论文标题
技术报告：在20秒内走 - 西门子HMIS中密码漏洞的概述
Technical Report: Gone in 20 Seconds -- Overview of a Password Vulnerability in Siemens HMIs
论文作者
论文摘要
西门子生产一系列工业人机界面（HMI）屏幕，使操作员既可以查看有关物理过程的信息和控制物理过程。对于操作员无法物理访问屏幕的方案，Siemens在HMIS上提供SM@rtserver功能，当激活后，该功能通过其自己的SM@rtclient应用程序或第三方VNC客户端软件提供远程访问。通过分析该服务器，我们发现缺乏针对基本设备上的蛮力密码攻击的保护。在包括蛮力保护机制的高级设备上，我们发现了一种攻击者策略，该策略能够逃避该机制，允许无限制的密码猜测尝试，对猜测的影响最小。该漏洞已分配了两个CVE-CVE-2020-15786和CVE-2020-157867。在本报告中，我们概述了这种脆弱性，讨论成功的剥削的影响，并提出缓解以保护这种脆弱性。该报告伴随着Cpsiotsec 2020的演示。
Siemens produce a range of industrial human machine interface (HMI) screens which allow operators to both view information about and control physical processes. For scenarios where an operator cannot physically access the screen, Siemens provide the SM@rtServer features on HMIs, which when activated provides remote access either through their own Sm@rtClient application, or through third party VNC client software. Through analysing this server, we discovered a lack of protection against brute-force password attacks on basic devices. On advanced devices which include a brute-force protection mechanism, we discovered an attacker strategy that is able to evade the mechanism allowing for unlimited password guess attempts with minimal effect on the guess rate. This vulnerability has been assigned two CVEs - CVE-2020-15786 and CVE-2020-157867. In this report, we provide an overview of this vulnerability, discuss the impact of a successful exploitation and propose mitigations to provide protection against this vulnerability. This report accompanies a demo presented at CPSIoTSec 2020.
