1
00:00:02,110 --> 00:00:06,130
Welcome to DEF CON 28, the safe mode edition.

2
00:00:06,130 --> 00:00:11,450
You're watching a video, or a talk, by H2C Village.

3
00:00:11,450 --> 00:00:14,550
And this is provided to you from Obi-Wan 666.

4
00:00:14,930 --> 00:00:17,830
Yeah, let's talk about Swimming IoT.

5
00:00:18,250 --> 00:00:21,150
An IT and OT overview.

6
00:00:21,270 --> 00:00:26,070
But, yeah, it's better without that mask.

7
00:00:26,550 --> 00:00:28,990
So, I don't expect anything here.

8
00:00:28,990 --> 00:00:30,990
So, let's go.

9
00:00:31,830 --> 00:00:34,550
Yeah, what will we listen to today?

10
00:00:34,550 --> 00:00:38,130
We have a short introduction over me.

11
00:00:38,130 --> 00:00:44,110
Then we get an overview of IT and OT systems on a yacht.

12
00:00:44,270 --> 00:00:47,710
Then we look a little bit deeper into the bridge network.

13
00:00:47,710 --> 00:00:52,490
How the bridge network is working and how some messages are transmitted.

14
00:00:53,570 --> 00:00:57,710
So that's more the details in the Actis Technical 101.

15
00:00:57,710 --> 00:01:03,170
So, how is an Actis network working and how the messages are transferred.

16
00:01:03,170 --> 00:01:10,410
How would it look like and what will be the outlook for, let's say, the next year until the next DEF CON.

17
00:01:11,510 --> 00:01:14,550
Hopefully, back in Vegas then.

18
00:01:15,470 --> 00:01:16,970
Yeah, why hacking yachts?

19
00:01:17,750 --> 00:01:20,950
Accidentally, I slipped into this topic.

20
00:01:21,530 --> 00:01:23,590
So, my boss owns one.

21
00:01:23,590 --> 00:01:28,590
And I was able to build some devices on the ship.

22
00:01:28,590 --> 00:01:31,650
And then I started to look at them.

23
00:01:33,410 --> 00:01:41,870
So, mostly they are privately owned and chartered by private people.

24
00:01:42,590 --> 00:01:47,790
And CEOs are running their business from yachts while they are traveling.

25
00:01:47,790 --> 00:01:54,890
So, the best office that you can have is away from everyone else.

26
00:01:54,890 --> 00:01:57,110
So, it's not crowded anyhow.

27
00:01:57,110 --> 00:01:59,430
So, you have your safe place.

28
00:01:59,430 --> 00:02:05,050
And you can do the business from your office on the water.

29
00:02:05,130 --> 00:02:08,650
So, it's a nice place to work from.

30
00:02:08,650 --> 00:02:14,090
And all the celebrities, they are using also yachts.

31
00:02:14,290 --> 00:02:20,890
And showing off on the famous places in the world and make their Insta-stories and so on.

32
00:02:20,890 --> 00:02:31,410
So, if you maybe have access to a yacht where a celebrity is on, then you can do maybe some other things with that information.

33
00:02:33,070 --> 00:02:44,470
So, the thing is then, if we have control over the yacht, the internet access for example or all the smart devices or the IT or the OT network that is on board.

34
00:02:44,710 --> 00:02:49,190
So, what we will have there, we will see in this presentation.

35
00:02:49,190 --> 00:02:52,270
So, my name is Stephan Gehring.

36
00:02:52,530 --> 00:02:55,450
I am also named Obiwan666.

37
00:02:55,450 --> 00:02:59,030
Older than the internet, as always.

38
00:02:59,590 --> 00:03:09,970
I have a couple of certifications like GCFA, CISSP, Microsoft Certified System Engineer, CCNA by Cisco and a couple of others.

39
00:03:09,970 --> 00:03:14,990
So, some of them are not maintained anymore.

40
00:03:14,990 --> 00:03:21,910
So, the one that I... my favorite one is the CISSP.

41
00:03:21,910 --> 00:03:26,490
OSCP is the next one I maybe will start on, but yeah.

42
00:03:26,850 --> 00:03:29,830
So, my background is an electronic specialist.

43
00:03:29,830 --> 00:03:36,410
I was working in the German aviation army on navigation systems for helicopters.

44
00:03:36,410 --> 00:03:45,350
And also 32 years now volunteer firefighter in my city here in beautiful Lingen.

45
00:03:46,030 --> 00:03:49,890
Yeah, I volunteer also in a couple of groups.

46
00:03:49,890 --> 00:03:52,510
So, Graffel is one of the things.

47
00:03:52,510 --> 00:03:55,810
It's a group of nerd hackers.

48
00:03:57,030 --> 00:04:00,770
Yeah, from around Europe you can say.

49
00:04:00,770 --> 00:04:04,890
I'm the Calvary Project I'm also working on.

50
00:04:04,890 --> 00:04:08,930
Then we have an AG Kritis.

51
00:04:08,930 --> 00:04:15,330
It's an NGO on critical infrastructures and also for the CCI.

52
00:04:18,370 --> 00:04:21,270
Yeah, what kind of networks do we have on board?

53
00:04:22,230 --> 00:04:25,370
Yeah, so I've counted a little bit.

54
00:04:25,370 --> 00:04:29,390
So, I found five different networks that we can have.

55
00:04:29,390 --> 00:04:31,250
So, it's on the IT network.

56
00:04:31,250 --> 00:04:37,190
We have the IT network and we have the wireless network as one.

57
00:04:38,170 --> 00:04:43,110
And then we have a couple of more networks when we look at the OT side.

58
00:04:44,110 --> 00:04:48,490
So, you can say the bridge network is an own network.

59
00:04:48,690 --> 00:04:59,630
So, all the navigation system and so on, everything what's needed for the operation of the ship is on the bridge connected together.

60
00:04:59,630 --> 00:05:01,830
So, I call it the bridge network.

61
00:05:02,250 --> 00:05:05,770
So, then we have an NMEA network or the NMEA bus.

62
00:05:05,770 --> 00:05:09,630
So, we will see a little bit what kind of system is that.

63
00:05:09,810 --> 00:05:16,190
Then we have an ICS network where all the PLCs and something else is connected to it.

64
00:05:16,190 --> 00:05:23,630
And yeah, the KNX or Instabus, you can say it's also a network.

65
00:05:24,010 --> 00:05:29,890
You can count it to the ICS network, but it can also count it to the IT network.

66
00:05:29,890 --> 00:05:34,520
So, I have it putting here as an additional one.

67
00:05:34,770 --> 00:05:42,090
So, I've counted here six, but yeah, it's five networks, maybe more.

68
00:05:43,950 --> 00:05:54,090
GSM is not explicitly here in or the satellite network that we are already on seven when we counted also.

69
00:05:54,810 --> 00:05:56,210
Okay, what have we?

70
00:05:56,210 --> 00:05:57,770
IT and OT.

71
00:05:59,290 --> 00:06:03,590
Yeah, you think now yachts, what could be on there?

72
00:06:05,450 --> 00:06:16,870
I say it's a swimming IoT device because there are so many systems on board that are connected together and most of them will have also internet connection.

73
00:06:17,110 --> 00:06:27,190
And from that point of view, so we have an ICS network and we have an IT network with maybe VPN connections to offices and so on.

74
00:06:27,190 --> 00:06:32,390
And everything is working from this small vessel.

75
00:06:34,110 --> 00:06:39,610
In detail, we have there, for example, the VTS, the Vessel Traffic Service.

76
00:06:40,110 --> 00:06:43,450
We have Automatic Identification System, the AIS.

77
00:06:43,450 --> 00:06:50,470
We have autopilot, we have GPS, we have radar, we have cameras, also thermal cameras.

78
00:06:50,470 --> 00:06:57,250
We have engine control and monitoring units that's in the ICS network.

79
00:06:57,250 --> 00:07:12,070
Some of them are more and more cloud-based or cloud-connected now so that you have access over your cloud-based devices on the engine control or the engine monitoring systems.

80
00:07:12,070 --> 00:07:13,930
The control, that's a bad idea.

81
00:07:14,850 --> 00:07:20,030
And we have internet access for the guests, for the crew and for the owner.

82
00:07:20,350 --> 00:07:27,250
And a couple of entertainment systems that are also connected over various systems together.

83
00:07:27,250 --> 00:07:33,490
So all of those things in the network view, we will see a little bit later now.

84
00:07:33,790 --> 00:07:39,350
Over a couple of things, I have already given some talks.

85
00:07:41,070 --> 00:07:44,450
So I will sometimes use it as a reference.

86
00:07:45,190 --> 00:07:49,590
So for the basic overview, we have the NMEA network here.

87
00:07:49,630 --> 00:07:51,520
So it's a bus system.

88
00:07:52,190 --> 00:07:55,510
In the old days, it was a serial bus.

89
00:07:55,510 --> 00:08:01,430
And it is going completely through the whole ship.

90
00:08:01,710 --> 00:08:07,550
And it's connected with taps to the devices.

91
00:08:07,670 --> 00:08:11,630
So this is an old serial system.

92
00:08:12,810 --> 00:08:20,810
The connections look a little bit like the 10BASE2 connectors or the cheaper net from the old days.

93
00:08:20,810 --> 00:08:23,230
And everything is connected to that.

94
00:08:23,230 --> 00:08:25,130
It's not that fast.

95
00:08:25,130 --> 00:08:27,440
It's only 4800 baud speed.

96
00:08:27,970 --> 00:08:32,520
And it's, as I already said, a serial communication protocol.

97
00:08:32,970 --> 00:08:42,250
And it connects the echo sounder, sonars, anemometers, gyros, autopilots, GPS and something else.

98
00:08:42,250 --> 00:08:45,330
There are a couple of devices more.

99
00:08:45,490 --> 00:08:48,330
Then we have the NMEA2000.

100
00:08:48,330 --> 00:08:53,710
This is already a CAN bus, a standard CAN bus technique.

101
00:08:54,130 --> 00:08:57,350
And we can operate already with one megabit.

102
00:08:59,590 --> 00:09:02,570
It's fast, but not that fast.

103
00:09:02,570 --> 00:09:07,210
For more and more applications, we need now faster networks.

104
00:09:07,510 --> 00:09:14,090
So the next generation is then, for example, Rainmarine calls them the SeaTalk-NG.

105
00:09:14,090 --> 00:09:22,850
So this is also a CAN bus system.

106
00:09:24,030 --> 00:09:29,510
But Rainmarine calls it, we call it SeaTalk-NG, next generation.

107
00:09:30,030 --> 00:09:32,410
But it's the same like NMEA2000.

108
00:09:33,390 --> 00:09:37,090
But the new version is SeaTalk-HS.

109
00:09:37,770 --> 00:09:40,710
So HS is for high speed.

110
00:09:40,710 --> 00:09:52,070
So this is a 10 megabit Ethernet network, where, for example, here you see in the pictures, some camera devices and navigation systems are connected together.

111
00:09:52,910 --> 00:10:01,770
Six is, for example, part of the bridge network, from the glass bridge series and so on.

112
00:10:01,830 --> 00:10:04,630
And all the devices are connected together.

113
00:10:06,690 --> 00:10:10,070
Then we have a couple of IT equipment on board.

114
00:10:11,190 --> 00:10:15,510
And you would think now, yeah, what could be on there?

115
00:10:15,930 --> 00:10:20,690
Well, the bigger the ships are, the more equipment is on it.

116
00:10:20,970 --> 00:10:26,030
So the first listing that I have here is from a 30 meter yacht.

117
00:10:26,470 --> 00:10:31,770
30 meter is not that much, but it's already a big one.

118
00:10:33,090 --> 00:10:40,010
So here we have a half size rack, completely full with IT equipment.

119
00:10:40,350 --> 00:10:42,270
So we have a router.

120
00:10:42,530 --> 00:10:45,170
We have some servers, three in total.

121
00:10:45,170 --> 00:10:48,190
We have two voice over IP gateways.

122
00:10:48,690 --> 00:10:58,130
We have a fully equipped 84 port switch.

123
00:10:58,950 --> 00:11:03,850
And we have an uninterruptible power supply for that.

124
00:11:05,590 --> 00:11:10,690
In total on that trip, we had 10 smart TVs and sat receivers.

125
00:11:10,690 --> 00:11:19,090
We had a sharp PC, 14 voice over IP telephones, internet router, UPS and four access points for the Wi-Fi.

126
00:11:20,550 --> 00:11:26,190
This is from a 48 meter yacht.

127
00:11:26,190 --> 00:11:29,750
So this is already a complete full rack.

128
00:11:29,750 --> 00:11:34,050
And there is a second rack full of additional stuff.

129
00:11:34,050 --> 00:11:46,210
And in each cabin is also a small rack with the entertainment systems and AVR system, the amplifiers and that stuff.

130
00:11:46,590 --> 00:11:49,870
So that's in each cabin, also in extra housings.

131
00:11:50,810 --> 00:11:56,170
And this one was from a 70 meter yacht class.

132
00:11:56,170 --> 00:12:00,430
Here you see already two complete full equipped racks.

133
00:12:00,430 --> 00:12:03,870
And there is a third one with a navigation system rack.

134
00:12:03,870 --> 00:12:15,070
So it's in total on that ship already three full stacked 42 inch network racks, you can say.

135
00:12:16,730 --> 00:12:27,070
And we had for that ship already around 25 access points, for example, to have a Wi-Fi coverage over the complete board.

136
00:12:28,990 --> 00:12:37,210
To get an idea about what the network on the AV equipment looks like, so audio and video network.

137
00:12:37,210 --> 00:12:41,010
So here you see it's connected to the IP network.

138
00:12:41,010 --> 00:12:45,390
There is a Crestron device that's connecting to everything.

139
00:12:45,390 --> 00:12:49,050
So the smart TVs are connected on the IP side.

140
00:12:49,050 --> 00:12:54,410
No, they are not connected on the IP side.

141
00:12:54,410 --> 00:12:58,290
They are only connected on the video side to the Crestron.

142
00:12:58,350 --> 00:13:03,930
The Crestron is the multimedia device that is connected to the IP network.

143
00:13:03,930 --> 00:13:05,630
So it's a little bit different.

144
00:13:07,210 --> 00:13:13,470
But there is also an Apple TV and such receivers that you will see there.

145
00:13:13,470 --> 00:13:18,090
So we have the Blu-rays, Apple TV and the Crestron system itself.

146
00:13:18,090 --> 00:13:21,590
And they have also different connection types.

147
00:13:21,970 --> 00:13:29,250
You will see it on the chart with different colors and well documented in this one.

148
00:13:29,970 --> 00:13:33,250
We have also additional other things.

149
00:13:34,450 --> 00:13:38,670
Most of the equipment you can access with a tablet.

150
00:13:39,010 --> 00:13:43,890
So you have a tablet on board where you can connect to the audio and video streaming.

151
00:13:43,890 --> 00:13:46,270
You can stream music on your tablet.

152
00:13:46,270 --> 00:13:58,390
You can use the tablet and say in the cabin, OK, now I want to have the audio to the amplifier to listen to the audio system on my room where I'm currently in.

153
00:13:58,390 --> 00:14:11,570
Or you go into the gym where you have flat TV screens in the ceiling where you can watch to the news or listen to music or whatever.

154
00:14:11,570 --> 00:14:17,030
Or have multimedia training system then on there.

155
00:14:17,030 --> 00:14:27,610
So you are cycling on your bicycle and you see a video of virtual reality where you are cycling.

156
00:14:27,610 --> 00:14:34,870
You have also other things like light control where you can switch on the lights on and off.

157
00:14:35,450 --> 00:14:39,690
The electric curtains, you can lever them up and down.

158
00:14:40,290 --> 00:14:45,610
You have, for example, an engine monitor, a rudder monitor and so on.

159
00:14:45,610 --> 00:14:49,730
So everything is accessible, for example, over the tablet.

160
00:14:50,990 --> 00:14:54,530
On the OT side we have a couple of other things.

161
00:14:55,270 --> 00:15:01,670
One of the monitoring systems is the engine monitoring and control system.

162
00:15:01,670 --> 00:15:13,290
Also the propulsion boat thruster, the KNX system for the light control, the PLCs, the valve controls and so on.

163
00:15:13,290 --> 00:15:18,830
So it's a whole bunch of systems on the OT side that we have connected.

164
00:15:22,170 --> 00:15:32,130
To get an overview of the OT, I have a couple of pictures of that that you get a feeling about what you will see.

165
00:15:32,570 --> 00:15:39,630
So you have all those engines that are connected to, mostly two engines that you have on that.

166
00:15:39,690 --> 00:15:44,070
Then you have two or three power generators that are connected.

167
00:15:44,070 --> 00:15:53,090
You have a couple of heat sensors, water sensors, sensors for how many fuel is in there and so on.

168
00:15:53,090 --> 00:15:59,310
The HVAC control, water distribution, pumps and valves and so on.

169
00:15:59,830 --> 00:16:05,970
For example, this is only the diagram of an engine control unit.

170
00:16:05,970 --> 00:16:09,150
So you have the engines with all the sensors.

171
00:16:09,150 --> 00:16:14,870
It's connected to, in this case, it's an AutoMask N400.

172
00:16:15,630 --> 00:16:21,110
The last year when I was on, there was also an AutoMask N400 control unit on it.

173
00:16:21,110 --> 00:16:26,290
And the engine is connected to the engine control unit.

174
00:16:26,290 --> 00:16:34,610
There is a special safety unit, the SCU, and everything is connected with different links together.

175
00:16:34,610 --> 00:16:40,130
And at the end, it's everything connected to the Ethernet network.

176
00:16:40,130 --> 00:16:52,830
So there is the Ethernet switch and also connections maybe to the Modbus or other bus systems that you will find here, that I have shown here.

177
00:16:53,850 --> 00:17:02,430
So this is then the picture of an engine control room where the ETO is sitting.

178
00:17:02,430 --> 00:17:06,090
The ETO is the electrical technical officer.

179
00:17:06,470 --> 00:17:13,890
And so mostly at yachts, 60, 70 meters or that, there you have an ETO.

180
00:17:13,890 --> 00:17:21,630
Below that, the technical officers, they are in charge for that.

181
00:17:21,630 --> 00:17:25,710
But on bigger ships, you have a dedicated person for that.

182
00:17:26,190 --> 00:17:31,530
And then you have the different monitor systems where you can see all the kinds of things.

183
00:17:31,530 --> 00:17:36,350
So here we have a monitor of the engines.

184
00:17:36,350 --> 00:17:39,230
So the port engine and the starboard engine.

185
00:17:40,490 --> 00:17:45,810
This is an overview of the ICS network itself.

186
00:17:45,810 --> 00:17:53,630
So how it is connected, how many PCs are in the network, how many PLCs systems are there and so on.

187
00:17:53,630 --> 00:18:02,150
So this is, in this case, an overview of how many systems are there and where I will find it.

188
00:18:03,190 --> 00:18:08,670
You have here on the right side, for example, main cabinet, remote rack and so on.

189
00:18:08,930 --> 00:18:14,190
Also, a PC client in the D-net or Dynet.

190
00:18:14,630 --> 00:18:19,170
This is where the crew is sitting.

191
00:18:19,750 --> 00:18:21,650
There is an extra monitor.

192
00:18:21,650 --> 00:18:28,570
You have clients on the bridge, on the starboard side and on the port side.

193
00:18:28,750 --> 00:18:37,890
For example, in the captain's cabin, there is also a connection so that the captain, when he is at rest, he has also access to all of those systems.

194
00:18:40,150 --> 00:18:53,810
And yeah, this is one of the computers that are connected to the monitors and that are connecting or getting all the information from the PLCs, for example.

195
00:18:54,570 --> 00:18:59,730
And here on the right, you see also a big silver thing.

196
00:18:59,730 --> 00:19:01,870
I'm not sure if my mouse is here.

197
00:19:01,870 --> 00:19:06,130
So this device is the network connection.

198
00:19:06,130 --> 00:19:11,350
So in this case, the complete PLC network is separated.

199
00:19:12,390 --> 00:19:16,870
I've seen also some other ships where this connection is active.

200
00:19:16,990 --> 00:19:27,270
So this owner or this crew has decided, OK, when we don't need it, we pull the plug to the normal network so nothing is connected on that side.

201
00:19:27,270 --> 00:19:28,350
Very good decision.

202
00:19:28,350 --> 00:19:35,590
And when they need remote assistance, then they put a network cable into the normal hub or normal switch.

203
00:19:35,590 --> 00:19:46,370
And then they can give remote access for the maintenance people that they have remote visibility or maybe can do some remote tasks on that.

204
00:19:47,610 --> 00:19:55,210
This, for example, is one of the racks where the complete PLC system is.

205
00:19:55,210 --> 00:20:01,430
This is a full rack of Siemens PLCs with all the subunits of that.

206
00:20:01,930 --> 00:20:09,410
And here you see some kind of fuel tanks and how many fuel is in which tank.

207
00:20:09,430 --> 00:20:19,970
And also you can access all the valves for the fuel tank that you can pump fuel from one tank to another one to balance the ship with that.

208
00:20:20,950 --> 00:20:24,650
So this is an HMI unit, for example.

209
00:20:24,650 --> 00:20:34,050
And this is one area where you maybe have to open a door for the garage or for the bath platform or whatever.

210
00:20:35,170 --> 00:20:38,610
So there are some HMI units also for that.

211
00:20:39,970 --> 00:20:42,530
And this is from another ship.

212
00:20:42,530 --> 00:20:50,230
Even here you see the main PLCs, the rudder, the ECR and so on.

213
00:20:50,230 --> 00:20:54,670
And also some other connections where we connect together.

214
00:20:54,950 --> 00:21:05,830
So here you see already also a serial connection where the sensors are connected and also the network layout of that.

215
00:21:06,450 --> 00:21:13,730
So this is a different system, a different ship with a different view on the things.

216
00:21:13,730 --> 00:21:17,470
But in general they are doing more or less the same.

217
00:21:19,230 --> 00:21:21,710
Here we have other systems.

218
00:21:21,710 --> 00:21:24,950
Here is more or less AVB stuff connected.

219
00:21:24,950 --> 00:21:31,650
Here we have also a KNX for the light controls and so on.

220
00:21:31,650 --> 00:21:36,830
So this is one of the connection boards where everything is connected together.

221
00:21:37,050 --> 00:21:41,170
So this is from the electrical point of view one of the nice things.

222
00:21:42,590 --> 00:21:49,910
This is another in the bridge, under the bridge or behind the bridge you can say.

223
00:21:49,910 --> 00:21:55,630
So the bridge panel is on the right one, the brown thing.

224
00:21:55,630 --> 00:22:04,130
And on the left one, the open thing that you see here with the wires, that is from the PLC network.

225
00:22:04,290 --> 00:22:11,590
And you see in the middle two network devices that belong to the bridge network.

226
00:22:11,590 --> 00:22:14,230
So that we will have a closer look at later.

227
00:22:16,270 --> 00:22:31,710
So this is then also the connections where another rack is with some PLC stuff and connecting the information from the systems.

228
00:22:31,930 --> 00:22:35,550
And here we have another connection system.

229
00:22:35,710 --> 00:22:39,110
So everything is connected over Ethernet together.

230
00:22:40,850 --> 00:22:43,450
What kind of attack records we have there?

231
00:22:43,930 --> 00:22:49,910
So this is a network diagram that I have wrote or painted.

232
00:22:51,350 --> 00:23:00,150
And I think I have to adjust it a little bit because there are a few things that are now missing when I look at it.

233
00:23:00,150 --> 00:23:10,530
But in general, we can say we can attack the systems over the Internet, for example, if we have access to the Internet router.

234
00:23:10,710 --> 00:23:23,650
In my last year talk, I have shown how to bypass authentication, for example, on an Internet router model with the vulnerabilities there.

235
00:23:23,650 --> 00:23:31,450
And also on the satellite systems where I had also access over the satellite modems to the network.

236
00:23:32,450 --> 00:23:40,610
Of course, you can plant malware on the crew PCs or the captain PC or the owner PC or whatever.

237
00:23:40,610 --> 00:23:44,330
Then you have access, for example, on that.

238
00:23:45,170 --> 00:23:57,390
The personal digital assistant devices of the crew or the owners is also another point where you can plant malware or where you can start with your attacks.

239
00:23:58,270 --> 00:24:11,670
And another interesting point is then once you have access on the Internet side, you have to dig for a gateway, for example, the NMEA gateway.

240
00:24:11,670 --> 00:24:17,650
So the NMEA gateway is often a bidirectional gateway.

241
00:24:17,670 --> 00:24:27,330
When you have access to that gateway and can plant NMEA messages on that device, you can interact also with NMEA messages on it.

242
00:24:27,330 --> 00:24:32,830
But yeah, these were points of my previous talk.

243
00:24:34,210 --> 00:24:42,050
And on the PLC network itself, you have a couple of other attack things that you can do.

244
00:24:43,430 --> 00:24:45,330
Okay, the bridge.

245
00:24:45,330 --> 00:24:48,910
We have seen already a couple of OT pictures.

246
00:24:49,890 --> 00:24:52,450
Now we look a little bit more on the bridge.

247
00:24:52,450 --> 00:24:55,810
So this is a bridge from a 70 meter class.

248
00:24:56,570 --> 00:25:05,170
You have seats for two captains, but only one rudder in the middle of the ship.

249
00:25:05,310 --> 00:25:08,930
So two people can sit there and do their job.

250
00:25:09,390 --> 00:25:14,370
And they have access to a couple of systems and monitors that you can see here.

251
00:25:15,090 --> 00:25:18,090
I will not go in detail on the systems.

252
00:25:18,090 --> 00:25:22,410
You have the OT monitoring devices.

253
00:25:22,470 --> 00:25:26,190
You have all the normal things to operate a ship.

254
00:25:26,410 --> 00:25:29,790
And you have the navigation things that you need there.

255
00:25:31,770 --> 00:25:33,750
Another side view of that.

256
00:25:33,750 --> 00:25:35,410
So it looks very nice there.

257
00:25:35,410 --> 00:25:37,830
It's a good place to work.

258
00:25:38,770 --> 00:25:41,490
The view from the front, from the night.

259
00:25:41,490 --> 00:25:44,990
So it looks a little bit like a Star Wars ship.

260
00:25:46,270 --> 00:25:47,950
I love that view.

261
00:25:49,090 --> 00:25:54,190
This is from a 45 meter yacht from the inner view.

262
00:25:54,190 --> 00:26:03,930
Here you have only one seat for the captain, but also a couple of monitors you will see here.

263
00:26:03,930 --> 00:26:10,250
And where you will find all your necessary information to operate the ship in a safe manner.

264
00:26:12,290 --> 00:26:15,030
Here on the left the monitor is already switched on.

265
00:26:15,030 --> 00:26:19,910
I switched on the ECTIS so that I can test some devices.

266
00:26:20,130 --> 00:26:24,230
Later I had also the S-band and X-band radar on.

267
00:26:25,270 --> 00:26:29,690
So I switched on only the system, but it was not translating a radar echo.

268
00:26:29,770 --> 00:26:32,970
So radar in a harbor is not a good idea.

269
00:26:34,110 --> 00:26:36,990
But you can switch on the system itself.

270
00:26:38,070 --> 00:26:42,450
It's then in standby, but you will see the network messages.

271
00:26:44,990 --> 00:26:51,310
So this is my working place when I'm looking at the yachts.

272
00:26:52,670 --> 00:27:05,050
It looks nice, but sometimes the AV is not on.

273
00:27:05,050 --> 00:27:08,150
So you have not that cool temperature there.

274
00:27:08,150 --> 00:27:16,690
When you have outside above 30 degrees, sometimes the climate control is not working.

275
00:27:16,690 --> 00:27:20,750
So it becomes hot on the bridge when they do their tests.

276
00:27:20,750 --> 00:27:24,410
But in general it's a nice place to work.

277
00:27:25,110 --> 00:27:27,250
I love that kind of audits.

278
00:27:28,930 --> 00:27:34,670
So this is an overview that I found in the ECTIS installation guide.

279
00:27:34,670 --> 00:27:38,750
For example from the Transas and NaviSailor MD4000.

280
00:27:39,070 --> 00:27:41,390
They have a nice overview about it.

281
00:27:41,390 --> 00:27:45,230
You have here two screens on the left and the right side.

282
00:27:45,270 --> 00:27:51,730
And they are connected together so you can switch from one ECTIS to another.

283
00:27:51,730 --> 00:27:54,350
And all the information you can also switch.

284
00:27:55,410 --> 00:27:56,910
It's in the documentation.

285
00:27:56,910 --> 00:28:00,950
You can find it in the link I have put in my slides here.

286
00:28:00,950 --> 00:28:03,510
So that you can put a look in.

287
00:28:03,510 --> 00:28:08,130
It's more than 200 slides presentation for that.

288
00:28:08,470 --> 00:28:13,690
But it's very nice to read because it is very detailed.

289
00:28:13,710 --> 00:28:22,810
You can see how the datagrams are configured on the network.

290
00:28:22,810 --> 00:28:27,910
That we will need later for Wireshark modules.

291
00:28:31,430 --> 00:28:36,650
Here we have the network diagram in an overview.

292
00:28:36,870 --> 00:28:47,170
And here we go a little bit more detailed in the DCU, the battery pack, the UPS, the keyboard, the monitor and the computer system itself.

293
00:28:47,170 --> 00:28:49,670
And what kind of connections you have there.

294
00:28:49,670 --> 00:28:51,430
Where it is going.

295
00:28:51,430 --> 00:28:55,370
For example you see here the S-Band radar connector.

296
00:28:55,370 --> 00:28:57,330
There is a special board for that.

297
00:28:58,030 --> 00:29:00,230
Here is another picture of that.

298
00:29:01,310 --> 00:29:05,790
Here we have the X-Band and another one is the S-Band radar.

299
00:29:06,750 --> 00:29:08,530
How it is connected.

300
00:29:10,390 --> 00:29:13,750
In reality it looks a little bit more crowded like this.

301
00:29:13,750 --> 00:29:20,410
You open the cabinets and then it looks like sometimes a little bit like a mess.

302
00:29:20,930 --> 00:29:24,190
But yeah, it is working.

303
00:29:24,450 --> 00:29:33,870
So this is pictures from the... I must think it's the 30 Meteor Yacht.

304
00:29:34,350 --> 00:29:42,690
Yeah, that's from the 30 Meteor Yacht where I made my first holiday and got recordings from that.

305
00:29:43,590 --> 00:29:45,850
This is then the PC.

306
00:29:46,370 --> 00:29:50,430
That's for the navigation system.

307
00:29:50,810 --> 00:29:56,390
So you think you have a navigation system with the electronic chart system.

308
00:29:56,390 --> 00:30:00,670
So in general it is a Windows computer.

309
00:30:01,290 --> 00:30:10,870
Windows computer with Windows software where you have your digital navigation charts on it where the navigator is navigating through the sea.

310
00:30:10,890 --> 00:30:12,190
That's it.

311
00:30:14,090 --> 00:30:17,350
It's connected with a hub and so on.

312
00:30:18,350 --> 00:30:27,210
But when you now think about, okay, let's do an NMAP scan on the bridge network, I say think twice about it.

313
00:30:27,590 --> 00:30:32,470
It's very legacy old stuff that you sometimes have.

314
00:30:34,650 --> 00:30:40,210
On the 30 Meteor Yacht where I was on, it was a transit system.

315
00:30:40,210 --> 00:30:49,130
The ship was 9 years old and the transit system at that time was a Windows XP embedded system.

316
00:30:49,890 --> 00:30:58,990
And you can imagine, 9 years, not connected to the internet, no patches, no updates, nothing.

317
00:30:59,050 --> 00:31:00,630
And it's still running.

318
00:31:01,770 --> 00:31:08,090
So that was a point for me, okay, I don't make an NMAP scan on that network.

319
00:31:08,090 --> 00:31:13,710
I passively connect to that and to see what's on the wire.

320
00:31:14,270 --> 00:31:26,210
So I take in this case my Linux PC, it's a Kali Linux in that case, and configure my network interfaces to passively monitor the network.

321
00:31:26,210 --> 00:31:31,350
And later we will look a little bit deeper in that how it is looking like.

322
00:31:31,350 --> 00:31:40,630
So on the left you see my laptop connected and the bigger screen is already one of the datagrams you see there.

323
00:31:40,690 --> 00:31:48,010
I will come later in the wire clamp demo where we can see a little bit more.

324
00:31:48,950 --> 00:31:53,270
Then we have the Actis system itself.

325
00:31:53,270 --> 00:32:01,910
So the Actis, it's the short abbreviation version of electronic chart display and information system.

326
00:32:02,030 --> 00:32:06,010
In the past we had paper charts for navigation.

327
00:32:07,010 --> 00:32:11,190
Also we are using a sync stand and a compass and whatever.

328
00:32:11,510 --> 00:32:14,520
Compass is still there, GPS is also there.

329
00:32:14,970 --> 00:32:20,690
But we need also electronic charts, so it's called ANGS.

330
00:32:20,690 --> 00:32:32,270
So the thing is, under the IMO regulations it is now allowed that you don't need any paper charts anymore.

331
00:32:32,330 --> 00:32:37,870
So unless you have two Actis devices, independently Actis devices.

332
00:32:39,790 --> 00:32:45,850
So two Actis devices does not mean that you have two different Actis devices.

333
00:32:45,850 --> 00:32:55,170
So when you update one and you update also the other one, the failure could be on both of the same systems.

334
00:32:55,410 --> 00:32:58,370
Also they are connected in the same network.

335
00:32:59,150 --> 00:33:13,290
When maybe an attacker is able to attack on the network area the devices, they will most likely be successful on both devices.

336
00:33:13,290 --> 00:33:19,150
But yeah, you need two devices, then you are fulfilling your requirement, that's it.

337
00:33:19,670 --> 00:33:27,290
So it's a navigation geographic information system for the nautical navigation of the ship.

338
00:33:27,310 --> 00:33:30,110
So you have the position, heading, speed.

339
00:33:30,350 --> 00:33:37,450
You have also deep information about the waterways there and also the waterways itself.

340
00:33:37,450 --> 00:33:47,790
And you can have overlays on the Actis system from the NADAR, from NAVTEX, from the AIS system and so on.

341
00:33:47,790 --> 00:34:01,750
So the Actis is more or less the main navigation system and you can have as an overlay, as an additional layer on top all the other systems like the radar.

342
00:34:05,920 --> 00:34:11,120
This is then a picture of the Actis system, how it looks like.

343
00:34:11,760 --> 00:34:23,320
This is in the port of Barcelona, for example, where you see then where the one ship is and all the other ships are also.

344
00:34:24,340 --> 00:34:29,880
These are here, these small things here, they are laying in the docks.

345
00:34:29,920 --> 00:34:34,140
Here is a big cruise ship and here is also another cruise ship.

346
00:34:34,140 --> 00:34:40,440
And you have also the waterways, how to travel into the different areas there.

347
00:34:42,380 --> 00:34:49,960
And here, the transats from the old system from 2011.

348
00:34:49,960 --> 00:35:01,540
You see here, it's in Windows XP with default credentials because it's not connected to the internet and never changed it.

349
00:35:01,540 --> 00:35:08,780
So it's a Windows XP system and the login name are as in the documentation of the system.

350
00:35:09,280 --> 00:35:14,320
So people installed it and it's working like that.

351
00:35:14,320 --> 00:35:17,300
So nobody takes care about that.

352
00:35:17,900 --> 00:35:30,000
So it's more likely when you have access to the network of it or accidentally someone connect the network to the other networks, then it would be not so good idea.

353
00:35:31,040 --> 00:35:36,500
You can have also access on the Actis to all the NMEA messages.

354
00:35:37,080 --> 00:35:42,200
You have special Modi where you can look at these informations.

355
00:35:42,680 --> 00:35:45,250
But these informations you will also see on the network.

356
00:35:46,560 --> 00:35:48,700
Yeah, the NMEA data is like that.

357
00:35:49,640 --> 00:35:56,920
So two weeks ago I did a last audit on a 45 meter yacht.

358
00:35:57,540 --> 00:36:02,980
And I was connecting them also to the network and then I found a nice information.

359
00:36:02,980 --> 00:36:16,780
So one of the things what I do mostly is then sniff all the data and then using at first the statistical diagrams.

360
00:36:16,780 --> 00:36:23,800
So to get an overview who is talking, how many packets are going to that.

361
00:36:23,940 --> 00:36:29,940
And then here in this picture you see there is only one public IP address.

362
00:36:30,400 --> 00:36:34,720
And it's only six packets in that time frame where I was scaling.

363
00:36:34,980 --> 00:36:39,120
So in this case it is a Foruno Actis system.

364
00:36:39,120 --> 00:36:41,020
It's not a Transas, it's a Foruno.

365
00:36:41,020 --> 00:36:46,040
So Transas is the major player, Foruno is the second biggest in that area.

366
00:36:46,040 --> 00:36:48,020
So it doesn't matter.

367
00:36:48,020 --> 00:36:51,420
So technically they are doing all the same.

368
00:36:53,520 --> 00:36:57,240
Yeah, this internet connection paid my attention.

369
00:36:57,240 --> 00:37:00,760
And then I was looking, wow, what is this?

370
00:37:01,380 --> 00:37:04,720
It's going to that address.

371
00:37:04,720 --> 00:37:07,980
So I used a filter to look it up.

372
00:37:07,980 --> 00:37:10,960
And yeah, it is an NTP protocol.

373
00:37:12,760 --> 00:37:17,220
So the Actis system is connected to the normal network.

374
00:37:18,560 --> 00:37:27,900
And then it makes a network time protocol call to an NTP server on the internet.

375
00:37:28,180 --> 00:37:29,500
Why?

376
00:37:29,840 --> 00:37:31,440
So why it is?

377
00:37:31,440 --> 00:37:35,800
Why should the bridge network connected to the internet?

378
00:37:35,800 --> 00:37:37,940
So normally it makes no sense.

379
00:37:38,220 --> 00:37:42,960
Especially not to get the network time from the internet.

380
00:37:43,000 --> 00:37:48,160
It could be accurate, but what is when the network is not available?

381
00:37:49,280 --> 00:37:51,760
And we have GPS systems on board.

382
00:37:51,760 --> 00:37:56,460
So why don't take the GPS time as the time source?

383
00:37:56,960 --> 00:37:59,780
So I then introduced the captain.

384
00:37:59,780 --> 00:38:03,760
So hey, just take a network time protocol server.

385
00:38:03,760 --> 00:38:05,060
It's a small box.

386
00:38:05,060 --> 00:38:10,360
It gets the time information from the GPS system.

387
00:38:10,440 --> 00:38:13,380
And it's then acting as an NTP server.

388
00:38:13,380 --> 00:38:16,900
And then you can say the Actis, okay, this is your NTP server.

389
00:38:16,900 --> 00:38:18,520
Take the time from that.

390
00:38:19,140 --> 00:38:23,600
And at this point, you don't need an internet connection anymore.

391
00:38:28,460 --> 00:38:32,920
SATCOM is another thing I had in my last talk.

392
00:38:32,920 --> 00:38:34,980
A couple of vulnerabilities.

393
00:38:34,980 --> 00:38:40,060
So yesterday I looked up some systems there.

394
00:38:40,420 --> 00:38:43,100
And there are still a couple of them online.

395
00:38:44,220 --> 00:38:45,960
Why SATCOM?

396
00:38:45,960 --> 00:38:49,820
So you have offshore internet access via SATCOM.

397
00:38:50,100 --> 00:38:52,900
Patching mostly not.

398
00:38:53,140 --> 00:38:57,100
And still many old versions are online and out there.

399
00:38:58,700 --> 00:39:04,500
So technically you have a satellite antenna dish on top of the ship.

400
00:39:04,500 --> 00:39:07,200
With an ICU unit for that.

401
00:39:07,200 --> 00:39:15,760
And then under that you have a computer that's connected over a media exchange protocol system.

402
00:39:16,800 --> 00:39:18,860
Then to the ICU.

403
00:39:20,980 --> 00:39:22,560
That's simple.

404
00:39:22,560 --> 00:39:26,320
It's a little bit more complicated, but that's how it looks like.

405
00:39:28,140 --> 00:39:37,400
You can look on Shodan for a couple of satellite dishes that are vulnerable to things.

406
00:39:37,620 --> 00:39:44,660
And the thing that I found was in Cobham CTEL systems in the MXP web server.

407
00:39:45,620 --> 00:39:49,160
And this is the search string where you use it.

408
00:39:49,160 --> 00:39:52,740
So this was 2018.

409
00:39:52,740 --> 00:39:55,620
I had then 21 online.

410
00:39:55,620 --> 00:40:02,740
So at that time I was thinking, okay, there are a couple of them online, but not that much.

411
00:40:02,740 --> 00:40:06,040
But I find out a reason why it is.

412
00:40:06,780 --> 00:40:08,740
I will explain later.

413
00:40:11,020 --> 00:40:15,500
Yesterday I looked up, there are still 19 online.

414
00:40:15,520 --> 00:40:21,080
Not really 19, you have here on port 80 15 devices that are still accessible.

415
00:40:21,600 --> 00:40:23,280
Why not more?

416
00:40:24,700 --> 00:40:30,500
Yeah, also Shodan has a live ship tracker.

417
00:40:30,900 --> 00:40:38,620
So all the systems that are connected over VZ, we are available over the ship tracker.shodan.io.

418
00:40:38,640 --> 00:40:47,280
But Shodan has decided, I don't know why, but yeah, it's okay to switch off those systems.

419
00:40:47,280 --> 00:40:50,560
So the ship tracker is currently not anymore there.

420
00:40:50,560 --> 00:41:00,240
So then I was thinking, okay, why not more set devices are in the internet to find?

421
00:41:00,440 --> 00:41:17,620
And in my last audit, I also found out that depending on the VZ provider that you get, they were using a network address translating, IP masquerading they're using.

422
00:41:17,620 --> 00:41:24,820
So you have a private IP address on your modem device that's connecting over the satellite.

423
00:41:25,220 --> 00:41:33,340
And the internet provider over satellite is making then the connection to the internet.

424
00:41:33,340 --> 00:41:39,580
So it's hiding all the ships that are using the VZ to the internet.

425
00:41:39,840 --> 00:41:42,220
So it's a good decision, yes.

426
00:41:42,220 --> 00:41:53,400
But on the other hand, it's shifting the attack level from the bad guys in the internet to maybe bad guys at the internet providers.

427
00:41:53,700 --> 00:42:11,860
So the internet provider has still the ability, if they want, or if they have to do by what kind of government, they maybe have then access to the ship network over the internet because of the vulnerabilities that are still there.

428
00:42:11,860 --> 00:42:16,140
So, yeah, the device is not visible to the internet.

429
00:42:17,220 --> 00:42:24,520
And it gives the owner or the crew a deceptive security because, hey, my device is not findable over the internet.

430
00:42:24,600 --> 00:42:29,820
But they are still there and the provider could exploit it now.

431
00:42:29,860 --> 00:42:34,800
Or someone else who is working at the provider level.

432
00:42:37,340 --> 00:42:44,520
And most of the devices that you find also using always the same default credentials.

433
00:42:44,520 --> 00:42:47,880
So install it and change it.

434
00:42:49,560 --> 00:42:54,100
Yeah, coming more or less to the end of my talk.

435
00:42:55,120 --> 00:43:00,900
Yeah, I show a little bit more on Wireshark demos now.

436
00:43:01,580 --> 00:43:10,400
But all of my tools I will publish on GitHub, also the decoders later on for Wireshark.

437
00:43:10,400 --> 00:43:17,100
So I'm working on now to make some kind of active decoder for the datagrams that you see.

438
00:43:17,100 --> 00:43:21,480
Because in Wireshark it's very hard to find out how this looks like.

439
00:43:21,940 --> 00:43:23,480
Let's have a look for that.

440
00:43:23,480 --> 00:43:26,680
So we have Wireshark here.

441
00:43:28,740 --> 00:43:35,600
So this is from one of my first network audits we have here.

442
00:43:36,000 --> 00:43:39,800
Many UDP protocols.

443
00:43:39,800 --> 00:43:45,080
So what you see, I always use the statistics.

444
00:43:45,740 --> 00:43:49,800
Let's look for the endpoints for example.

445
00:43:51,840 --> 00:43:57,170
And then you see... yeah, no magnifying here.

446
00:44:09,160 --> 00:44:11,200
Nope, not working.

447
00:44:11,660 --> 00:44:16,990
You see then here the connections, but it's ok.

448
00:44:18,620 --> 00:44:24,260
The thing that you see here is that we can make bigger.

449
00:44:25,120 --> 00:44:27,740
Most of the information are UDP.

450
00:44:27,740 --> 00:44:33,080
So the active is working with UDP broadcast.

451
00:44:33,080 --> 00:44:37,660
They don't care about and acknowledge if the information is gone.

452
00:44:37,660 --> 00:44:43,200
It's more or less a real-time traffic protocol, you can say.

453
00:44:43,780 --> 00:44:51,020
So each device is broadcasting their information as a UDP broadcast on the network.

454
00:44:51,020 --> 00:44:56,140
And the design of the protocol is then in that.

455
00:44:56,140 --> 00:45:08,600
So when we look here, for example, for the UDP stream, then you see here a couple of information.

456
00:45:10,660 --> 00:45:12,000
Look at this.

457
00:45:15,010 --> 00:45:16,350
Oh, we have to wait.

458
00:45:20,180 --> 00:45:24,700
I picked one of the biggest nodes

459
00:45:28,470 --> 00:45:29,030
.

460
00:45:30,630 --> 00:45:35,810
Yeah, this is how it is looking then, like that.

461
00:45:36,030 --> 00:45:43,510
But you then see here NMEA POS satellite GPS information.

462
00:45:43,790 --> 00:45:51,110
So in this datagram, it's 462 bytes.

463
00:45:53,960 --> 00:45:59,900
There are the GPS information that the GPS receiver, for example, gets.

464
00:45:59,900 --> 00:46:10,240
So the thing is now to write a decoder for that data here that you can make as a Wireshark plug-in.

465
00:46:10,720 --> 00:46:13,780
Information is more visible like that.

466
00:46:13,900 --> 00:46:21,780
On the other hand, I have here also another network from the Furuno network.

467
00:46:21,780 --> 00:46:24,200
It's a little bit more readable.

468
00:46:25,760 --> 00:46:33,940
Here you see already something from the AIS system in that case.

469
00:46:34,880 --> 00:46:39,380
And we just can take a UDP lookup.

470
00:46:40,620 --> 00:46:41,660
And here you see

471
00:46:46,120 --> 00:46:48,130
a couple of error messages.

472
00:46:49,610 --> 00:46:57,730
Receiving channel 2 malfunction, TX malfunction, external EPFS lost, and so on.

473
00:46:57,730 --> 00:47:07,050
So at that time when I was sniffing on the network, there was an NMEA network gateway that was faulty.

474
00:47:07,110 --> 00:47:10,090
And a couple of messages are missing.

475
00:47:10,950 --> 00:47:15,510
Also you can find errors by analyzing those protocols.

476
00:47:15,510 --> 00:47:20,610
So that was the idea to provide a filter for that.

477
00:47:21,650 --> 00:47:30,370
And also at the Furuno network, everything is here in UDP broadcast.

478
00:47:30,650 --> 00:47:33,370
Do I find another nice one?

479
00:47:35,870 --> 00:47:39,390
This is, for example, an AIS message.

480
00:47:41,950 --> 00:47:44,710
A malfunction message.

481
00:47:44,750 --> 00:47:45,570
Another one

482
00:47:50,870 --> 00:47:51,210
.

483
00:47:51,210 --> 00:47:52,870
Do I have a nice one?

484
00:47:54,750 --> 00:47:59,550
Here we have a GPS information with the coordinates and so on.

485
00:48:00,730 --> 00:48:04,590
Okay, let's switch back to the presentation.

486
00:48:05,750 --> 00:48:10,530
Once I have it ready, I put it on my GitHub in the Maritime channel.

487
00:48:12,370 --> 00:48:14,850
I have a couple of other sections there.

488
00:48:14,850 --> 00:48:22,950
You find some X-ray pictures from devices, IoT devices that I analyze, and so on.

489
00:48:22,950 --> 00:48:25,990
Feel free to look at it, and so on.

490
00:48:26,790 --> 00:48:29,970
Coming to the end, my content details.

491
00:48:29,970 --> 00:48:33,170
I have to say thank you for watching my talk.

492
00:48:33,170 --> 00:48:37,470
And have a nice DEF CON 28.

493
00:48:37,470 --> 00:48:39,070
Stay safe.

494
00:48:39,810 --> 00:48:42,950
And when you go out, always wear your mask.

495
00:48:42,950 --> 00:48:44,990
Goodbye and thank you.