SCADA systems: 15 new HTML reply signatures and examples

There is an incredible variety of things now connected to the Internet from industrial control systems and digital video security systems to printers and VoIP telephone systems. Many of these systems provide a web service via HTTP on port 80. A good deal of information about these devices can be found by looking at the meta-data within a reply from a simple HTTP Get message. The Shodan system scans the Internet to acquire this information and its database now holds the records for millions of IP addresses around the world.

In the tables below I have put together a list of signatures(i.e search strings) that appear in the HTTP meta-data for 15 Supervisory Control and Data Acquisition(SCADA) systems. An additional list of 29 signatures is available in this paper by Cambridge University Master's student E P Leverett, the paper also has a great introduction to SCADA systems.
In the following analysis I follow the same engagement rules as E P Leverett which are from the joint US DHS & UK CPNI good practice guide.

1. I will not interact with any system except to view a publicly accessible HTTP interface.
2. I will not attempt to login to any system.

What sort of SCADA systems are out there? Here are  a couple of examples.

Wastewater overflow management pumping station, Boncourt, Switzerland

The SCADA system on this pump is a Schneider Electric FactoryCast system. According to the user manual.

"FactoryCast is a software package that allows you to customize a Web site on the Embedded Web Server module. The site can be accessed via a browser to view and modify data from a Quantum or Premium programmable logic controller (PLC)."

System home page

Found on Google maps

This small pumping station is used to manage wastewater overflow in the Basse-Allaine region of Switzerland. Wastewater from the town of Boncourt flows through a pipe down to the treatment plant in Grandvilliars,France. But what happens if there is heavy rain? Along the pipe's path are overflow stations which consist of a large underground basin, a pump and a overflow pipe leading to the Allaine river. When it rains the overflow first runs into the basin and the pump returns it to the pipe reducing the flow down the pipe and lessening the chance of overflow to the river. Of course if the rains are heavy enough then the basin will fill and wastewater will overflow into the river.

The installers of the Schneider system, Swiss firm Stebatec, have customized the embedded web site.

1.9MW solar power plant, Mysliv, Czech Republic

This system is running Schneider Electric FactoryCast.

News items give further details on this plant.

"On October 7, Solar Park Mysliv, located in the south-western part of Bohemia, 20 kilometers east of the city of Klatovy, started producing solar electricity. This is the first solar power plant Gehrlicher Solar AG has built in the Czech Republic. The plant has a peak performance of 1.99 MWp and comprises an area of 3.8 hectares. It will be producing 1.79 million kilowatt hours of green electricity and covering the electricity requirements of 510 three-person households. 8.844 Yingli modules and two SMA inverters were used in the construction."
Biomass boiler systems

Unknown HVAC system in Germany

This small HVAC system, running a Saia-Burgess PCD allows anyone level 0 access(the least privileged) which allows viewing of measurements.

Solar power plant, Coppola S.p.A, Scafati, Italy

Coppola is company located in Scafati, it's solar power system was installed by group magaldi.The system allows anyone to view solar plant measurements. It is running a SpiderControl system.

The security of some of these systems can be very weak. I have seen cases of the system login password being shown directly within the HTML source code of the publicly accessible device home page(anyone can view this source code using a browser's view HTML source button).

SCADA systems
System	Signature	Shodan count	Comments
Siemens building automation energy management	Siemens Switzerland Ltd	449	http://www.buildingtechnologies.siemens.com
Beck IPC embedded controller	IPC@CHIP	4038	For example used by Solar plant energy monitor solar-log.net,beck-ipc.com
SMA Solar remote solar plant monitoring/maintenance	Sunny webbox	6675	SMA Solar Sunny webbox
Kieback&Peter Bus Module Controller	BMR/0.09	85	kieback&Peter BMC. Controller for controlling,monitoring & operating HVAC systems.
Saia-Burgess Process Control Device(PCD)	Saia PCD	839	saia-pcd.com,control devices for remote monitoring and machine control
Schneider Electric energy management/monitoring	Schneider-WEB	197	Schneider FactoryCast system
Sciopta system software	sciopta Webserver	2	System Software for Safety-Critical Embedded Applications, sciopta.com
Phoenix contact system running SpiderControl	Phoenix-Contact	155	phoenixcontact.com,spidercontrol.net
Moxa industrial systems	MoxaHttp	4734	moxa.com
Trihedral SCADA software	"Server: VTS"	102	Trihedral VTS
Electro Industries/GaugeTech	EIG Embedded Web Server	118	electroind.com
clearSCADA integrated SCADA host platform	clearSCADA	13	www.clearscada.com
Delta enteliTOUCH	DELTA enteliTOUCH	22	Delta entelitouch system
TAC Xentra control systems	TAC/Xentra	53	Old systems,TAC now owned by Schneider Electric
Loxone home automation system	Loxone	165	Home automation web control system

Links to further reading

SCADA security news and consulting, http://scadahacker.com/
SCADA security analysis, www.reversemode.com
SCADA security consulting firm, www.digitalbond.com
SCADA security consulting firm, www.tofinosecurity.com
US government ICS-CERT, www.us-cert.gov/control_systems/ics-cert
SCADA security consulting firm, www.scadahacker.com
SCADA security consulting firm, www.redtigersecurity.com

Some interesting articles on problems with Moxa systems in the Netherlands.

www.tofinosecurity.com/blog/cyber-security-nightmare-netherlands

The following are in Dutch.

webwereld.nl/nieuws/109526/zeeuwse-gemalen-te-hacken-via-scada-lek---update.html
webwereld.nl/nieuws/109565/scada-bedrijf-xylem-ontkent-kwetsbaarheden.html