Water, electricity, transportation—all of them are critical infrastructures. In Germany, everything classified as part of a critical infrastructure has to conform to security and safety guidelines. I had some nightmares^Wexperiences with these in the past. And I decided to only work on projects classified as critical infrastructure if I could do defensive research, despite being a mostly offensive security researcher. This blog post outlines why offensive critical infrastructure research is a bad idea, and is also a long rant about an article that will be released in a German magazine on December 19th. Sorry for ranting!!!!1!11

Critical infrastructure security

Critical infrastructure is regulated and has to follow various certifications. Disclaimer, I'm not an expert on this. However, certifications are both good and bad:

• Everything classified as critical infrastructure has to pass various tests, ensuring it is safe and secure.
• Such tests are limited in scope and prevent the ability to roll out fixes in a timely manner.

Components might be installed and never changed for decades. This shouldn't be a problem in theory, because why should something tested to be secure suddenly become insecure?

Cryptographic algorithms tend to break over time. They rely on computationally hard problems but computation power increases and there could be new approaches to solve them more efficiently. Attacker capabilities change over time. Software-defined radios are affordable these days and suddenly everything transmitted over-the-air can be sniffed, modified, and injected. Underlying software contains unknown bugs that are discovered later. Suddenly, components within the network infrastructure become insecure and require updates. Just to provide a few examples.

In practice, rolling out something that is classified as critical infrastructure might take so long that it is already outdated when it goes live. 👻🎉

Imagine a system that was installed during the last 30 years. Now, a security researcher finds out that it can be attacked. The vendor of this system might be able to create a new generation of devices, re-certify everything, and so on. This already takes a long time. And even worse, system components might now be incompatible. But replacing everything at once costs so much that neither the vendor nor the customer could pay this. The update process will probably take another 10 years, keeping fingers crossed that there is no new security flaw meanwhile.

So, when approaching critical infrastructure security research, ask yourself:

German electronic health card terminals

In Germany, every public health patient has an electronic health card (eGK), and every doctor has a special permission card (HBA). Both are put into a card terminal, and there is an additional authorization step with a PIN. Manipulation of these card terminals might allow tampering with health data, invoices, or prescriptions. Even though these card terminals are just an end point within a more complex ecosystem, they're classified as critical infrastructure. Their protection level requires that they should withstand physical manipulation attempts without special equipment for 10 minutes.

The roll-out of this system wasn't smooth. Doctors were forced to join this system by making them pay additional costs if they refused to join. Oh, and someone decided to install non-replaceable cryptographic certificates on some of the devices that will expire after 5 years... 🙈

I agree that these card terminals should be classified as critical infrastructure. Imagine something like a network-based attack that simultaneously disables all of them. This would require processing everything on paper, slow everything down, etc. and be a risk to the health of German citizens.

Research request

In September 2020, I got a special request concerning those card terminals by someone who had a lot of knowledge about the German electronic health system, and a news reporter. I was the perfect person to contact because I already ordered a VPN connector for this system in the past to prove that the supply chain wasn't secure. I knew the system pretty well and I was already publicly known in this context. 👩‍💻

Some "hackers" who wanted to stay anonymous published an attack that allows physical manipulation of health card terminals almost a year ago. BSI and gematik, who are responsible for the security of the terminals, were in doubt that this attack was possible. The news reporter wanted an additional opinion if the manipulation could be done.

In my point of view, the offensive part of this research was finished. The attack documentation appeared to be valid. Thus, any additional research would be to enforce a fix for this known bug. Moreover, the person who contacted me claimed that bypassing the security of a card terminal would be sufficient for illegal drug dealing, killing selected people, and more. Based on this description it was a severe flaw that hadn't been fixed because BSI and gematik doubted plausibility.

I replied that the attack seemed to be plausible. Inside, the terminal didn't look that much different from all those IoT devices that I took apart before, lots of open contacts for debugging, some STM chip, and so on. Uuuh, maybe even some glitching attacks might be possible to extract keys??! However, the previously published attack required to bypass a protection against drilling, and claimed that plaintext data was sent over wires within the card terminal. Things that I couldn't confirm just from seeing a few pictures. 

Confirming the bug

The bug is as follows:

The news reporter ordered two terminals on eBay, the older offline variant and the online variant. Yeah, those devices with a "secure supply chain" can be purchased on eBay.

Each terminal has five seals. Yet, the case can be opened on the bottom without breaking any seal. Access to the mainboard is still protected. The protection against drilling is a foil with a very thin circuit structure. By inserting a 2.5mm high LED into the card slot, light shines through this foil and the structure becomes visible. I modified an animated rainbow LED for this experiment, and red light worked the best. 🌈 

I failed cutting the foil properly in the first attempt with the offline version. In the second attempt on the online version I took some more time, optimized the cut's position and length, and it worked well. This means that the foil can detect manipulation if the cut isn't precise but fails otherwise. Note that the model of the first attempt was an older generation that already had various debug outputs, and I used them to confirm my logic analyzer settings and observed a serial boot output. Moreover, the foils are made of different materials but both foils still have the same circuit structure and the mainboard has most components at the same positions, which helped me in optimizing the cut's position.

After succeeding with the second cut, I attached the logic analyzer to the card reader wires within the terminal that transmit plaintext data. However, even when rebooting the device multiple times, my logic analyzer didn't show anything interesting, including the analog output mode. Positioning the logic analyzer probes through the small cut isn't easy, this is why I repeated this step multiple times to exclude failures on my end. During the whole procedure I didn't insert any smartcard into the reader, which might've been required to extract signals out of it. I only saw a ground signal and maybe a clock but the clock could've also been due to the ground contact not being that stable. I didn't have any smartcards except my own banking and health insurance cards and I didn't want them on video—and I filmed every step to ensure reproducibility.

Facing reality

When discussing the last step, which was about intercepting and confirming the plaintext data with a smartcard, I rage quitted the project. Oooops 🤷‍♀️ I still provided my feedback for the article but didn't fully confirm the attack, even if the article states otherwise. And I opted out from submitting a CCC talk about this topic.

As far as I know, there are two companies that sell these terminals in Germany. The manufacturer of the vulnerable terminal produces nothing else than this and sold 200k terminals in Germany and France. They're a GmbH (=LLC, Limited Liability Company), which means that if there is some failure for which they are accountable, the amount they have to pay is limited.

The cheapest fix against manipulation would be to add two more seals (resulting in seven seals, lol... 🦭🦭🦭🦭🦭🦭🦭). Then, the device could no longer be opened without voiding the seals. The overall costs of this? Let's assume some technician drives from terminal to terminal, documents the device was not manipulated, and then applies the seals. Maybe 50€ per terminal? That's like... oh... 10 million €. Just to confirm that no manipulation took place in the past and hoping that the seals are secure against manipulation as well. Oh, remember this detail with the pre-installed cryptographic certificates that expire in five years? The terminals will have to be replaced in two years anyway, as far as I know.

Yes, this is a valid attack. But there are much more critical components within this ecosystem, for example all the networked parts, encryption, and servers that store data.

So I wrote a mail that was along the lines of: "Okay, great, the attack probably works. I need some smartcards. And we have to inform BSI and gematik and tell them if and how to fix this, because I estimate the fix to cost 10 million €, paid by the German healthcare system or taxes."

And I got the following reply (by Thomas Maus, not the c't reporter Hartmut Gieselmann (CC), who asked me to clarify this... but he also didn't take any action afterwards): "Yeah, the fix will cost more like 50 million €. It doesn't matter since gematik is responsible for fixing this, they failed properly testing this terminal. The overall costs of this system were >4 billion € wasted so far, so this fix is rather cheap. Oh, and once they're finished checking the foil for cuts, we can tell them that there might be an additional foil on top to hide the cuts, and they need to check again."

This response crossed multiple ethical lines, like:

In response, I quit the project, never signed the contract with the news magazine, didn't confirm the plaintext part of the attack, and sent back all the hardware. I'm still in the news with some article that confirms the attack excluding most of my criticism about the attack. "There is an attack but it really doesn't matter and the bug won't be fixed" isn't a fancy headline. Whatever. 🔥

Disclosure Timeline

Responsible disclosure means that everyone needs to stay in the loop and that all vulnerabilities (not just a few selected ones) need to be disclosed to the vendor. The vendor should be allowed a decent amount of time to react to the findings. During my initial contact with gematik on December 2, I was quite surprised that they didn't know if and when the article would be published and if the reporter found someone who confirmed the anonymous hack or not.