KR20230050869A - Vulnerability testing method and apparatus for serial communication apparaus - Google Patents

Abstract

The present invention relates to a vulnerability testing method for a serial communication device and a device thereof. According to an embodiment of the present invention, the testing method is a method performed in a test device that is connected to a target device in a serial communication manner and tests vulnerabilities due to serial communication of the target device. The method comprises the following steps of: transmitting an attack packet to a target device; transmitting a normal packet including a value within an allowed normal range to the target device; and determining that the target device is vulnerable to the attack packet when an abnormal state of the target device occurs.

Description

Vulnerability testing method and apparatus for serial communication device {VULNERABILITY TESTING METHOD AND APPARATUS FOR SERIAL COMMUNICATION APPARAUS}

The present invention relates to a vulnerability testing technology for a serial communication device, and more particularly, to a serial communication of a protocol such as Modbus RTU (Modbus Remote Terminal Unit) for a target device connected by serial communication. It is about techniques for testing vulnerabilities according to

A conventional vulnerability testing method is based on a TCP/IP protocol. That is, after sending a specific TCP/IP protocol packet to a target device having an IP address from a remote location, receiving a response TCP/IP protocol packet and inspecting the received packet, the TCP/IP protocol communication of the target device A vulnerability test was performed according to .

However, in the case of a target device using a serial communication protocol such as Modbus RTU, the aforementioned conventional vulnerability test method cannot be applied. This is because, in the case of a target device using Modbus RTU, when it receives abnormal data, most of them do not respond with an error message, unlike the TCP/IP protocol method.

That is, in the case of a target device to which the Modbus RTU method applied in an actual industrial field is applied, only one-way serial communication (ie, data reception) is basically provided for most types of packets. As a result, even if abnormal data is transmitted to the target device, the target device rejects or deletes the abnormal data, but does not respond to the sender with an error message or the like according to the reception of the abnormal data, so the conventional vulnerability test method This is difficult to apply.

Therefore, there is a need for a new type of vulnerability test technology that can be applied to a target device using a serial communication protocol such as Modbus RTU.

In order to solve the problems of the prior art as described above, the present invention tests the vulnerability according to the serial communication of the corresponding protocol for a target device connected by serial communication of a protocol such as Modbus RTU rather than the TCP/IP protocol method. Its purpose is to provide the technology that can do it.

However, the problem to be solved by the present invention is not limited to the above-mentioned problems, and other problems not mentioned can be clearly understood by those skilled in the art from the description below. There will be.

A method according to an embodiment of the present invention for solving the above problems is a method performed in a test device that is connected to a target device in a serial communication method and tests vulnerabilities according to serial communication of the target device, wherein the target device Transmitting an attack packet to; Transmitting a normal packet including a value within an allowed normal range to the target device; and determining that the target device is vulnerable to the attack packet when an abnormal state of the target device occurs.

The abnormal state may include a case where an operation stoppage phenomenon or a lag phenomenon of the target device occurs, or when the target device responds with a response packet having a value outside the permitted range.

The serial communication may be communication based on a Modbus Remote Terminal Unit (RTU) protocol.

The transmitting of the attack packets may include continuously transmitting a plurality of attack packets to the target device, and the determining step may include transmitting the plurality of attack packets to the target device when the abnormal state occurs. It may include a step of determining that there is a vulnerability to

In the method according to an embodiment of the present invention, when it is determined that the target device is vulnerable to the plurality of attack packets, the plurality of attack packets are divided into groups, and attack packets belonging to the groups are used to perform the attack packets for each group. The method may further include finding an attack packet having a vulnerability among the plurality of attack packets by repeatedly performing the transmitting of the attack packet, the transmitting of the normal packet, and the determining step.

Transmitting the attack packet may include generating and transmitting an attack packet having a value related to the existing information on common vulnerabilities and exposures (CVE).

The transmitting of the attack packets stores setting values or operation-related information of the target device, but generates a plurality of attack packets each having a value that changes outside of the permitted range for all memory addresses of the target device that are writable. and continuously transmitting.

The attack packet includes abnormal data in which the data length section has a value outside the allowed length range, abnormal data in which the data section has data having a length different from that of the data length section, and abnormal data in which the data section has a value outside the allowed value. The data or data section may contain abnormal data having a data type other than the permitted type.

Transmitting the attack packets may include transmitting attack packets to a plurality of writable memory addresses of the target device in a different order while storing setting values or operation-related information of the target device.

An existing vulnerability attack that generates and transmits an attack packet having a value related to existing vulnerability information that has been disclosed, and changes outside the permitted range for all memory addresses of the target device that store information related to the operation of the target device. A random attack that generates and continuously transmits a plurality of attack packets having values, and a semantic attack that transmits attack packets to a plurality of memory addresses of the target device that store information related to the operation of the target device in different order. At least two attacks selected from attack groups each including each attack may be performed in the step of transmitting the attack packet.

Transmitting the attack packet according to any one attack from the attack group, transmitting the normal packet, and performing the determining step, and then transmitting the attack packet according to another attack from the attack group The step of transmitting the normal packet and the step of determining may be performed.

Transmitting the attack packet according to any one attack from the attack group, transmitting the normal packet, and performing the determining step, and then transmitting the attack packet according to another attack from the attack group carrying out the steps of transmitting the normal packet, transmitting the normal packet, and determining the attack packet, and then transmitting the attack packet according to the attack of the other one of the attack group, transmitting the normal packet, and determining the attack packet. can be performed.

An apparatus according to an embodiment of the present invention includes a communication unit that performs serial communication with a target device; and a controller controlling a vulnerability test according to serial communication of the target device while controlling an operation of the communication unit.

After transmitting the attack packet to the target device, the control unit may control to transmit a normal packet including a value within an allowed normal range to the target device, and then stop or lag the target device. If this occurs or the device responds with a response packet having a value outside the permitted range, it may be determined that the target device has vulnerability to the attack packet.

The present invention configured as described above can test the vulnerability according to the serial communication of the corresponding protocol for the target device connected to the serial communication of the protocol method such as Modbus RTU, and the vulnerability test according to the conventional TCP/IP protocol method There are advantages to overcoming the limitations of

In addition, the present invention performs a complex attack in which at least two are selected and attacked from an attack group consisting of an existing vulnerability attack, a random attack step, and a semantic attack, thereby more closely examining the vulnerability of various setting values or operations of the target device. There are benefits that can be identified.

The effects obtainable in the present invention are not limited to the effects mentioned above, and other effects not mentioned can be clearly understood by those skilled in the art from the description below. will be.

1 shows a connection conceptual diagram between a test device 100 and a target device 200 according to an embodiment of the present invention.
2 shows a block diagram of a test device and a target device 100 or 200 according to an embodiment of the present invention.
3 shows a block configuration diagram of the control unit 130 of the test device 100.
4 shows a flow chart of a test method according to an embodiment of the present invention.
5 shows types of attacks performed in a test method according to an embodiment of the present invention.
6 shows an example of a memory address.
7 shows the contents of the four vulnerabilities found in the experiment of the present invention.

The above objects and means of the present invention and the effects thereof will become clearer through the following detailed description in conjunction with the accompanying drawings, and accordingly, those skilled in the art to which the present invention belongs can easily understand the technical idea of the present invention. will be able to carry out. In addition, in describing the present invention, if it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted.

Terms used in this specification are for describing the embodiments and are not intended to limit the present invention. In this specification, singular forms also include plural forms in some cases unless otherwise specified in the text. In this specification, terms such as "comprise", "have", "provide" or "have" do not exclude the presence or addition of one or more other elements other than the mentioned elements.

In this specification, terms such as “or” and “at least one” may represent one of the words listed together, or a combination of two or more. For example, "or B" and "at least one of B" may include only one of A or B, or may include both A and B.

In this specification, descriptions following "for example" may not exactly match the information presented, such as cited characteristics, variables, or values, and tolerances, measurement errors, limits of measurement accuracy and other commonly known factors It should not be limited to the embodiments of the present invention according to various embodiments of the present invention with effects such as modifications including.

In this specification, when a component is described as being 'connected' or 'connected' to another component, it may be directly connected or connected to the other component, but there may be other components in the middle. It should be understood that it may be On the other hand, when a component is referred to as 'directly connected' or 'directly connected' to another component, it should be understood that no other component exists in the middle.

In the present specification, when an element is described as being 'on' or 'in contact with' another element, it may be in direct contact with or connected to the other element, but another element may be present in the middle. It should be understood that On the other hand, if an element is described as being 'directly on' or 'directly in contact with' another element, it may be understood that another element in the middle does not exist. Other expressions describing the relationship between components, such as 'between' and 'directly between', can be interpreted similarly.

In this specification, terms such as 'first' and 'second' may be used to describe various elements, but the elements should not be limited by the above terms. In addition, the above terms should not be interpreted as limiting the order of each component, and may be used for the purpose of distinguishing one component from another. For example, a 'first element' may be named a 'second element', and similarly, a 'second element' may also be named a 'first element'.

Unless otherwise defined, all terms used in this specification may be used in a meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless explicitly specifically defined.

Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

1 shows a conceptual diagram of a connection between a test device 100 and a target device 200 according to an embodiment of the present invention, and FIG. Shows the block diagram.

Referring to FIG. 1 , a test device 100 according to an embodiment of the present invention is connected to a target device 200 in a serial communication method to detect vulnerabilities according to a serial communication protocol applied to the target device 200. It is a test device.

On the other hand, unlike the prior art that performs a vulnerability test method based on the TCP/IP protocol, the present test device 100 uses a serial communication protocol such as Modbus RTU (Modbus Remote Terminal Unit) when the target device 200 is used. In this case, a vulnerability test method to be applied to the corresponding serial communication protocol is performed.

In particular, when the serial communication protocol of Modbus RTU is applied, even if abnormal data is transmitted to the target device 200, the target device 200 rejects or deletes the abnormal data, but is unable to receive the abnormal data. Since most of the error messages and the like according to the transmission side do not respond, it is difficult to apply the vulnerability test method according to the prior art.

In order to solve this problem, the present test device 100 is a device for testing vulnerabilities in the serial communication protocol of the Modbus RTU applied to the target device 200, and may be an electronic device capable of computing or a computing network. .

For example, the electronic device includes a desktop personal computer, a laptop personal computer, a tablet personal computer, a netbook computer, a workstation, and a personal digital assistant (PDA). , a smartphone, a smartpad, or a mobile phone, or a separately manufactured electronic device for vulnerability testing, but is not limited thereto.

In addition, the target device 200 is a device subject to vulnerability testing, and is a device capable of serial communication based on a serial communication protocol of Modbus RTU. For example, the target device 200 may be a device used for various industrial controls such as a programmable logic controller (PLC) device, or a protection relay device including a smart distribution electric device, but is not limited thereto.

As shown in FIG. 2 , the test device and the target device 100 or 200 may include a communication unit 110 , a memory 120 , and a control unit 130 .

The communication units 110 and 210 are components that communicate with other devices. That is, the communication unit 110 of the test device 100 and the communication unit 210 of the target device 200 may be connected to each other to perform serial communication based on a serial communication protocol such as Modbus RTU. To this end, the communication units 110 and 210 include components for serial communication. For example, the serial communication configuration may be connected in an RS485, RS423, RS422, RS232 or USB method, but is not limited thereto.

That is, the communication unit 110 of the test device 100 can transmit attack packets, normal packets, etc. to the communication unit 210 of the target device 200 in a serial communication method when performing a test method according to the present invention, which will be described later. , Afterwards, a response packet or the like may be received in a serial communication method from the communication unit 210 of the target device 200.

The memories 120 and 220 store various types of information necessary for the operation of the test device 100 and the target device 200 . For example, the storage information of the memory 120 of the test apparatus 100 includes existing vulnerability information (Common Vulnerabilities and Exposures, CVE), information on attack packets, information on normal packets, and the test method according to the present invention to be described later Related program information may be included, but is not limited thereto. In addition, information stored in the memory 220 of the target device 200 may include information related to various setting values and operations of the target device 200, but is not limited thereto.

For example, the memories 120 and 220 may be a hard disk type, a magnetic media type, a compact disc read only memory (CD-ROM), and an optical recording medium type according to their type. Media type), Magneto-optical media type, Multimedia card micro type, flash memory type, read only memory type, or RAM type (random access memory type), etc., but is not limited thereto. In addition, the memories 120 and 220 may be caches, buffers, main storage devices, auxiliary storage devices, or separately provided storage systems depending on their use/location, but are not limited thereto.

The controllers 130 and 230 may perform various control operations of the test device 100 and the target device 200 . For example, the control unit 130 of the test device 100 performs a vulnerability test according to serial communication of the target device 200 while controlling operations of the communication unit 110 and the memory 120, which are the other components of the test device 100. That is, the control unit 130 can control the execution of a test method according to the present invention, which will be described later, using information stored in the memory 120. In addition, the control unit 230 of the target device 200 can control unique functions of the target device 200, such as industrial control, while controlling operations of the communication unit 210 and the memory 220, which are the other components of the target device 200.

For example, the controllers 130 and 230 may include a processor that is hardware or a process that is software executed in the corresponding processor, but is not limited thereto.

Meanwhile, the test device 100 and the target device 200 may additionally include an input unit (not shown) or a display unit (not shown).

At this time, the input unit generates input data in response to a user's input, and may include various input means. For example, the input unit may include a keyboard, a key pad, a dome switch, a touch panel, a touch key, a touch pad, and a mouse. , a menu button, and the like, but is not limited thereto.

In addition, the display unit displays various image data on a screen, and may include a non-emission-type configuration or a light-emission-type configuration. For example, the display unit may include a light emitting diode (LED), a liquid crystal display (LCD) panel, a light emitting diode (LED) display panel, and an organic LED (OLED) display panel. , a micro electro mechanical systems (MEMS) display panel, or an electronic paper display panel, but is not limited thereto. Also, the display unit may be combined with the input unit and implemented as a touch screen or the like.

3 shows a block configuration diagram of the control unit 130 of the test device 100.

Referring to FIG. 3 , the control unit 130 of the test apparatus 100 includes an attack packet generator 131, a normal packet generator 132, and vulnerability determination in order to control the execution of a test method according to the present invention, which will be described later. Part 133 may be included. For example, the attack packet generation unit 131, the normal packet generation unit 132, and the vulnerability determination unit 133 may be hardware configurations of the control unit 130 or may be software processes executed by the control unit 130, It is not limited to this.

Hereinafter, a test method according to an embodiment of the present invention will be described in more detail.

4 shows a flow chart of a test method according to an embodiment of the present invention.

A test method according to an embodiment of the present invention is a method for testing vulnerabilities according to serial communication of a target device 200 in a test device 100 connected to the target device 200 in a serial communication method, as shown in FIG. As described above, it may include S100 to S300.

S100 is a step in which the attack packet generation unit 131 of the control unit 130 generates an attack packet and transmits the attack packet to the communication unit 210 of the target device 200 through the communication unit 110 . That is, the attack packet is a packet that changes the setting value of the target device 200 or causes the target device 200 to perform a specific operation, and may include normal data or abnormal data.

At this time, normal data refers to data in the case where each section of a packet has a value within a normal range allowed according to the type of the corresponding packet. Also, abnormal data refers to data in the case where each section of a packet has a value outside of the normal range allowed according to the type of the corresponding packet. That is, the attack packet may include normal data or abnormal data according to the type of attack to be described later.

For example, abnormal data means that the data length section has a value outside the allowed length range, but the data section has data of a different length from the data length section, or the data section has a value outside the allowed value range, or , the data section may have a data type other than the allowed type, but is not limited thereto.

That is, when performing an attack on existing vulnerabilities to be described later, the attack packet generating unit 131 may generate an attack packet including abnormal data. Also, when a random attack described later or a semantic attack described later is performed, the attack packet generation unit 131 may generate an attack packet including normal data or an attack packet including abnormal data.

However, in S100, the attack packet generation unit 131 may generate and transmit one attack packet or generate and transmit a plurality of attack packets according to the type of attack to be described later. This will be explained in more detail in a random attack to be described later.

Thereafter, S200 is a step in which the normal packet generation unit 132 of the control unit 130 generates a normal packet and transmits the normal packet to the communication unit 210 of the target device 200 through the communication unit 110 . That is, the normal packet is a packet that changes the setting value of the target device 200 or causes the target device 200 to perform a specific operation, but includes normal data. For example, the normal packet transmitted in S200 may be a packet for changing the setting value related to the memory address of the memory 220 of the target device 200 attacked by the previous attack packet transmitted in S100 or for performing a specific operation. , but is not limited thereto. For example, when an attack packet related to the memory address of A in the memory 220 of the target device 200 is transmitted in S100, in S200, the attack packet related to the memory address of A in the memory 220 of the target device 200 is transmitted. Normal packets containing normal data can be transmitted.

However, the target device 200 may respond to a specific type of packet received from the test device 100 according to the specifications of the control unit 230 . In this case, the normal packet generation unit 132 may generate and transmit a packet of a type that is responded to by the target device 200 as a normal packet.

Thereafter, in S300, the vulnerability determination unit 133 of the control unit 130 determines whether the attack packet of S100 is vulnerable to the target device 200 based on the state of the test device 100 according to the reception of the normal packet of S200. It is a step to That is, when the target device 200 is in an abnormal state, the vulnerability determination unit 133 may determine that the target device 200 is vulnerable to the attack packet of S100. On the other hand, when the target device 200 is in a normal state, the vulnerability determination unit 133 may determine that the target device 200 has no vulnerability to the attack packet of S100.

At this time, the abnormal state of the target device 200 is a response in which the target device 200 stops or lags, or the target device 200 has abnormal data (ie, a value outside the permitted range). It may include a case of responding with a packet. In particular, such vulnerability determination may be performed in various ways depending on whether a response to a normal packet in S200 is possible.

For example, there is a case in which the test device 200 cannot respond to the normal packet of S200 due to the low specification of the control unit 230 . In this case, when an abnormal state such as a shutdown phenomenon or a lag phenomenon occurs in the target device 200, the vulnerability determining unit 133 may determine that the target device 200 is vulnerable to the attack packet of S100. On the other hand, if the target device 200 does not have an abnormal state such as downtime or lag and the target device 200 operates normally, the vulnerability determination unit 133 determines that the target device 200 responds to the attack packet of S100. It can be judged that there is no vulnerability.

In addition, there is a case where the test device 200 can respond to the normal packet of S200 due to the provision of the control unit 230 with high specifications. In this case, if an abnormal state in which the target device 200 responds with a response packet having abnormal data occurs, the vulnerability determining unit 133 may determine that the target device 200 is vulnerable to the attack packet of S100. there is. On the other hand, if a normal state in which the target device 200 responds with a response packet having normal data occurs, the vulnerability determining unit 133 may determine that the target device 200 has no vulnerability to the attack packet of S100. .

5 shows types of attacks performed in a test method according to an embodiment of the present invention.

Meanwhile, in S100, the attack packet generation unit 131 may generate various attack packets according to the type of attack and transmit them to the target device 200. At this time, the types of attack packets may also be divided according to the types of attacks. That is, referring to FIG. 5 , the type of attack may include an existing vulnerability attack, a random attack, or a semantic attack. Accordingly, the attack packet generation unit 131 may select at least one attack type from an attack group consisting of existing vulnerability attacks, random attacks, and semantic attacks, and generate an attack packet according to the corresponding attack type.

<Existing Vulnerability Attack>

The existing vulnerability attack is an attack in which the attack packet generation unit 131 generates and transmits an attack packet having a value related to existing vulnerability information (Common Vulnerabilities and Exposures, CVE) that has been disclosed. That is, the CVE is a publicly known security defect list for the serial communication protocol of the target device 200 or the Modbus RTU, and is downloadable from a server providing it and pre-stored in the memory 120.

The attack packet generated by referring to these CVEs is a memory address that stores information related to the change of setting values or operation of the target device 200 in the memory 220 of the target device 200, and particularly a writable memory address (hereinafter referred to as “ It may be a packet related to a target memory address”).

After S100 according to the existing vulnerability attack is performed, S200 and S300 may be sequentially performed. At this time, when an existing vulnerability attack is performed, since the possibility of an abnormal state occurring in the target device 200 is relatively high, it may be desirable for the control unit 130 to perform a control operation to check vulnerabilities according to the existing vulnerability attack one by one. .

That is, after S100, which transmits one attack packet for the existing vulnerability attack, is performed, S200 and S300 are performed, and then S100, which transmits another attack packet for the existing vulnerability attack, is performed, and then S200 and S300 are performed. It can be. This process can be performed for all existing vulnerability attacks.

<Random attack>

A random attack is an attack in which the attack packet generation unit 131 targets target memory addresses of the memory 220 of the target device 200 and generates and transmits a plurality of attack packets intensively. At this time, a random attack may be performed on all target memory addresses.

That is, a plurality of attack packets are generated for one target memory address and continuously transmitted, and this transmission process is performed in turn for each target memory address. At this time, a plurality of attack packets transmitted for one target memory address may include abnormal data. After S100 according to the random attack is performed, S200 and S300 may be sequentially performed.

However, there are not only many target memory addresses, but also many attack packets for each target memory address. Accordingly, when performing S100, attack packets of the random attack are transmitted one by one, and S200 and S300 are separately performed for each, it may take a considerable amount of time. To improve this, it may be desirable to continuously transmit attack packets of random attacks to the target device when performing S100.

For example, in order to check vulnerabilities on a target memory address one by one, S100 is performed to continuously transmit attack packets of a random attack targeting one target memory address, and then S200 and S300 are performed, and then another target S200 and S300 may be performed after S100 of sequentially transmitting attack packets of a random attack targeting a memory address. This process can be performed for all target memory addresses.

Alternatively, after S100 in which attack packets of a random attack targeting a plurality of target memory addresses are transmitted, S200 and S300 are performed, and then attack packets of a random attack targeting a plurality of other target memory addresses are transmitted. After S100 is performed, S200 and S300 may be performed. This process can be performed for all target memory addresses.

Alternatively, S200 and S300 may be performed after S100 in which attack packets of a brute force attack targeting all target memory addresses are transmitted.

Meanwhile, when an abnormal state occurs in S300, the vulnerability determining unit 133 determines that the target device 200 is vulnerable to attack packets according to the random attack of S100. However, in this case, it is necessary to specifically check which attack packet has a vulnerability among attack packets according to the random attack of S100.

To this end, the attack packet generation unit 131 divides the attack packets (ie, attack packets according to random attacks with vulnerabilities) transmitted in the previous operation S100 into groups. Thereafter, steps S100 to S300 are repeatedly performed while transmitting attack packets for each group using attack packets belonging to each group. As a result, the control unit 130 can specifically find and confirm which attack packet has a vulnerability among attack packets according to a random attack having a vulnerability.

For example, in the attack packets transmitted in S100, the data length section has a different value outside the allowed length range, or the data section has data of a different length than the data length section but has a different length It may have data, the data section may have a different value other than the permitted value, or the data section may have a data type other than the permitted data type but may have different data types, but is not limited thereto.

<Semantic Attack>

A semantic attack is an attack that identifies vulnerabilities according to the transmission order by targeting a plurality of target memory addresses, generating attack packets for these target memory addresses, and transmitting them in various orders. That is, even if a vulnerability does not occur in a random attack, there may be a case where a vulnerability occurs when the order of attacks on target memory addresses is changed, and a semantic attack is an attack to check such a case.

To this end, the controller 130 may select (set) a plurality of target memory addresses corresponding to the target of the semantic attack. Of course, such selection may be performed by a user's input through an input unit (not shown).

That is, when a semantic attack is performed, after a target of the semantic attack is selected, attack packets are transmitted in the first order to the target memory addresses of the selected target (eg, after transmitting the attack packet to the first target memory address) The attack packet is transmitted to the second target memory address) to perform S100, and then S200 and S300 are sequentially performed. Next, attack packets are transmitted to the target memory addresses of the selected target in a second order different from the first order (eg, attack packets to the first target memory address after transmission to the second target memory address). By doing so, S100 is performed, and then S200 and S300 are sequentially performed. In this way, attack packets are transmitted in various orders to the target memory addresses of the selected target, and vulnerabilities according to the attack order of the target memory addresses of the target can be identified.

However, in this semantic attack, each attack packet transmitted to each target memory address of the target in S100 may include abnormal data or normal data.

For example, in S100 of one sequence (first sequence or second sequence), an attack packet of normal data may be transmitted first, and then an attack packet of abnormal data may be transmitted. Alternatively, in S100 of one sequence (first sequence or second sequence), an attack packet of abnormal data may be transmitted first, and then an attack packet of normal data may be transmitted. Alternatively, an attack packet of normal data may be transmitted in the first sequence S100, and an attack packet of abnormal data may be transmitted in the second sequence S100. Alternatively, an attack packet of abnormal data may be transmitted in the first sequence S100, and an attack packet of normal data may be transmitted in the second sequence S100. Alternatively, attack packets of normal data may be transmitted in all S100 of the first order and the second order. Alternatively, an attack packet of abnormal data may be transmitted in all S100 of the first order and the second order.

Of course, when all attack packets include normal data, it is also possible to check vulnerabilities that occur when the target device 200 performs a plurality of normal operations in various orders according to attack packets of normal data.

6 shows an example of a memory address.

That is, referring to FIG. 6 , target memory addresses of A and X may be selected as targets of a semantic attack. At this time, as a result of performing S200 and S300 after performing S100 of the first sequence of transmitting the attack packet for X after transmitting the attack packet for A, vulnerability does not occur. However, vulnerability may occur as a result of performing S200 and S300 after performing S100 of the second order in which the attack packet for X is transmitted and then the attack packet for A is transmitted in a different order.

For example, when Enter is input after entering the menu button (first sequence), the target device 200 operates in a normal state, but when the menu button is input after Enter is input (second sequence), the target device 200 ) may operate in an abnormal state.

To check this abnormal state, a semantic attack can be performed by setting a menu button input operation and an Enter input operation as targets. That is, as a result of performing S200 and S300 after performing S100 for transmitting attack packets of normal data for each operation of the first order, the target device 200 operates in a normal state, and thus the vulnerability according to the first order is confirmed to be absent. On the other hand, as a result of performing S200 and S300 after performing S100 for transmitting attack packets of normal data for each operation of the second order, the target device 200 operates in an abnormal state, and thus, the vulnerability according to the second order It is confirmed that there is

<Compound Attack>

Meanwhile, the test method according to an embodiment of the present invention may perform a complex attack in which at least two are selected and attacked from an attack group consisting of an existing vulnerability attack, a random attack step, and a semantic attack. In the case of such a complex attack, there is an advantage in being able to more closely check vulnerabilities for various setting values or operations of the target device 200 .

That is, the control unit 130 performs S100 according to the first attack in the attack group, then performs S200 and S300 sequentially, and then performs S100 according to the second attack in the attack group, and then performs S200 and S300. can be done sequentially.

For example, the controller 130 may perform S100 according to an existing vulnerability attack, then sequentially perform S200 and S300, and then perform S100 according to a random attack and then sequentially perform S200 and S300. Alternatively, the control unit 130 may perform S100 according to a random attack, then sequentially perform S200 and S300, and then perform S100 according to a semantic attack and then sequentially perform S200 and S300.

If all attacks are performed in the attack group, the control unit 130 performs S100 according to the first attack in the attack group, then sequentially performs S200 and S300, and then performs another second attack in the attack group. After performing S100, S200 and S300 are sequentially performed, and after performing S100 according to the remaining third attack in the attack group, S200 and S300 may be sequentially performed.

For example, the controller 130 performs S100 according to the existing vulnerability attack, then sequentially performs S200 and S300, and then performs S100 according to the random attack, then sequentially performs S200 and S300, and then After performing S100 according to the semantic attack, S200 and S300 may be sequentially performed.

<Experiment>

An experiment according to the present invention was carried out. To this end, a test device 100, which is an embedded system implemented as a Real Time Operating System (RTOS) using FreeRTOS, was prepared. In the thread of the RTOS, the application is assigned its task when executing the test startup. However, since the memory size is small and the CPU performance is low, a packet generation module was implemented externally. The generated packet is transmitted to a middle section (JIG) and transmitted to the JIG of the target device 200 again.

A protection relay device including a smart distribution electric device was selected as the target device 200 . However, among the IED categories, electric devices having more mesh structures than simple electrical devices (eg, basic distributors, basic relays, etc.) are selected as the target device 200 . The mesh structure means hardware-based implementation as well as RTOS-based software implementation using commands used through HMI.

To test the target device 200 using the Modbus RTU protocol, the target device 200 is connected to the test device 100 using a USB or serial port. Upon connection, the Ethernet switch inside the test device 100 converts raw packets into acceptable packets.

While performing an attack on all writable memory addresses of the target device 200, the vulnerability was confirmed. First, for attacking existing vulnerabilities, the attack packet structure was implemented by referring to the CVE list disclosed on the exploit-DB website. If a vulnerability is not found after performing an existing vulnerability attack referring to such a CVE list, the test device 100 performs a random attack. During a brute force attack, the test rig 100 generates Modbus RTU packets that invert each section value. If the brute force attack fails, the test device 100 performs a semantic attack.

These semantic attacks are performed similarly to unit tests. First, the test device 100 selects a target among writable memory addresses, transmits an attack packet of normal data to the first target of the target device 200, and then transmits an abnormal attack packet to the target of the next address. do. The test device 100 performed a semantic attack on the target in all cases in sequence until there were no attackable memory addresses remaining.

7 shows the contents of the four vulnerabilities found in the experiment of the present invention.

As a result, as shown in FIG. 7 , a total of four vulnerabilities, that is, one critical vulnerability and three weak vulnerabilities were found. One critical vulnerability occurs in PLCs. This vulnerability resulted in dumping of read-only addresses. Basically, RS485 communication needs to check the data length section when communicating. For this reason, RS485-based communication is difficult to perform buffer overflow attacks. The remaining weaker vulnerabilities are related to fast packet sending, and cannot be processed beyond their own processing capacity. The target device 200 where such an attack has occurred cannot accept commands other than attack packets.

The present invention configured as described above can test the vulnerability according to the serial communication of the corresponding protocol for the target device connected to the serial communication of the protocol method such as Modbus RTU, so that the vulnerability according to the conventional TCP/IP protocol method There are advantages to overcoming the limitations of testing. In addition, the present invention performs a complex attack in which at least two are selected and attacked from an attack group consisting of an existing vulnerability attack, a random attack step, and a semantic attack, thereby more closely examining the vulnerability of various setting values or operations of the target device. There are benefits to check.

In the detailed description of the present invention, specific embodiments have been described, but various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention is not limited to the described embodiments, and should be defined by the following claims and equivalents thereof.

100: test device 200: target device
110, 210: communication unit 120, 220: memory
130, 230: control unit

Claims (12)

A method performed in a test device connected to a target device in a serial communication method to test vulnerabilities according to serial communication of the target device,
Transmitting an attack packet to the target device;
Transmitting a normal packet including a value within an allowed normal range to the target device; and
determining that the target device is vulnerable to the attack packet when an abnormal state of the target device occurs;
How to include.
According to claim 1,
Wherein the serial communication is communication based on Modbus RTU (Modbus Remote Terminal Unit) protocol.
According to claim 1,
The transmitting of the attack packets includes sequentially transmitting a plurality of attack packets to the target device,
The determining step includes determining that the target device is vulnerable to the plurality of attack packets when the abnormal state occurs.
According to claim 3,
When it is determined that the target device is vulnerable to the plurality of attack packets, dividing the plurality of attack packets into groups and transmitting the attack packets for each group using attack packets belonging to the groups, The method further comprising finding an attack packet having a vulnerability among the plurality of attack packets by repeatedly performing the transmitting and determining steps.
According to claim 1,
The step of transmitting the attack packet includes generating and transmitting an attack packet having a value related to existing vulnerability information (Common Vulnerabilities and Exposures, CVE) that has been disclosed.
According to claim 1,
The transmitting of the attack packets stores setting values or operation-related information of the target device, but generates a plurality of attack packets each having a value that changes outside of the permitted range for all memory addresses of the target device that are writable. and continuously transmitting.
According to claim 6,
The attack packet includes abnormal data in which the data length section has a value outside the allowed length range, abnormal data in which the data section has data having a length different from that of the data length section, and abnormal data in which the data section has a value outside the allowed value. How data, or sections of data, contain abnormal data having a data type other than the allowed type.
According to claim 1,
The transmitting of the attack packets includes transmitting attack packets to a plurality of writable memory addresses of the target device in a different order while storing setting values or information related to operation of the target device.
According to claim 1,
An existing vulnerability attack that generates and transmits an attack packet having a value related to existing vulnerability information that has been disclosed, and changes outside the permitted range for all memory addresses of the target device that store information related to the operation of the target device. A random attack that generates and continuously transmits a plurality of attack packets having values, and a semantic attack that transmits attack packets to a plurality of memory addresses of the target device that store information related to the operation of the target device in different order. A method in which at least two attacks selected from attack groups each including an attack are respectively performed in the step of transmitting the attack packet.
According to claim 9,
After the step of transmitting the attack packet according to any one attack from the attack group, the step of transmitting the normal packet, and the step of determining are performed,
The method of transmitting the attack packet according to another attack from the attack group, transmitting the normal packet, and determining the attack.
According to claim 9,
The step of transmitting the attack packet according to any one attack from the attack group, the step of transmitting the normal packet, and the step of determining are performed,
Thereafter, the step of transmitting the attack packet according to another attack from the attack group, the step of transmitting the normal packet, and the step of determining are performed,
Then, the step of transmitting the attack packet according to the other attack from the attack group, the step of transmitting the normal packet, and the step of determining are performed.
a communication unit that performs serial communication with a target device; and
A control unit controlling a vulnerability test according to serial communication of the target device while controlling an operation of the communication unit;
The control unit,
After transmitting the attack packet to the target device, control to transmit a normal packet including a value within the allowed normal range to the target device, and then, when the target device stops operating or a lag phenomenon occurs, or the target device A device that determines that the target device has a vulnerability to the attack packet when it responds with a response packet having a value outside the allowed range.

Images