[00:00.000 --> 00:04.520]  Uh, good morning everyone. So as Larry just mentioned, today we're gonna talk about an ICS
[00:04.520 --> 00:10.360]  specific talk and we will discuss, uh, the specific use of some Modbus function by, uh,
[00:10.360 --> 00:17.120]  Schneider in order to perform some, uh, bad actions on PLC. Just a quick introduction, this
[00:17.120 --> 00:22.260]  is nothing new. Uh, everything that I'm gonna mention today was discovered, uh, maybe 10
[00:22.260 --> 00:29.260]  years ago, mostly by, uh, reverse ICS from Digital Bond at the time. However, um, I will try
[00:29.260 --> 00:35.860]  to show how it is still relevant even in newer PLCs and, uh, also how we can use that to
[00:35.860 --> 00:42.300]  perform a new kind of attack. So just a few words about me, my name is Arnaud Soulier, I'm
[00:42.300 --> 00:47.700]  French as you can probably hear. Um, I mostly do pen tests, a bit of research and
[00:47.700 --> 00:52.520]  development. I'm a manager at WaveStone, that doesn't mean I manage anyone. Um, I really,
[00:52.520 --> 00:58.400]  really love ICS, really fun to play with and I've given a lot of, um, ICS workshop where I
[00:58.400 --> 01:04.240]  teach people how to perform, uh, entry level pen testing on ICS at, uh, Black Hat Europe,
[01:04.240 --> 01:09.920]  Brucon, Defcon, besides Las Vegas. And, um, I also like other things like Active Directory
[01:09.920 --> 01:17.060]  security and other stuff I'm not gonna talk about today. So I'm not sure that everyone is
[01:17.060 --> 01:22.160]  familiar with ICS here so I'm just gonna try to give a crash course in 1 minute or something
[01:22.160 --> 01:28.280]  like that. So ICS mean industrial control systems. Those are the system in charge of, uh,
[01:28.280 --> 01:33.960]  let's say managing all the automation at plants and factories in all kind of sector. If we
[01:33.960 --> 01:39.860]  take a look at this diagram you will see that an ICS is composed, um, on the far right side
[01:39.860 --> 01:45.920]  of sensors and actuators. A sensors will give you an information, for example a switch will
[01:45.920 --> 01:51.760]  tell you if it's, uh, switched on and off. And, uh, one actuators will perform an action. For
[01:51.760 --> 01:56.520]  example, if you take the simplest example, it's a light bulb. You see that it emits light or
[01:56.520 --> 02:01.860]  not. Those physical device, they are managed by PLCs. That's the device we're gonna talk
[02:01.860 --> 02:07.220]  about today. That stands for programmable logic controllers. And mostly it's an embedded
[02:07.220 --> 02:11.900]  computer with electrical inputs and outputs. That's the main difference between a standard
[02:11.900 --> 02:18.860]  computer and a PLC. Those PLCs are then managed by, uh, some classical IT stuff like, uh,
[02:18.860 --> 02:23.360]  Windows servers and workstation running what we will call today a SCADA software. I'm not
[02:23.360 --> 02:28.120]  digging into the detail of SCADA versus DCS and stuff like that. Today we're gonna call
[02:28.120 --> 02:33.640]  that SCADA. And somehow this is connected to the corporate network to get some information or
[02:33.640 --> 02:42.810]  send some, uh, batch, uh, orders. Okay, so there are a lot of ICS protocols. Today we're
[02:42.810 --> 02:48.830]  gonna talk about, uh, Modbus. It's one of the most widely used I think, uh, discovered, um,
[02:48.830 --> 02:54.470]  invented in 1979 by a company that was at the time called Modicon and later bought by
[02:54.470 --> 03:01.050]  Schneider Electric. Um, it was designed to work over serial lines, um, so RS, uh, 485
[03:01.050 --> 03:06.210]  mostly. There are two versions of the protocol, the binary and the ASCII. And if you take a
[03:06.210 --> 03:12.950]  look at a frame format, you will see that it's composed of the address of the PLC. Then what
[03:12.950 --> 03:18.130]  is called the PDU, the protocol data unit with one function code and the data and, uh, some
[03:18.130 --> 03:24.590]  kind of cyclic or linear, um, redundancy check to make sure that we have data integrity. So
[03:24.590 --> 03:28.870]  what do I talk about the frame format? Just to show you that, uh, there is no security
[03:28.870 --> 03:34.110]  built into the protocol. There is no encryption, there is no authentication. So that was not
[03:34.110 --> 03:39.450]  really a problem when we were using that over serial lines. However, later they tried to use
[03:39.450 --> 03:45.350]  Modbus over TCP. So they just removed the integrity checks because that's handled by, uh,
[03:45.350 --> 03:53.210]  the, uh, TCP, uh, layer. And, uh, a Modbus TCP frame format also has the PDU, so the
[03:53.210 --> 03:59.870]  function code and the data. And as a transaction identifier, that's, uh, let's say, um, a
[03:59.870 --> 04:05.470]  random number that is used to make sure that, uh, the request and the response match. A
[04:05.470 --> 04:10.470]  protocol identifier which is usually, uh, has the value 1, not really useful. The length of
[04:10.470 --> 04:14.690]  the packet and the unit identifier. Most of the time the unit identifier is set to 1
[04:14.690 --> 04:19.250]  because we already have the IP address to identify which PLC we talk to. So we do not need
[04:19.250 --> 04:25.450]  to use this, uh, field. Mostly Modbus is used to perform read and write actions. So here
[04:25.450 --> 04:30.670]  you have the most function, uh, most common function code. Um, it's mostly used to read
[04:30.670 --> 04:35.930]  some information. A coil which is 1 byte or, um, a register that is 8 byte. As you can
[04:35.930 --> 04:41.290]  see, when Modbus was transferred to TCP, they did not added, uh, any kind of security. So
[04:41.290 --> 04:46.230]  still no security. So this is a protocol that's used for ICS. There is no authentication, no
[04:46.230 --> 04:52.950]  encryption. You can perform other kind of actions. For example, there are some basic
[04:52.950 --> 04:59.110]  diagnostic functions built in like the, um, function read device information. Um, that's a
[04:59.110 --> 05:06.390]  screenshot of, um, this kind of, uh, request to this PLC which is a Schneider M340. As you
[05:06.390 --> 05:11.070]  can see, we can, uh, know the fact that it's a Schneider Electric PLC and also get the
[05:11.070 --> 05:17.850]  detailed hardware information. So BMX P34. So that's interesting. But there are other kind
[05:17.850 --> 05:24.890]  of Modbus function codes that are used and not part of the standard. So we will focus on
[05:24.890 --> 05:29.710]  the Schneider PLC. So, uh, I do not have knowledge of all the PLCs that are produced by
[05:29.710 --> 05:36.030]  Schneider. However, I've encoded, uh, several, uh, kind of products. The first one and the,
[05:36.030 --> 05:41.490]  the oldest are the Quantum 1, then the Premium, then this one, the M340. And then we have
[05:41.490 --> 05:50.050]  newer, newer models, the TM221 or 241 and the M580. So those PLCs, they are programmed, uh,
[05:50.050 --> 05:56.330]  by engineers using a specific Schneider software which is called Unity Pro. And, um, what
[05:56.330 --> 06:01.210]  we're gonna see is that Unity Pro is actually relying on some specific Modbus function code
[06:01.210 --> 06:07.130]  to discuss with the PLC and to program it. So how do we do that? It's quite simple. You
[06:07.130 --> 06:12.270]  install a demo PLC, you install Unity Pro, you launch Wireshark and you take a look at the
[06:12.270 --> 06:17.790]  packet dump. So as you can see, here's a packet dump when I log in to a, to a PLC and I
[06:17.790 --> 06:23.150]  upload a new program. It runs on top of Modbus TCP. Uh, the function code is 90. It's
[06:23.150 --> 06:28.250]  already part of the Wireshark de-sector. So as mentioned, uh, the use of Modbus function
[06:28.250 --> 06:32.610]  code 90 is not something new. It has been known for years. And when I first started working
[06:32.610 --> 06:37.810]  on it, uh, I had a chat with, um, I think it's Alex Lagut, a Wireshark developer in France,
[06:37.810 --> 06:43.150]  and he was kind enough to add this to the Wireshark Modbus TCP de-sector. So now if you
[06:43.150 --> 06:48.010]  take a look at, um, Modbus traffic, you will be able to know when there is, uh, somebody
[06:48.010 --> 06:56.370]  performing admin actions on a Schneider PLC. Um, something else that's really important, I
[06:56.370 --> 07:01.730]  mentioned that in the introduction, uh, all of this is already known. The fact that you can
[07:01.730 --> 07:07.330]  upload a road program to a PLC is known, uh, since at least 2012. It was done by, uh,
[07:07.330 --> 07:14.350]  reverse ICS. Um, so what I did was during a, an assessment, I think it was maybe 5 years
[07:14.350 --> 07:21.830]  ago, I was, uh, facing a Schneider PLC so I take a deep look at what, um, uh, Red did and
[07:21.830 --> 07:26.610]  what I try to do is try to build on that to add additional features or to make the, the
[07:26.610 --> 07:34.390]  Metasploit modules more reliable. Okay, so now we, we see that using Modbus function called
[07:34.390 --> 07:39.810]  90 we can do everything that can be done with Unity Pro, the programming software. So what
[07:39.810 --> 07:44.750]  kind of evil things can we do? First thing, not really offensive, is to gather some
[07:44.750 --> 07:50.910]  information about the, the PLC and the project and I'm gonna try to demo that. So here on my
[07:50.910 --> 07:57.310]  setup, just to, to be clear, I have a Schneider PLC M340 and this is my laptop that will host
[07:57.310 --> 08:37.530]  both the attacking VM and the legitimate, uh, HMI workstation. Well, actually I did not plan
[08:37.530 --> 08:44.150]  on how I was going to type and, uh, have the mic at the same time. Thanks a lot. Okay, so
[08:44.150 --> 08:48.750]  the idea is that I'm using a, a new Metasploit module that I just developed this week and, uh,
[08:48.750 --> 09:02.240]  I'm gonna try to see what kind of information we can gather from, uh, the PLC. And hopefully
[09:02.240 --> 09:07.780]  it will work. Yes. So as you can see, um, I'm able to get the same information as, uh, using
[09:07.780 --> 09:15.140]  the Modbus function code, uh, 43. So the BMX is the hardware CPU of the PLC. That's the name
[09:15.140 --> 09:20.680]  of the project that's on the, the PLC. And from time to time I'm also able to get the host
[09:20.680 --> 09:25.500]  name running the, the, the name of the workstation running this programming software, the
[09:25.500 --> 09:29.680]  version of, uh, the Unity software and the comments in this project. I think there are no
[09:29.680 --> 09:40.160]  comments. That's why we are, do not have anything here. Uh, okay. So that was the, the, the
[09:40.160 --> 09:45.580]  first thing. Uh, next we can start and stop the PLC. So, uh, that's, does not mean we are
[09:45.580 --> 09:50.560]  gonna have to shut it on or off, but actually the PLC will stay on. We can still perform admin
[09:50.560 --> 09:55.360]  action, but it will not execute the program. That's basically what start sub did. I'm not
[09:55.360 --> 10:00.800]  gonna demo that today. Why? It's quite simple. Uh, there is a module in Metasploit. It works.
[10:01.020 --> 10:04.960]  It works greatly when you want to stop the PLC, but it does not work so well when you want to
[10:04.960 --> 10:09.820]  start it again. You actually have to unplug the electrical, uh, plug of the PLC and put it back
[10:09.820 --> 10:14.840]  again. So in order to, let's say, do not waste too much time today, I'm not gonna demo that,
[10:14.840 --> 10:19.560]  but it works quite well starting and stopping the PLC. Uh, another thing that I want to show
[10:19.560 --> 10:24.060]  you is how to download the ladder logic. What I call ladder logic is actually the, the
[10:24.060 --> 10:32.000]  program that the PLC is executing. So that is also something that Red had worked on, but
[10:32.000 --> 10:36.920]  during my assessment a few years back, I discovered that it was not working correctly. Why?
[10:36.920 --> 10:43.800]  It's quite simple. Um, I think he used a demo, uh, program, so really small in size. So he,
[10:43.800 --> 10:47.580]  there was a misconfiguration with the, the size of a counter in the specific Schneider
[10:47.580 --> 11:16.260]  protocol. Okay, so here you can see that I'm gonna attempt to download the program and to
[11:16.260 --> 11:27.970]  store it at this, uh, location. Okay, so there are a few Modbus requests that are sent to the
[11:27.970 --> 11:34.550]  PLC. The Ethernet card is flashing and in a few seconds we should have the program. It's a
[11:34.550 --> 11:44.030]  very simple program, just, um, managing a traffic light, so it's quite, uh, it's quite fast.
[11:44.030 --> 11:48.430]  Okay, so here I have my file. So now what I'm gonna do, I want to make sure that the file that
[11:48.430 --> 11:53.210]  I downloaded is the real one. So I'm gonna switch to the other VM, which is a, uh, Windows
[11:53.210 --> 12:03.070]  one. Uh, I'm gonna connect to the PLC. Oh yeah, it's not working. Yes, it works. Uh, I'm gonna
[12:03.070 --> 12:25.230]  download the project, uh, from the PLC to my PC. Okay, so now I have, I have on my PC the, the
[12:25.230 --> 12:30.170]  same program as the one running on the PLC using the legitimate software. I'm gonna save that as
[12:30.170 --> 12:41.580]  an archive on my desktop. Okay. If I take a look at the desktop, I'm gonna try to find the
[12:41.600 --> 12:51.100]  file. Okay, it's here. I just have to rename, rename it because it's actually a zip file. And if
[12:51.100 --> 12:56.200]  you take a look inside the zip file, you see that there's a hidden folder called binappli. And in
[12:56.200 --> 13:01.160]  this file we have, uh, uh, in this folder we have the station.apx file, which, uh, actually the
[13:01.160 --> 13:07.140]  one, uh, that has the, the PLC ladder logic. So I'm copying this file to, um, uh, to a share to
[13:07.140 --> 13:19.960]  the other VM. Okay, I'm replacing the file. And if I go back here on my Kali Linux machine, uh,
[13:19.960 --> 13:27.400]  okay, so I'm actually doing a binary diff between the file I just downloaded and the one that I
[13:27.400 --> 13:33.880]  just copied from the legitimate software. And as you can see, the files are identical. So the
[13:33.880 --> 13:39.080]  module works. It's possible to download the ladder logic. Uh, it should be possible to upload
[13:39.080 --> 13:43.200]  it as well. However, I have the same kind of issue with the counter and the size of the
[13:43.200 --> 13:48.020]  counter. So at the moment, the module in Metasploit, uh, or the one that I developed does not
[13:48.020 --> 14:01.410]  work correctly. Okay, so those were the thing that already existed. But since this is Defcon, I
[14:01.410 --> 14:06.470]  wanted to, to have something, uh, to have something new. Uh, so one feature that was really
[14:06.470 --> 14:10.830]  interesting to me was the, what we call forcing the outputs. Uh, I don't know if you have
[14:10.830 --> 14:16.190]  already worked on the PLC. Forcing the outputs is used during the development phase, uh, that
[14:16.190 --> 14:21.510]  allows you to bypass the control, uh, the, the ladder logic of the PLC and directly set the
[14:21.510 --> 14:28.490]  outputs to on or off or any kind of, uh, arbitrary value. Um, and that helps you debugging,
[14:28.490 --> 14:35.050]  uh, especially when working with, uh, other entities. So that's interesting why the way PLCs
[14:35.050 --> 14:41.230]  are developed, most of the time, um, on the SCADA HMI, you do not read the values of the
[14:41.230 --> 14:46.910]  outputs. You read the values of some intermediary, uh, variables. So for example, if I go
[14:46.910 --> 15:07.100]  back on my, um, Windows workstation. So here I'm gonna launch the, the SCADA software. Okay,
[15:07.100 --> 15:11.580]  so basically this controls the, the, um, the PLC. As you can see, I can switch the lights on
[15:11.580 --> 15:17.420]  and off. The way it works is that I'm not directly reading the outputs because that's not a
[15:17.420 --> 15:23.580]  feature, uh, that this, uh, specific software has. What I'm doing is actually, if I take a look
[15:23.580 --> 15:41.100]  at the code, let me zoom on that. So as you can see here, I have 3, uh, variables, red, green,
[15:41.100 --> 15:46.340]  and orange, that will set the outputs to, uh, 1 or 0. That's the way it works. So I have
[15:46.340 --> 15:52.980]  modbus values that are, uh, um, managing the values of the outputs. From what I've been able
[15:52.980 --> 15:57.960]  to discuss with, uh, people, engineers working in automation, most of the case that's how it
[15:57.960 --> 16:02.980]  works in ICS. You never use directly, uh, the outputs. You use some kind of intermediary
[16:02.980 --> 16:07.620]  variables because in real life, uh, you will use some complex function block and it's not as
[16:07.620 --> 16:14.200]  simple as just, uh, uh, 1, um, 1 switch. Okay, so that's interesting because what happens if I
[16:14.200 --> 16:19.760]  want to directly modify the, the outputs, uh, what will happen on the HMI screen? Probably
[16:19.760 --> 16:30.540]  nothing. So that's what I'm gonna demo here. Uh, let me see, okay, I go back to Kelly. So here
[16:30.540 --> 16:35.780]  I'm just gonna use the other module. I will launch, uh, a specific action that will set, uh,
[16:35.780 --> 16:43.700]  every output value to 0 then 1 and, um, that for all the 8 outputs that I have on this, uh,
[16:43.700 --> 16:49.900]  specific, um, PLC. So the idea is that I should be able to modify the real process without the
[16:49.900 --> 17:25.780]  operator noticing anything on the screen. So that's what I'm gonna try to do. Okay, so the
[17:25.780 --> 17:31.220]  module is running so at some point we should see the light changing. It should not be, uh, part
[17:31.220 --> 17:41.380]  of the, the HMI screen. Let's wait a few seconds. Yes. So as you can see I'm switching the, the
[17:41.380 --> 17:47.620]  first output to 1. But that's not displayed on the screen. Then I'm gonna do the orange one, set
[17:47.620 --> 18:01.360]  to 1 then 0. But it's gonna stay orange on the screen. There's a 5 second delay that, that may be
[18:01.500 --> 18:12.080]  a bit much. And the light, the last one will be the green one. No, the orange again. Okay. So as
[18:12.080 --> 18:16.300]  you can see I was able to barely influence the physical process without having any kind of
[18:16.300 --> 18:28.600]  information displayed back to the, uh, to the operator. Okay, so that's interesting. Uh, other
[18:28.600 --> 18:33.440]  topics I'd like to work on in the future is the ability to hot patch the PLC. Because actually
[18:33.440 --> 18:38.480]  when you program the PLC you have to stop it, upload the program and start it again. So in the
[18:38.480 --> 18:44.140]  physical process anyone will notice that. However, using Unity 4 you can also hot patch. That
[18:44.140 --> 18:48.060]  means you can perform some small modification of the ladder logic without having to stop the
[18:48.060 --> 18:51.960]  PLC. So that's really interesting. And I'd like to have a Metasploit module that does the
[18:51.960 --> 18:57.080]  same. Uh, for the record I also have another module in the works that does not force the
[18:57.080 --> 19:02.380]  output's value but the register's value. So you can actually modify any action inside the
[19:02.380 --> 19:11.600]  ladder logic, uh, as you wish. Okay, so that was true for the premium, the quantum and the M340
[19:11.600 --> 19:19.680]  PLCs. Uh, what about the new ones? So in 2015 I bought the, the new, uh, released TM221. So
[19:19.680 --> 19:25.160]  those are entry level PLCs and what I've discovered is that even if they are not programmed by
[19:25.160 --> 19:30.820]  Unity Pro but another soft, software called SoMachineBasic, they actually still use the same
[19:30.820 --> 19:35.920]  function code. So even the PLCs released 2 years ago, even if we know that there was no
[19:35.920 --> 19:42.760]  authentication on admin actions since, since, uh, almost 10 years, uh, the new PLCs still have
[19:42.760 --> 19:47.440]  the same problem. Uh, however, the, the exploits, they do not work out of the box. You
[19:47.440 --> 19:51.340]  actually have to perform some kind of modification, change some offsets. So it's
[19:51.340 --> 19:55.960]  vulnerable but you cannot prove it at the moment. Uh, one of my colleague, Alexandrine,
[19:55.960 --> 20:01.120]  the, she already had, uh, ported some modification to the Metasploit module so you can now
[20:01.120 --> 20:05.760]  start and stop those device, uh, without any kind of, uh, authentication directly from
[20:05.760 --> 20:13.640]  Metasploit. So that was, uh, 3 years ago. Um, I recently learned that the new high end, uh, M580
[20:13.640 --> 20:19.640]  PLC adds IPSec authentication. So between the engineering station and the PLC. So that's a
[20:19.640 --> 20:25.560]  good thing. They actually use IPSec not for encryption but only the, uh, uh, authentication
[20:25.560 --> 20:30.180]  header part. So that allows you to make sure that, uh, if you want to program the PLC, you
[20:30.180 --> 20:35.660]  have to know the pre-shared key. So that's a good thing. However, that's quite new. Uh, it's
[20:35.660 --> 20:41.800]  the high end PLC so the, uh, CPU is, uh, at least, uh, I think $4,000. So at the moment I
[20:41.800 --> 20:45.620]  haven't, do not have the money to have that in my lab. Uh, so I cannot vouch for it. But
[20:45.620 --> 20:50.440]  that's the good idea, that's a good idea and that's the way things should work. So we can
[20:50.440 --> 20:54.540]  hope that in the future it will work. However, this is something quite new and you will
[20:54.540 --> 20:59.280]  probably not see that in plants and factory for, uh, at least 5 to 10 years.
[21:02.490 --> 21:08.730]  Okay, so what do we do now? Um, is it possible to, let's say, configure the PLC in a way that
[21:08.730 --> 21:14.410]  allows you to, uh, defeat those kind of attacks? To the extent of my knowledge, no. Uh,
[21:14.410 --> 21:19.570]  actually there are very few things you can do on a PLC. Uh, I think that on some Schneider
[21:19.570 --> 21:25.410]  PLCs you can, there is some kind of integrated firewall but it works not like a firewall
[21:25.410 --> 21:30.470]  because you can actually send a modbus- it's at the application layer, let's say, not at the
[21:30.470 --> 21:36.590]  network layer. But you could use that to prevent, uh, unauthorized action. Using newer PLC
[21:36.590 --> 21:40.670]  will work only if you buy the light, the latest one. So it might also be difficult to
[21:40.670 --> 21:46.910]  implement in, uh, I would say in, uh, existing or legacy environment. And of course what
[21:46.910 --> 21:51.050]  you can do is perform network security monitoring. As mentioned, those attacks are not
[21:51.050 --> 21:54.930]  new. Uh, the exploits are new but the vulnerability is known for a long time. So there
[21:54.930 --> 21:59.430]  are signatures for this modbus function code. So if you're using, uh, any kind of network
[21:59.430 --> 22:04.330]  security monitoring in your ICS, you will be able to detect any kind of attack. I would say
[22:04.330 --> 22:09.270]  that you should log anytime, uh, an engineering station logs to a PLC to perform admin
[22:09.270 --> 22:15.370]  action. And of course if you have an unknown workstation doing modbus, uh, 90 traffic to a
[22:15.370 --> 22:22.830]  PLC, that should raise a really, really red alert. Okay, so to sum things up, uh, most
[22:22.830 --> 22:29.470]  China PLCs, uh, that you will find in, uh, ICS, in, uh, assessment are vulnerable for, uh, 10
[22:29.470 --> 22:34.270]  years to this unauthorized access vulnerability. Uh, attackers can leverage that to do
[22:34.270 --> 22:39.030]  whatever the hell they want with the PLC, including, uh, forcing directly the outputs which
[22:39.030 --> 22:43.730]  might allow them to perform some kind of stealthy attacks on your process. So what can
[22:43.730 --> 22:51.860]  you do? Um, I would say at the moment you have to deal with it. Okay, so before I take any
[22:51.860 --> 22:56.240]  question, I'd like to say that everything is at this GitHub address at the moment. I really
[22:56.240 --> 23:00.440]  hope to be able to clean up the code and, uh, do a pull request to Metasploit, but they're
[23:00.440 --> 23:05.860]  quite picky about code quality and at the moment it's, uh, it's pretty shitty so, uh, in a few
[23:05.860 --> 23:11.300]  month, uh, I hope to be able to do a pull request to put that directly into Metasploit. Uh,
[23:11.300 --> 23:16.700]  but you can find that today on GitHub as well as the slides and a few videos of me, uh,
[23:16.700 --> 23:28.570]  pentesting PLCs. So do you have, uh, any questions? Also, I'd be happy to play with other
[23:28.570 --> 23:33.750]  kind of PLCs. If you have, for example, Schneider PLC that I do not have, it would be easier
[23:33.750 --> 23:40.310]  for me to try to understand the protocol. So if you have, uh, uh, M580 or TM241, I'd be
[23:40.310 --> 23:44.150]  interested in testing that. Or you can also download the modules, test on your own and give
[23:44.150 --> 23:51.730]  me some feedback on GitHub. I would love that. Okay, so if there are no question, thanks
[23:52.450 --> 23:58.030]  everyone. And, uh, I'll be around the ICS village, uh, a lot, I think during DEF CON. And if
[23:58.030 --> 24:03.830]  you are interested into ICS, of course, you just go, uh, across the hall and you will find a
[24:03.830 --> 24:04.990]  lot of PLCs to play with.