitting step and the determining step.
According to paragraph 1,
The abnormal state includes a case where the target device stops working or lags, or the target device responds with a response packet with a value outside the allowed range.
delete According to paragraph 1,
The attack packet is abnormal data in which the data length section has a value outside the allowed length range, abnormal data in which the data section has data of a length different from the data length section, and abnormal data in which the data section has a value outside the allowed value. A method in which data, or a section of data, contains abnormal data that has a data type other than the permitted type.
According to paragraph 1,
The method of transmitting the attack packet includes transmitting attack packets for the random attack in different orders.
delete According to paragraph 1,
After the step of transmitting the attack packet according to one attack among the attack group, the step of transmitting the normal packet, and the step of determining are performed,
A method in which the step of transmitting the attack packet according to another attack among the attack group, the step of transmitting the normal packet, and the step of determining are performed.
According to paragraph 1,
Transmitting the attack packet according to one attack among the attack group, transmitting the normal packet, and the determining step are performed,
Thereafter, the step of transmitting the attack packet according to another attack among the attack group, the step of transmitting the normal packet, and the step of determining are performed,
Thereafter, the steps of transmitting the attack packet according to the remaining attack among the attack group, transmitting the normal packet, and the determining step are performed.
A communication unit that performs serial communication with a target device; and
It includes a control unit that controls the operation of the communication unit and controls a vulnerability test according to serial communication of the target device,
The control unit,
After transmitting an attack packet to the target device, control to transmit a normal packet containing a value within a normal range allowed to the target device,
Afterwards, if an abnormal state of the target device occurs, it is determined that the target device is vulnerable to the attack packet,
When transmitting the attack packet, an existing vulnerability attack that generates and transmits an attack packet with values related to existing publicly disclosed vulnerability information (Common Vulnerabilities and Exposures, CVE), and information related to the setting value or operation of the target device. A random attack that generates and continuously transmits multiple attack packets with values that change outside of the permitted range targeting multiple stored memory addresses of the target device, and the target that stores information related to the operation of the target device. A device that controls the execution of at least two attacks selected from a group of attacks, each of which includes a semantic attack that transmits attack packets to a plurality of memory addresses of the device in different orders.