1
00:00:00,000 --> 00:00:07,060
First, thanks everyone for either coming out and waking up this morning or potentially

2
00:00:07,060 --> 00:00:09,800
staying out and rolling in this morning.

3
00:00:11,500 --> 00:00:15,960
Like Larry said, we're here to talk about some radio stuff, so let's have fun.

4
00:00:17,140 --> 00:00:19,080
So first, a little bit about me.

5
00:00:19,180 --> 00:00:20,380
Like Larry said, my name is Blake.

6
00:00:21,160 --> 00:00:26,640
I'm a consultant on the industrial control system team at Mandiant, a FireEye company

7
00:00:26,640 --> 00:00:29,660
as the slides will remind you throughout the day.

8
00:00:31,400 --> 00:00:37,880
I've been a radio hobbyist for about the last 15 years and have been using radio more and

9
00:00:37,880 --> 00:00:40,900
more in my professional life for about the last three to five.

10
00:00:41,540 --> 00:00:47,980
I started my career in critical infrastructure security about five years ago working in electric

11
00:00:47,980 --> 00:00:54,380
power generation for a company in the U.S. Midwest, Alliant Energy, and more recently

12
00:00:54,380 --> 00:00:56,620
spent some time as the security engineer.

13
00:00:56,620 --> 00:01:01,600
I'm the security engineer liaison for the information security team at Amazon to our

14
00:01:01,600 --> 00:01:07,520
fulfillment transportation and logistics practice where I got to play with all of our fun robots.

15
00:01:08,520 --> 00:01:15,080
So today we're going to talk about trends in industrial wireless communication and the

16
00:01:15,080 --> 00:01:19,740
exploitation that is possible with the additional attack surface that wireless provides.

17
00:01:20,600 --> 00:01:26,500
And how you, most importantly, how you can get started understanding the radio frequency

18
00:01:26,620 --> 00:01:29,340
environment in the systems that you protect.

19
00:01:30,880 --> 00:01:33,040
So first, a bit of background.

20
00:01:33,760 --> 00:01:35,060
Why radio at all?

21
00:01:35,260 --> 00:01:41,260
I think the natural answer to a lot of questions about radio in industrial environments is

22
00:01:41,260 --> 00:01:41,840
don't bother.

23
00:01:42,420 --> 00:01:43,780
You know, what's the point?

24
00:01:44,000 --> 00:01:46,140
You're just opening up additional attack surface.

25
00:01:46,740 --> 00:01:55,200
But the reality is that lower per sensor component costs combined with the falling cost of storage

26
00:01:55,200 --> 00:01:59,720
decreases the marginal cost of tracking additional points of a process.

27
00:02:00,260 --> 00:02:06,460
That combined with cheap access to computational power and increasing availability of analytical

28
00:02:06,460 --> 00:02:12,020
tools means that engineers have more and more desire for more and more data.

29
00:02:12,660 --> 00:02:17,800
Not just from the process itself, but also sometimes less critical points that weren't

30
00:02:17,800 --> 00:02:18,680
worth tracking before.

31
00:02:19,220 --> 00:02:24,480
Things like machine performance data for predictive analytics and the IOT.

32
00:02:24,480 --> 00:02:26,180
So, shots, right?

33
00:02:27,440 --> 00:02:28,840
So, but why radio?

34
00:02:29,080 --> 00:02:34,280
So engineers are limited by the practical constraints of running additional I.O.

35
00:02:35,920 --> 00:02:40,220
Most DCS I.O. cabinets look a little better than that.

36
00:02:40,720 --> 00:02:45,680
But there still is just the fact that running an additional cable to every sensor just doesn't

37
00:02:45,680 --> 00:02:46,020
scale.

38
00:02:47,120 --> 00:02:52,220
Sensor placement is limited when you have to run cables to every drop, and with the

39
00:02:52,220 --> 00:02:54,460
availability of ultra, low-precision I.O.

40
00:02:54,480 --> 00:03:01,900
power, embedded systems, and sensors. You have the ability to monitor additional points in

41
00:03:01,900 --> 00:03:08,500
your process with no additional power or communications cabling. Sometimes for months or

42
00:03:08,500 --> 00:03:16,500
years on end. There's also the field. So wireless communication has always been the

43
00:03:16,500 --> 00:03:24,200
backbone of long distance SCADA communications and telecommunications networks. You know,

44
00:03:24,200 --> 00:03:30,880
transporting signals reliably over long distance to very rural areas that are poorly served by

45
00:03:30,880 --> 00:03:37,940
traditional ISPs and telecoms has always been the providence of microwave communications. And

46
00:03:38,540 --> 00:03:45,140
fundamentally some systems just move like my old friend the Kiva robot there. Systems like

47
00:03:45,140 --> 00:03:51,480
robots, trains, planes, automobiles aren't stationary and need to be reached with critical

48
00:03:51,480 --> 00:03:53,980
control traffic wherever they happen to wander.

49
00:03:56,300 --> 00:04:01,360
Fundamentally this isn't the pitch for the wonderware expo over in Henderson. So why do we as

50
00:04:01,360 --> 00:04:10,640
hackers care about industrial RF? The threat model is fundamentally different than hardwired

51
00:04:10,640 --> 00:04:18,700
networks or hardwired I.O. because of physics. It's fundamentally public. No antenna is

52
00:04:18,700 --> 00:04:24,180
perfectly unidirectional in practice. And many systems are point to multipoint. And they're

53
00:04:24,200 --> 00:04:30,440
multi point to multipoint meshes which necessitate the use of omnidirectional radiating antennas, at

54
00:04:30,440 --> 00:04:36,460
least in some endpoints. Even those systems that are designed to be constrained within a single

55
00:04:36,460 --> 00:04:41,960
facility often leak through the walls. And the receivers on those systems may be sensitive enough

56
00:04:41,960 --> 00:04:50,360
to pick up signals that are sent from outside. So the types of attacks that end up possible, I

57
00:04:50,360 --> 00:04:54,180
really encourage everyone that's here and interested to check out the data that's available on the

58
00:04:54,180 --> 00:05:00,740
web. The talk from yesterday, radio exploitation 101, that was Matt Knight and Mark Newland from

59
00:05:00,740 --> 00:05:06,520
Bastille. Their slides are already up on the DEF CON media share. So I'd really, really suggest checking

60
00:05:06,520 --> 00:05:15,000
that out. They go into detail about the form of several wireless attacks. Most common, obviously,

61
00:05:15,120 --> 00:05:20,800
denial of service or jamming. But this is a very well known and well understood reliability issue

62
00:05:20,800 --> 00:05:24,160
for wireless systems engineers. With decades of experience in the field of wireless systems, I've

63
00:05:24,160 --> 00:05:24,960
worked with many of the systems engineers that have been using wireless for decades and decades of

64
00:05:24,960 --> 00:05:31,380
research, mostly going back to military electronics warfare. So this threat is generally very well

65
00:05:31,380 --> 00:05:36,540
understood and accounted for by any system engineer who's considering the use of wireless

66
00:05:36,540 --> 00:05:44,900
communications in practice. But, protection from other types of attacks, the type that we typically

67
00:05:44,900 --> 00:05:54,140
see on IP or IT style networks, have traditionally relied over time on protection by obscurity. So

68
00:05:54,160 --> 00:06:01,380
security, which is everyone's best friend. So things like data injection, malicious device

69
00:06:01,380 --> 00:06:08,360
association with networks have typically been dismissed over time as simply not needing

70
00:06:08,360 --> 00:06:14,960
treatment due to the lack of skills and lack of availability of open source equipment to

71
00:06:14,960 --> 00:06:22,960
attack wireless implementations. So what changed? So now we're here, that's the background,

72
00:06:22,960 --> 00:06:31,160
and you're all here because you want to be radio hackers too. Maybe you've even walked through a

73
00:06:31,160 --> 00:06:38,460
plant with a USB wireless card running Kismet before. Maybe you've even found some rogue

74
00:06:38,460 --> 00:06:44,020
access points that are stuck in an employee's drawer with a power cable drilled through the

75
00:06:44,020 --> 00:06:52,920
back of the desk to feed the AP, things like that. So 802.11 has its benefits in that there's

76
00:06:52,960 --> 00:06:59,880
off-the-shelf hardware, purpose-built for security assessments even, available online. The

77
00:06:59,880 --> 00:07:06,320
same applies to Bluetooth and to some extent even RFID. But historically the challenge has been

78
00:07:06,320 --> 00:07:12,160
that for every protocol and frequency pair that you want to assess, you require either the

79
00:07:12,160 --> 00:07:18,660
purchase or the design and fabrication of purpose-built hardware, which is a challenge,

80
00:07:18,700 --> 00:07:22,940
again, for scaling arbitrary security assessments across multiple types of hardware. So that's

81
00:07:22,960 --> 00:07:35,260
where we enter SDR. So that's the real heart of the talk today. Software-defined radio is a

82
00:07:35,260 --> 00:07:42,860
family of applied digital signal processing techniques that leverage high-speed analog to

83
00:07:42,860 --> 00:07:51,340
digital converters. That's the far right hand of that board. As well as DSP algorithms implemented

84
00:07:51,340 --> 00:07:52,940
in FPGA hardware. So that's the real heart of the talk today. Software-defined radio is a family of

85
00:07:52,960 --> 00:07:57,340
BaiM节 algorithms based on the hardware interface to a companion CPU as a peripheral.

86
00:07:58,420 --> 00:08:03,780
So those are a lot of words. But practically what it means, it frees us from the need to

87
00:08:03,780 --> 00:08:07,500
implement specialized hardware for every type of radio system that we want to assess,

88
00:08:08,080 --> 00:08:17,780
understand, and characterize. So to the left there is an Etis Research USRP-B210. That's a

89
00:08:17,780 --> 00:08:22,940
software-defined radio that covers from 70 megahertz to 6 gigahertz. That's what these guys do. So they're

90
00:08:22,960 --> 00:08:27,300
So quite broad set of frequencies at an instantaneous bandwidth

91
00:08:28,020 --> 00:08:30,960
that's really only practically limited by the speed of the USB

92
00:08:30,960 --> 00:08:35,160
bus that you attach it to. And to the right I just have a

93
00:08:35,160 --> 00:08:39,240
screenshot from GNU radio companion which is the graphical

94
00:08:39,240 --> 00:08:44,320
user interface front end GNU radio. And this shows what's

95
00:08:44,320 --> 00:08:49,200
kind of become the canonical hello world program of receiving

96
00:08:49,200 --> 00:08:54,440
wide band FM or commercial FM broadcast. So the goal today is

97
00:08:54,440 --> 00:08:56,880
hopefully with the brief overview we're about to give

98
00:08:56,880 --> 00:09:03,040
that you'd be able to get to this hello world type program on

99
00:09:03,040 --> 00:09:06,600
your own with limited investment and maybe just an additional

100
00:09:06,600 --> 00:09:10,880
couple hours of your time. So to start there's kind of three

101
00:09:10,880 --> 00:09:14,820
components I would say to succeeding with a software

102
00:09:14,820 --> 00:09:18,740
defined radio project. One is the hardware because there are

103
00:09:18,740 --> 00:09:19,180
some hardware that are not as good as the hardware that you

104
00:09:19,200 --> 00:09:22,400
need. The second is the software which is really where

105
00:09:23,040 --> 00:09:26,580
your brain meets the problem. And the third is obviously the

106
00:09:26,580 --> 00:09:29,120
knowledge and theory that you have to understand in order to

107
00:09:29,120 --> 00:09:33,100
be at least skillful enough with digital single processing to

108
00:09:33,100 --> 00:09:37,840
get something done. But the good news is that because of

109
00:09:37,840 --> 00:09:40,760
advancements in both open source software and open source

110
00:09:40,760 --> 00:09:44,940
hardware this type of work is accessible even to those of us

111
00:09:44,940 --> 00:09:47,220
like myself who don't have advanced degrees in electrical

112
00:09:47,220 --> 00:09:51,340
engineering and the community that supports this type of work

113
00:09:51,340 --> 00:09:57,860
is very strong and helpful as I've found over time. So to start

114
00:09:57,860 --> 00:10:03,740
with the hardware. So even until relatively recently

115
00:10:04,580 --> 00:10:09,580
software defined radios had a serious price constraint. We're

116
00:10:09,580 --> 00:10:12,760
talking professional test equipment running in the tens

117
00:10:12,760 --> 00:10:17,040
of thousands of dollars to even get started. But the good news is

118
00:10:17,040 --> 00:10:22,820
over the last five years primarily due to the reduced RF integrated

119
00:10:23,360 --> 00:10:28,320
circuit component cost driven by development of 4G networks

120
00:10:28,720 --> 00:10:33,160
primarily, the cost has been falling and continues to fall to

121
00:10:33,160 --> 00:10:39,360
get started. So the most common way people get started is with

122
00:10:39,360 --> 00:10:46,540
an RTL, SDR dongle. This is a general term for a family of

123
00:10:46,540 --> 00:10:47,020
U.S. companies. It's a general term for a family of U.S.

124
00:10:47,180 --> 00:10:47,320
companies. This is a general term for a family of U.S.

125
00:10:47,320 --> 00:10:50,000
Microsoft devices, USB devices based on a real tech integrated

126
00:10:50,000 --> 00:10:54,200
circuit chipset. They are receivers only. So they're

127
00:10:54,200 --> 00:10:57,640
relatively limited with a general range of about 40

128
00:10:57,640 --> 00:11:03,440
megahertz to 2 gigahertz which is great for starting. It gives

129
00:11:03,440 --> 00:11:06,300
you enough to do that hello world program that we saw on the

130
00:11:06,300 --> 00:11:15,780
last slide. It also provides sufficient coverage of some industrial frequencies, for

131
00:11:15,780 --> 00:11:21,700
example, the unlicensed industrial scientific and medical bands at 430 megahertz and 900

132
00:11:21,700 --> 00:11:29,000
megahertz in the U.S. But because they top out somewhere between 1.7 and 2 gigahertz, you

133
00:11:29,000 --> 00:11:36,060
lose out on the unlicensed 2.45 gigahertz ISM and 5 gigahertz and above licensed and

134
00:11:36,060 --> 00:11:41,060
unlicensed space. So enough to get started, enough to learn, enough to get dangerous, but

135
00:11:41,060 --> 00:11:46,400
once you get the taste, you'll probably want to move up to some of these, you know, fantastic

136
00:11:46,960 --> 00:11:54,800
really hobbyist grade gear. So for about a single order of magnitude increase in price, we're

137
00:11:54,800 --> 00:11:58,840
talking about between three and four hundred dollars, you can move up to a

138
00:11:59,000 --> 00:12:02,980
really full-featured and sensitive transceivers, so something that's capable of both

139
00:12:02,980 --> 00:12:08,880
receiving signals, decoding them, and actually transmitting signals that you synthesize in

140
00:12:08,880 --> 00:12:18,720
software. I cover a few here. They range between in their RF front ends between, you know,

141
00:12:18,740 --> 00:12:24,280
several hundred kilohertz up to about four gigahertz. I believe the HackRF will get up to

142
00:12:24,280 --> 00:12:28,980
six gigahertz, but suffers some performance degradation above four. And then the other

143
00:12:29,720 --> 00:12:36,180
thing is that they're relatively wide bandwidth, relatively sensitive receivers. So really, if

144
00:12:36,180 --> 00:12:42,260
you want to toy around, you know, reverse engineering your garage door opener at home, or

145
00:12:42,260 --> 00:12:48,280
even doing some simple assessments in your own environments or a client's environments, it is

146
00:12:48,820 --> 00:12:57,720
enough to get started. The industry standard really though for professional grade gear are the

147
00:12:57,720 --> 00:13:03,780
USRP line from Edis Research. I have no affiliation to them. Don't consider this an

148
00:13:03,780 --> 00:13:10,380
endorsement, but it is what I use for client engagements. Very well regarded in industry. The

149
00:13:10,380 --> 00:13:17,460
prices range into the thousands here, but low thousands. And so if you have a commercial need to

150
00:13:17,460 --> 00:13:25,120
actually support repeatable assessments, it quickly starts to make sense. These cover, like I

151
00:13:25,120 --> 00:13:27,700
mentioned, I think a slide or two before, up to six gigahertz. So, you know, that's kind of the

152
00:13:27,720 --> 00:13:31,080
way it works. So you can get six gigahertz out of the box at an incredibly wide instantaneous

153
00:13:31,080 --> 00:13:40,200
bandwidth, giving you a lot of flexibility for design and synthesis of your protocol decoders. So

154
00:13:40,630 --> 00:13:46,980
good times. That's the hardware. On to the software. Really the heart of all of this is GNU

155
00:13:46,980 --> 00:13:53,980
Radio. GNU Radio is essentially a set of C libraries for digital signal processing

156
00:13:53,980 --> 00:13:57,700
algorithms. But the good news is that it also ships with the hardware. So you don't have to go to

157
00:13:57,700 --> 00:14:02,320
an address with very nice gooey front end called GNU radio companion. And what GNU radio

158
00:14:02,320 --> 00:14:07,060
companion allows you to do is essentially attack the problem as a visual programming language,

159
00:14:07,880 --> 00:14:14,380
building out a flow graph that that describes the processing of your signal from source to sync,

160
00:14:15,320 --> 00:14:20,920
allowing you to manipulate the data along the way using both its standard library of DSP

161
00:14:20,920 --> 00:14:27,680
algorithms, as well as a large and growing set of community open source common energía

162
00:14:27,700 --> 00:14:35,080
source modules. I will have links to all of this. They're currently pushed to my GitHub which

163
00:14:35,080 --> 00:14:39,600
I'll have a reference to at the end of the talk. So you'll be able to find all of these later.

164
00:14:40,600 --> 00:14:46,420
The next I put up there is actually what's pictured to the right. It's called GQRX. It's

165
00:14:46,420 --> 00:14:52,300
also an open source project and its primary use is for exploration of spectra. So this is very

166
00:14:52,300 --> 00:14:58,700
helpful for identifying previously unknown signals or confirming your understanding of

167
00:14:58,700 --> 00:15:02,460
signals that you believe might exist but aren't sure exactly where they are or what they look

168
00:15:02,460 --> 00:15:10,120
like. This is where I start. If I'm on a new engagement at a new facility. And it's also

169
00:15:10,120 --> 00:15:17,780
helpful for capturing those signals for later offline analysis. This is where having one of the

170
00:15:17,780 --> 00:15:22,280
slightly higher end SDRs really pays off. Because you're limited, you're not going to be

171
00:15:22,300 --> 00:15:27,260
able to see them. The width you see on the screen is dictated by the instantaneous bandwidth of

172
00:15:27,260 --> 00:15:34,540
the RF front end of the SDR hardware. Simply what that means is that the wider bandwidth, the

173
00:15:34,540 --> 00:15:40,000
less tuning around you're going to have to do to find new signals. The more you see at once. So

174
00:15:40,000 --> 00:15:45,520
this is where those definitely moving into that hobbyist grade gear up from the RTL SDR has the

175
00:15:45,520 --> 00:15:52,180
biggest dividends is during this exploration phase. There are also options for automated

176
00:15:52,180 --> 00:15:59,520
scanning across wide sets of spectrum. One is called hack RF scan. Which not surprisingly works

177
00:15:59,520 --> 00:16:07,800
with the hacker F and the hacker F only. But if anyone here in the talk has recommendations for

178
00:16:07,800 --> 00:16:11,980
me, I'd love to hear about other kind of automated scanning tools. Especially any that

179
00:16:11,980 --> 00:16:17,480
implement the UHD hardware API. So come find me or raise your hand during the questions. We can

180
00:16:17,480 --> 00:16:22,160
talk. The last thing here is a little bit more about what we're going to talk about today. So

181
00:16:22,160 --> 00:16:28,640
this is in spectrum. I don't have a screen shot. This is a tool for offline analysis of a captured

182
00:16:28,640 --> 00:16:35,360
signal. So once you've maybe identified a new signal using GQRX, either one that you didn't

183
00:16:35,360 --> 00:16:41,120
expect or don't understand, you can use the recording feature of GQRX to capture a raw IQ

184
00:16:41,120 --> 00:16:47,180
sample and open it up in spectrum. This gives you a similar view to what you're seeing in GQRX.

185
00:16:47,380 --> 00:16:52,140
But critically what it allows you to do is pick out a single signal that you're going to be able to

186
00:16:52,140 --> 00:16:59,740
measure. Add a variable bandwidth from the capture and take derived measurements from it. So

187
00:16:59,740 --> 00:17:06,200
like a derived frequency domain plot. What this will allow you to do is start to reason about not

188
00:17:06,200 --> 00:17:11,900
just what the signal looks like in something like a waterfall graph, but actually the nature of

189
00:17:11,900 --> 00:17:17,200
the digital modulation of the signal. So when you're starting to try to understand the signal

190
00:17:17,200 --> 00:17:21,920
and build out a new radio flow graph, you're going to have to make a critical set of decisions

191
00:17:22,140 --> 00:17:26,920
about where to start. And then spectrum gives you the tools to at least reason about and

192
00:17:26,920 --> 00:17:32,660
understand the protocol before you start trying to just implement a receiver blindly in the

193
00:17:32,660 --> 00:17:42,240
software. All right. So that's a lot. And I know if you're not taking vigorous notes, you

194
00:17:42,240 --> 00:17:48,880
probably don't know exactly where to go from here. And honestly, this topic is a little bit

195
00:17:48,880 --> 00:17:52,120
more than what you can cover in a half hour talk, even to get started. So if you're interested,

196
00:17:52,120 --> 00:17:56,660
you can go ahead and get started. But the good news is that even without a strong electrical

197
00:17:56,660 --> 00:18:02,120
engineering background, I really believe you can get started in dangerous in about less than a day

198
00:18:02,120 --> 00:18:07,500
of reading and studying if you start with some of the resources that I have up on the slide here.

199
00:18:08,180 --> 00:18:14,320
So the first one, Michael Osman, who's the designer of the HackRF that was mentioned a few

200
00:18:14,320 --> 00:18:22,100
slides ago, has a video lecture series on his website openly available. So this is a training that he sells at the

201
00:18:22,120 --> 00:18:28,640
actually relatively high cost, even earlier this week at Black Hat. But he makes at least a large

202
00:18:28,640 --> 00:18:35,220
portion of it, I'm not sure if it's the whole thing, available for free on his website, Great Scott

203
00:18:35,220 --> 00:18:40,500
Gadgets. Again, the link will be in the GitHub. So at this point, I think he's up to either eight or

204
00:18:40,500 --> 00:18:49,020
nine video lectures. I've watched them all. It's a fantastic introduction to SDR in general, DSP

205
00:18:49,020 --> 00:18:50,920
fundamentals and terminology.

206
00:18:52,120 --> 00:18:58,160
And the HackRF in particular, since that's the device that he makes. But realistically, the

207
00:18:58,160 --> 00:19:04,160
lectures and the exercises in that series can be completed with any SDR, including really with an

208
00:19:04,160 --> 00:19:10,460
RTL SDR dongle. And even the first three or four lectures are really just on digital signal

209
00:19:10,460 --> 00:19:16,780
processing and you can do just after downloading a copy of GNU radio without any external hardware to

210
00:19:16,780 --> 00:19:21,260
get up to speed with some of the fundamentals. So that is definitely the place I recommend.

211
00:19:22,120 --> 00:19:27,100
Everyone to start. Eight lectures, about an hour long apiece, and you'll be up and running and quite

212
00:19:27,100 --> 00:19:35,620
dangerous in less than a day. The second resource I have here is a blog called Carriers Everywhere.

213
00:19:36,660 --> 00:19:44,400
Bastion Blesel is a European radio researcher with a security hobby, maybe, or a security

214
00:19:44,400 --> 00:19:52,100
passion. And his blog is where he documents his experience, reverse engineering, and the

215
00:19:52,120 --> 00:20:00,500
use of multiple consumer and industrial protocols. His work has influenced my work flow quite a

216
00:20:00,500 --> 00:20:07,340
bit. And you'll see some of his open source software projects later on in the slides when we get

217
00:20:07,340 --> 00:20:14,620
into 802.15.4. And even his work with mobile traffic light reverse engineering informs the mod bus

218
00:20:14,620 --> 00:20:21,920
work we'll see in a couple minutes as well. The last two on here are textbooks. So if you have a

219
00:20:21,920 --> 00:20:27,140
little bit stronger interest and you want to round out your skills, practical skills with some

220
00:20:27,140 --> 00:20:32,340
theory, the first one there, Practical Signal Processing, is actually a very skinny textbook.

221
00:20:33,120 --> 00:20:41,560
And it's really made for people that are using DSP technology, not people implementing DSP

222
00:20:41,560 --> 00:20:47,620
technology. So it's the perfect level to familiarize yourself with the GNU radio modules that

223
00:20:47,620 --> 00:20:51,900
are in the standard library. To help make sense of terms like rational, reasonable, and

224
00:20:51,900 --> 00:20:55,820
easy to understand, it's basically sampling, which fundamentally means multiplying by a constant

225
00:20:55,820 --> 00:21:02,680
and dividing by another one. Not nearly as complicated as it sounds, but without some of this

226
00:21:02,680 --> 00:21:07,960
guidance, it might seem a little, maybe, too intimidating at first. So definitely a good place

227
00:21:08,240 --> 00:21:15,220
to start. A couple hundred pages. The last one is a bit thicker. Complete Wireless Design. It's

228
00:21:15,220 --> 00:21:21,880
not DSP specific. It really focuses on the analog sides of radio frequency theory. And it's really

229
00:21:22,660 --> 00:21:29,260
a good resource if it's something you'd like to take on a little bit more seriously. So this is a

230
00:21:29,260 --> 00:21:36,660
grounding in the fundamentals of oscillators, filters, mixers, radiators, all of the fun analog

231
00:21:36,660 --> 00:21:44,060
RF stuff. And when I use this book, it's to solve challenges that I run into that have to be

232
00:21:44,060 --> 00:21:51,120
addressed in the analog world. Some things simply can't be done in DSP. For example, due to

233
00:21:51,120 --> 00:21:56,200
limitations of the RF front under your SDR. So an example of when I've used this book as a

234
00:21:56,200 --> 00:22:03,580
reference was on a recent engagement when I was asked to assess a signal for an oil and natural

235
00:22:03,580 --> 00:22:09,000
gas client that they were running at 11 gigahertz for their microwave backhaul. Well, the

236
00:22:09,000 --> 00:22:14,000
USRP that I have only goes up to 6 gigahertz, so how do I do this? There's really no SDR that

237
00:22:14,000 --> 00:22:19,680
covers 11 gigahertz, at least not at reasonable prices that I could find. So the answer really is

238
00:22:19,680 --> 00:22:21,100
in this book. But it's a little bit more complicated than that. It's a little bit more

239
00:22:21,120 --> 00:22:22,900
complicated than that. But it's a little bit more complicated than that. With the design of a RF

240
00:22:22,900 --> 00:22:30,300
down converter, which again, seems intimidating. But once you break it down to its individual

241
00:22:30,300 --> 00:22:35,660
system components, it's something that I think anyone who's a hardware hobbyist can achieve

242
00:22:35,660 --> 00:22:42,920
with a couple weeks effort. So these are all very good, very good resources for someone getting

243
00:22:42,920 --> 00:22:48,360
started and for someone learning maybe over the course of their first three to six months of

244
00:22:48,360 --> 00:22:50,240
really digging into software defined radio.

245
00:22:51,360 --> 00:23:01,560
Like I mentioned, links to all of this on GitHub. All right. So enough background. When you get

246
00:23:01,560 --> 00:23:06,280
out into the field, what are you going to find? What do industrial signals look like? What are

247
00:23:06,280 --> 00:23:13,960
these protocols? Why not just 802.11? What are you going to find when you get out there? So the

248
00:23:13,960 --> 00:23:19,120
first example I brought today is a protocol called wireless heart. Wireless heart is an

249
00:23:19,120 --> 00:23:21,100
international standard process automation protocol. It's an international standard process automation

250
00:23:21,120 --> 00:23:28,540
standard developed initially by the heart foundation and transferred to ISA as ISA standard 100.

251
00:23:30,700 --> 00:23:36,500
It's a field communication layer for talking with sensors and actuators in the field. So there's layer

252
00:23:36,500 --> 00:23:42,560
zero and one devices. It's just a wireless implementation of the heart protocol, which has a

253
00:23:42,560 --> 00:23:51,100
long history we won't get into. Wireless heart, though, depends on the 802.15 dash, our

254
00:23:51,120 --> 00:24:00,680
802.15.4 physical layer for transit. So that's the same physical layer that's used for Zigbee and

255
00:24:00,680 --> 00:24:08,540
other popular home automation devices. So we get lucky here because there's been a lot of security

256
00:24:08,540 --> 00:24:14,840
research into home automation protocols that are built on 802.15.4 and Zigbee and now we get to

257
00:24:14,840 --> 00:24:20,620
leverage that in our research into the security properties of wireless heart for industrial

258
00:24:20,620 --> 00:24:27,260
automation. So a little background. It is a mesh protocol where individual sensors can store and

259
00:24:27,260 --> 00:24:32,880
forward messages to a network manager, which is typically a process manager or controller or

260
00:24:32,880 --> 00:24:39,580
gateway. So talking about the way that home automation security research paid dividends here,

261
00:24:40,160 --> 00:24:48,760
you might see in the top right-hand corner my flow block there for Wireshark. So to give you a

262
00:24:48,760 --> 00:24:49,980
little bit of a walkthrough here.

263
00:24:50,620 --> 00:24:55,740
This is the source block that defines the interface to the hardware radio that I have. Where it

264
00:24:55,740 --> 00:25:01,980
defines the center frequency at the 2.41 gigahertz with some offset that I think I had defined up

265
00:25:01,980 --> 00:25:11,780
there. This block, the 802.15.4 OQPSK phi, luckily we don't really have to understand what it's

266
00:25:11,780 --> 00:25:17,100
doing in order to get what we want. This was implemented by Bastion Blessel, whose blog I

267
00:25:17,100 --> 00:25:20,600
mentioned earlier. But because this opensource block is a very, very important part of the

268
00:25:20,600 --> 00:25:25,000
source work has been done, we can just kind of ignore it. It's a black magic box. I plumb the

269
00:25:25,000 --> 00:25:30,680
lines in, I plumb the lines out, and in the top right hand corner, I get Wireshark. And the good

270
00:25:30,680 --> 00:25:37,780
news about Wireshark is, oh geez, good news about Wireshark is we know this. Right? We're

271
00:25:37,780 --> 00:25:42,980
security researchers. We know Wireshark. This is, you know, this is exactly what I want to see.

272
00:25:43,660 --> 00:25:50,380
So once we get into Wireshark, we can find some critical findings right off the bat just

273
00:25:50,380 --> 00:25:58,080
by looking into the 80154 headers that Wireshark will understand out of the box. So if you look

274
00:25:58,080 --> 00:26:02,300
up here in the frame control data field, the highlighted field, as you might imagine, the

275
00:26:02,300 --> 00:26:07,660
fourth bit from the right there in the frame control, security enabled false. So what have I

276
00:26:07,660 --> 00:26:12,600
learned already about this wireless hard implementation? Well, they're not leveraging the

277
00:26:12,600 --> 00:26:19,440
authentication and encryption features that are part of the 802.154 standard. But, you know,

278
00:26:19,440 --> 00:26:20,360
critically, Wireshark doesn't have that. They don't have the authentication and encryption

279
00:26:20,360 --> 00:26:25,640
features. Wireshark doesn't ship with a wireless heart protocol deceptor out of the box. So I'm

280
00:26:25,640 --> 00:26:30,740
still left with this kind of mysterious payload in the bottom right-hand corner. And for all I

281
00:26:30,740 --> 00:26:36,640
know, maybe they're implementing authentication and encryption further up the stack. But what we

282
00:26:36,640 --> 00:26:45,220
find is, well, no. It turns out wireless heart does use authentication and encryption as far as I

283
00:26:45,220 --> 00:26:50,340
can tell in the messages that contain sensor values. So, you know, it's a little bit of a

284
00:26:50,340 --> 00:26:52,400
mystery. It's a little bit of a mystery. It's a little bit of a mystery. It's a little bit of a mystery.

285
00:26:52,400 --> 00:26:58,500
But critically, what we've observed is that it does not give that treatment to advertisement

286
00:26:58,500 --> 00:27:03,940
messages. So the wireless heart standard is closed. It's a bit pricey to access. And

287
00:27:03,940 --> 00:27:09,820
unfortunately, the license for the one, the price that I paid does not allow me to release tools

288
00:27:09,820 --> 00:27:15,640
based on it. I'm lobbying internal for us to spend the cash so that we can open source the work

289
00:27:15,640 --> 00:27:20,320
that we've done. But we do need to work that out with the heart foundation first. So, you know, I'm

290
00:27:20,320 --> 00:27:24,560
really excited to see what happens. But what you'll see here is kind of the broken down

291
00:27:24,560 --> 00:27:30,400
version of the protocol message on the last slide. And what you learn from looking here is that

292
00:27:30,960 --> 00:27:37,480
while malicious actors can't necessarily inject data values, what they can do is join the

293
00:27:37,480 --> 00:27:43,120
network as their own nodes by injecting advertisements which potentially congest the link

294
00:27:43,120 --> 00:27:49,480
layer of the protocol and can affect network routing because it's a mesh. So, yeah, if you see

295
00:27:49,480 --> 00:27:53,440
that Knight and Newland paper that I mentioned earlier, you might get some more ideas about how

296
00:27:53,440 --> 00:27:58,960
you can abuse open advertisements. And I encourage you to check out Joe Weiss's talk at this

297
00:27:58,960 --> 00:28:05,600
village this afternoon on why you care about vulnerabilities and process sensors and

298
00:28:05,600 --> 00:28:10,320
actuators, not just the controllers that they interface with. All right. Last couple of

299
00:28:10,320 --> 00:28:19,080
minutes. Modbus RTU. These radios are ubiquitous for process control in North America. Everyone

300
00:28:19,480 --> 00:28:26,860
knows Modbus TCP is unauthenticated. And so is its predecessor, Serial Modbus. So what happens

301
00:28:26,860 --> 00:28:32,040
when you take the bits from Serial Modbus, shove them into a modem and push them out an

302
00:28:32,040 --> 00:28:41,460
antenna? Fun and profit. So pictured here, two really common modems. Both are, well, kind of by

303
00:28:41,460 --> 00:28:48,160
GE now. But this tradition extends all the way back to the 70s. You know, it's not GE's problem

304
00:28:49,860 --> 00:28:56,440
necessarily. To now-defunct manufacturers such as Daniels. They use a physical implementation, a

305
00:28:56,440 --> 00:29:03,300
modulation called AFSK, or audio frequency shift keying, which is essentially a 180-degree phase

306
00:29:03,300 --> 00:29:09,500
shift, an audio signal that's then encoded onto or modulated onto narrowband FM. So kind of

307
00:29:09,500 --> 00:29:14,680
similar to what you listen to in your car. In the case of the two radios pictured here, these are

308
00:29:15,320 --> 00:29:19,460
unlicensed 900 megahertz spectrum, but you can get them in licensed spectrum as well. And so,

309
00:29:19,480 --> 00:29:24,240
the newer ones have encryption as an option, but it's generally, in my observations, not

310
00:29:24,240 --> 00:29:28,520
implemented, because they'll ship in what's called a compatibility or interoperability mode with

311
00:29:28,520 --> 00:29:35,580
no encryption. So we'll see here, this gets a little more complicated, right? And the reason it

312
00:29:35,580 --> 00:29:38,740
gets a little more complicated is because this work hasn't been done in the open source

313
00:29:38,740 --> 00:29:44,380
literature before, so there is no black magic box for me to just pipe a signal through. But

314
00:29:44,380 --> 00:29:49,460
fundamentally, I think, again, with a few days of research, you could, you know, you could do a

315
00:29:49,480 --> 00:29:52,100
bunch of things here that you don't actually understand what's going on here. Mixing down to

316
00:29:52,100 --> 00:29:58,460
baseband, resampling to change the sample rate, you have an FM demodulation, clock recovery to

317
00:29:58,460 --> 00:30:06,040
match the beats, squelch, and then slice it out to binary and throw it out to a FIFO file sync. So

318
00:30:06,040 --> 00:30:16,140
what's that give me? Not perfect. It's cool enough, and we can simulate the matrix. So I don't

319
00:30:16,140 --> 00:30:18,400
even see the code. It's just...

320
00:30:19,700 --> 00:30:26,160
Anyway. All right. So what I'd like to get to next from that is this. So a functioning

321
00:30:26,160 --> 00:30:31,720
integration with a software Modbus server or client. So this was actually done offline

322
00:30:32,600 --> 00:30:38,900
because of some issues with my implementation of the framing for Modbus, which we don't have

323
00:30:38,900 --> 00:30:42,780
time to get into the details of today because I'm out of time. But what you can see here is

324
00:30:42,780 --> 00:30:49,460
actually PyModbus essentially reading and writing coils as a Modbus client. So this is a

325
00:30:49,480 --> 00:30:53,980
modbus server and decoding the Modbus server messages on the back end. So the implications

326
00:30:53,980 --> 00:30:59,020
here should be clear. These radios are deployed widely in North America for oil and gas pipelines

327
00:30:59,560 --> 00:31:07,320
as well as municipal water systems. And they are fundamentally just public over the air. All

328
00:31:07,320 --> 00:31:12,880
right. So that's my time. I think I'm over. I'm in it. So I just want to thank Larry,

329
00:31:13,040 --> 00:31:19,380
especially, for dealing with me. The organizers, sponsors, and volunteers at the ICS Village,

330
00:31:19,480 --> 00:31:25,060
and all you guys for coming out and waking up this morning. That's about it. I do just want to

331
00:31:25,060 --> 00:31:31,100
mention I'm on the Mandiant team at FireEye Industrial Control Systems. We are hiring. So if

332
00:31:31,100 --> 00:31:35,580
this is the kind of work that interests you, you want to learn more, come talk to me after. And

333
00:31:35,580 --> 00:31:39,520
that's my GitHub that has the links from the talk, my Twitter if you want to continue the

334
00:31:39,520 --> 00:31:43,000
conversation that way. So that's it. Thanks so much. And if you guys have questions.