start	end	text
2110	6130	Welcome to DEF CON 28, the safe mode edition.
6130	11450	You're watching a video, or a talk, by H2C Village.
11450	14550	And this is provided to you from Obi-Wan 666.
14930	17830	Yeah, let's talk about Swimming IoT.
18250	21150	An IT and OT overview.
21270	26070	But, yeah, it's better without that mask.
26550	28990	So, I don't expect anything here.
28990	30990	So, let's go.
31830	34550	Yeah, what will we listen to today?
34550	38130	We have a short introduction over me.
38130	44110	Then we get an overview of IT and OT systems on a yacht.
44270	47710	Then we look a little bit deeper into the bridge network.
47710	52490	How the bridge network is working and how some messages are transmitted.
53570	57710	So that's more the details in the Actis Technical 101.
57710	63170	So, how is an Actis network working and how the messages are transferred.
63170	70410	How would it look like and what will be the outlook for, let's say, the next year until the next DEF CON.
71510	74550	Hopefully, back in Vegas then.
75470	76970	Yeah, why hacking yachts?
77750	80950	Accidentally, I slipped into this topic.
81530	83590	So, my boss owns one.
83590	88590	And I was able to build some devices on the ship.
88590	91650	And then I started to look at them.
93410	101870	So, mostly they are privately owned and chartered by private people.
102590	107790	And CEOs are running their business from yachts while they are traveling.
107790	114890	So, the best office that you can have is away from everyone else.
114890	119430	So, it's not crowded anyhow. So, you have your safe place.
119430	125050	And you can do the business from your office on the water.
125130	128650	So, it's a nice place to work from.
128650	134090	And all the celebrities, they are using also yachts.
134290	140890	And showing off on the famous places in the world and make their Insta-stories and so on.
140890	151410	So, if you maybe have access to a yacht where a celebrity is on, then you can do maybe some other things with that information.
153070	164470	So, the thing is then, if we have control over the yacht, the internet access for example or all the smart devices or the IT or the OT network that is on board.
164710	169190	So, what we will have there, we will see in this presentation.
169190	175450	So, my name is Stephan Gehring. I am also named Obiwan666.
175450	179030	Older than the internet, as always.
179590	189970	I have a couple of certifications like GCFA, CISSP, Microsoft Certified System Engineer, CCNA by Cisco and a couple of others.
189970	194990	So, some of them are not maintained anymore.
194990	201910	So, the one that I... my favorite one is the CISSP.
201910	206490	OSCP is the next one I maybe will start on, but yeah.
206850	209830	So, my background is an electronic specialist.
209830	216410	I was working in the German aviation army on navigation systems for helicopters.
216410	225350	And also 32 years now volunteer firefighter in my city here in beautiful Lingen.
226030	229890	Yeah, I volunteer also in a couple of groups.
229890	235810	So, Graffel is one of the things. It's a group of nerd hackers.
237030	240770	Yeah, from around Europe you can say.
240770	244890	I'm the Calvary Project I'm also working on.
244890	255330	Then we have an AG Kritis. It's an NGO on critical infrastructures and also for the CCI.
258370	261270	Yeah, what kind of networks do we have on board?
262230	269390	Yeah, so I've counted a little bit. So, I found five different networks that we can have.
269390	271250	So, it's on the IT network.
271250	277190	We have the IT network and we have the wireless network as one.
278170	283110	And then we have a couple of more networks when we look at the OT side.
284110	288490	So, you can say the bridge network is an own network.
288690	299630	So, all the navigation system and so on, everything what's needed for the operation of the ship is on the bridge connected together.
299630	301830	So, I call it the bridge network.
302250	305770	So, then we have an NMEA network or the NMEA bus.
305770	309630	So, we will see a little bit what kind of system is that.
309810	316190	Then we have an ICS network where all the PLCs and something else is connected to it.
316190	323630	And yeah, the KNX or Instabus, you can say it's also a network.
324010	329890	You can count it to the ICS network, but it can also count it to the IT network.
329890	334520	So, I have it putting here as an additional one.
334770	342090	So, I've counted here six, but yeah, it's five networks, maybe more.
343950	354090	GSM is not explicitly here in or the satellite network that we are already on seven when we counted also.
354810	357770	Okay, what have we? IT and OT.
359290	363590	Yeah, you think now yachts, what could be on there?
365450	372410	I say it's a swimming IoT device because there are so many systems on board that are connected together
372410	376870	and most of them will have also internet connection.
377110	382590	And from that point of view, so we have an ICS network and we have an IT network
384030	387190	with maybe VPN connections to offices and so on.
387190	392390	And everything is working from this small vessel.
394110	399610	In detail, we have there, for example, the VTS, the Vessel Traffic Service.
400110	403450	We have Automatic Identification System, the AIS.
403450	410470	We have autopilot, we have GPS, we have radar, we have cameras, also thermal cameras.
410470	417250	We have engine control and monitoring units that's in the ICS network.
417250	421750	Some of them are more and more cloud-based or cloud-connected now
421750	432070	so that you have access over your cloud-based devices on the engine control or the engine monitoring systems.
432070	433930	The control, that's a bad idea.
434850	440030	And we have internet access for the guests, for the crew and for the owner.
440350	447250	And a couple of entertainment systems that are also connected over various systems together.
447250	453490	So all of those things in the network view, we will see a little bit later now.
453790	459350	Over a couple of things, I have already given some talks.
461070	464450	So I will sometimes use it as a reference.
465190	469590	So for the basic overview, we have the NMEA network here.
469630	471520	So it's a bus system.
472190	475510	In the old days, it was a serial bus.
475510	481430	And it is going completely through the whole ship.
481710	487550	And it's connected with taps to the devices.
487670	491630	So this is an old serial system.
492810	500810	The connections look a little bit like the 10BASE2 connectors or the cheaper net from the old days.
500810	503230	And everything is connected to that.
503230	507440	It's not that fast. It's only 4800 baud speed.
507970	512520	And it's, as I already said, a serial communication protocol.
512970	522250	And it connects the echo sounder, sonars, anemometers, gyros, autopilots, GPS and something else.
522250	525330	There are a couple of devices more.
525490	528330	Then we have the NMEA2000.
528330	533710	This is already a CAN bus, a standard CAN bus technique.
534130	537350	And we can operate already with one megabit.
539590	542570	It's fast, but not that fast.
542570	547210	For more and more applications, we need now faster networks.
547510	554090	So the next generation is then, for example, Rainmarine calls them the SeaTalk-NG.
554090	562850	So this is also a CAN bus system.
564030	569510	But Rainmarine calls it, we call it SeaTalk-NG, next generation.
570030	572410	But it's the same like NMEA2000.
573390	577090	But the new version is SeaTalk-HS.
577770	580710	So HS is for high speed.
580710	587890	So this is a 10 megabit Ethernet network, where, for example, here you see in the pictures,
588290	592070	some camera devices and navigation systems are connected together.
592910	601770	Six is, for example, part of the bridge network, from the glass bridge series and so on.
601830	604630	And all the devices are connected together.
606690	610070	Then we have a couple of IT equipment on board.
611190	615510	And you would think now, yeah, what could be on there?
615930	620690	Well, the bigger the ships are, the more equipment is on it.
620970	626030	So the first listing that I have here is from a 30 meter yacht.
626470	631770	30 meter is not that much, but it's already a big one.
633090	640010	So here we have a half size rack, completely full with IT equipment.
640350	642270	So we have a router.
642530	645170	We have some servers, three in total.
645170	648190	We have two voice over IP gateways.
648690	658130	We have a fully equipped 84 port switch.
658950	663850	And we have an uninterruptible power supply for that.
665590	670690	In total on that trip, we had 10 smart TVs and sat receivers.
670690	679090	We had a sharp PC, 14 voice over IP telephones, internet router, UPS and four access points for the Wi-Fi.
680550	686190	This is from a 48 meter yacht.
686190	689750	So this is already a complete full rack.
689750	694050	And there is a second rack full of additional stuff.
694050	706210	And in each cabin is also a small rack with the entertainment systems and AVR system, the amplifiers and that stuff.
706590	709870	So that's in each cabin, also in extra housings.
710810	716170	And this one was from a 70 meter yacht class.
716170	720430	Here you see already two complete full equipped racks.
720430	723870	And there is a third one with a navigation system rack.
723870	735070	So it's in total on that ship already three full stacked 42 inch network racks, you can say.
736730	747070	And we had for that ship already around 25 access points, for example, to have a Wi-Fi coverage over the complete board.
748990	757210	To get an idea about what the network on the AV equipment looks like, so audio and video network.
757210	761010	So here you see it's connected to the IP network.
761010	765390	There is a Crestron device that's connecting to everything.
765390	769050	So the smart TVs are connected on the IP side.
769050	774410	No, they are not connected on the IP side.
774410	778290	They are only connected on the video side to the Crestron.
778350	783930	The Crestron is the multimedia device that is connected to the IP network.
783930	785630	So it's a little bit different.
787210	793470	But there is also an Apple TV and such receivers that you will see there.
793470	798090	So we have the Blu-rays, Apple TV and the Crestron system itself.
798090	801590	And they have also different connection types.
801970	809250	You will see it on the chart with different colors and well documented in this one.
809970	813250	We have also additional other things.
814450	818670	Most of the equipment you can access with a tablet.
819010	823890	So you have a tablet on board where you can connect to the audio and video streaming.
823890	826270	You can stream music on your tablet.
826270	838390	You can use the tablet and say in the cabin, OK, now I want to have the audio to the amplifier to listen to the audio system on my room where I'm currently in.
838390	851570	Or you go into the gym where you have flat TV screens in the ceiling where you can watch to the news or listen to music or whatever.
851570	857030	Or have multimedia training system then on there.
857030	867610	So you are cycling on your bicycle and you see a video of virtual reality where you are cycling.
867610	874870	You have also other things like light control where you can switch on the lights on and off.
875450	879690	The electric curtains, you can lever them up and down.
880290	885610	You have, for example, an engine monitor, a rudder monitor and so on.
885610	889730	So everything is accessible, for example, over the tablet.
890990	894530	On the OT side we have a couple of other things.
895270	901670	One of the monitoring systems is the engine monitoring and control system.
901670	913290	Also the propulsion boat thruster, the KNX system for the light control, the PLCs, the valve controls and so on.
913290	918830	So it's a whole bunch of systems on the OT side that we have connected.
922170	932130	To get an overview of the OT, I have a couple of pictures of that that you get a feeling about what you will see.
932570	939630	So you have all those engines that are connected to, mostly two engines that you have on that.
939690	944070	Then you have two or three power generators that are connected.
944070	953090	You have a couple of heat sensors, water sensors, sensors for how many fuel is in there and so on.
953090	959310	The HVAC control, water distribution, pumps and valves and so on.
959830	965970	For example, this is only the diagram of an engine control unit.
965970	974870	So you have the engines with all the sensors. It's connected to, in this case, it's an AutoMask N400.
975630	981110	The last year when I was on, there was also an AutoMask N400 control unit on it.
981110	986290	And the engine is connected to the engine control unit.
986290	994610	There is a special safety unit, the SCU, and everything is connected with different links together.
994610	1000130	And at the end, it's everything connected to the Ethernet network.
1000130	1012830	So there is the Ethernet switch and also connections maybe to the Modbus or other bus systems that you will find here, that I have shown here.
1013850	1022430	So this is then the picture of an engine control room where the ETO is sitting.
1022430	1026090	The ETO is the electrical technical officer.
1026470	1033890	And so mostly at yachts, 60, 70 meters or that, there you have an ETO.
1033890	1041630	Below that, the technical officers, they are in charge for that.
1041630	1045710	But on bigger ships, you have a dedicated person for that.
1046190	1051530	And then you have the different monitor systems where you can see all the kinds of things.
1051530	1056350	So here we have a monitor of the engines.
1056350	1059230	So the port engine and the starboard engine.
1060490	1065810	This is an overview of the ICS network itself.
1065810	1073630	So how it is connected, how many PCs are in the network, how many PLCs systems are there and so on.
1073630	1082150	So this is, in this case, an overview of how many systems are there and where I will find it.
1083190	1088670	You have here on the right side, for example, main cabinet, remote rack and so on.
1088930	1094190	Also, a PC client in the D-net or Dynet.
1094630	1099170	This is where the crew is sitting.
1099750	1101650	There is an extra monitor.
1101650	1108570	You have clients on the bridge, on the starboard side and on the port side.
1108750	1117890	For example, in the captain's cabin, there is also a connection so that the captain, when he is at rest, he has also access to all of those systems.
1120150	1133810	And yeah, this is one of the computers that are connected to the monitors and that are connecting or getting all the information from the PLCs, for example.
1134570	1141870	And here on the right, you see also a big silver thing. I'm not sure if my mouse is here.
1141870	1146130	So this device is the network connection.
1146130	1151350	So in this case, the complete PLC network is separated.
1152390	1156870	I've seen also some other ships where this connection is active.
1156990	1167270	So this owner or this crew has decided, OK, when we don't need it, we pull the plug to the normal network so nothing is connected on that side.
1167270	1168350	Very good decision.
1168350	1175590	And when they need remote assistance, then they put a network cable into the normal hub or normal switch.
1175590	1186370	And then they can give remote access for the maintenance people that they have remote visibility or maybe can do some remote tasks on that.
1187610	1195210	This, for example, is one of the racks where the complete PLC system is.
1195210	1201430	This is a full rack of Siemens PLCs with all the subunits of that.
1201930	1209410	And here you see some kind of fuel tanks and how many fuel is in which tank.
1209430	1219970	And also you can access all the valves for the fuel tank that you can pump fuel from one tank to another one to balance the ship with that.
1220950	1224650	So this is an HMI unit, for example.
1224650	1234050	And this is one area where you maybe have to open a door for the garage or for the bath platform or whatever.
1235170	1238610	So there are some HMI units also for that.
1239970	1242530	And this is from another ship.
1242530	1250230	Even here you see the main PLCs, the rudder, the ECR and so on.
1250230	1254670	And also some other connections where we connect together.
1254950	1265830	So here you see already also a serial connection where the sensors are connected and also the network layout of that.
1266450	1273730	So this is a different system, a different ship with a different view on the things.
1273730	1277470	But in general they are doing more or less the same.
1279230	1284950	Here we have other systems. Here is more or less AVB stuff connected.
1284950	1291650	Here we have also a KNX for the light controls and so on.
1291650	1296830	So this is one of the connection boards where everything is connected together.
1297050	1301170	So this is from the electrical point of view one of the nice things.
1302590	1309910	This is another in the bridge, under the bridge or behind the bridge you can say.
1309910	1315630	So the bridge panel is on the right one, the brown thing.
1315630	1324130	And on the left one, the open thing that you see here with the wires, that is from the PLC network.
1324290	1331590	And you see in the middle two network devices that belong to the bridge network.
1331590	1334230	So that we will have a closer look at later.
1336270	1351710	So this is then also the connections where another rack is with some PLC stuff and connecting the information from the systems.
1351930	1359110	And here we have another connection system. So everything is connected over Ethernet together.
1360850	1363450	What kind of attack records we have there?
1363930	1369910	So this is a network diagram that I have wrote or painted.
1371350	1380150	And I think I have to adjust it a little bit because there are a few things that are now missing when I look at it.
1380150	1390530	But in general, we can say we can attack the systems over the Internet, for example, if we have access to the Internet router.
1390710	1403650	In my last year talk, I have shown how to bypass authentication, for example, on an Internet router model with the vulnerabilities there.
1403650	1411450	And also on the satellite systems where I had also access over the satellite modems to the network.
1412450	1420610	Of course, you can plant malware on the crew PCs or the captain PC or the owner PC or whatever.
1420610	1424330	Then you have access, for example, on that.
1425170	1437390	The personal digital assistant devices of the crew or the owners is also another point where you can plant malware or where you can start with your attacks.
1438270	1451670	And another interesting point is then once you have access on the Internet side, you have to dig for a gateway, for example, the NMEA gateway.
1451670	1457650	So the NMEA gateway is often a bidirectional gateway.
1457670	1467330	When you have access to that gateway and can plant NMEA messages on that device, you can interact also with NMEA messages on it.
1467330	1472830	But yeah, these were points of my previous talk.
1474210	1482050	And on the PLC network itself, you have a couple of other attack things that you can do.
1483430	1488910	Okay, the bridge. We have seen already a couple of OT pictures.
1489890	1492450	Now we look a little bit more on the bridge.
1492450	1495810	So this is a bridge from a 70 meter class.
1496570	1505170	You have seats for two captains, but only one rudder in the middle of the ship.
1505310	1508930	So two people can sit there and do their job.
1509390	1514370	And they have access to a couple of systems and monitors that you can see here.
1515090	1518090	I will not go in detail on the systems.
1518090	1526190	You have the OT monitoring devices. You have all the normal things to operate a ship.
1526410	1529790	And you have the navigation things that you need there.
1531770	1537830	Another side view of that. So it looks very nice there. It's a good place to work.
1538770	1544990	The view from the front, from the night. So it looks a little bit like a Star Wars ship.
1546270	1547950	I love that view.
1549090	1554190	This is from a 45 meter yacht from the inner view.
1554190	1563930	Here you have only one seat for the captain, but also a couple of monitors you will see here.
1563930	1570250	And where you will find all your necessary information to operate the ship in a safe manner.
1572290	1579910	Here on the left the monitor is already switched on. I switched on the ECTIS so that I can test some devices.
1580130	1584230	Later I had also the S-band and X-band radar on.
1585270	1589690	So I switched on only the system, but it was not translating a radar echo.
1589770	1592970	So radar in a harbor is not a good idea.
1594110	1596990	But you can switch on the system itself.
1598070	1602450	It's then in standby, but you will see the network messages.
1604990	1611310	So this is my working place when I'm looking at the yachts.
1612670	1625050	It looks nice, but sometimes the AV is not on.
1625050	1628150	So you have not that cool temperature there.
1628150	1636690	When you have outside above 30 degrees, sometimes the climate control is not working.
1636690	1640750	So it becomes hot on the bridge when they do their tests.
1640750	1644410	But in general it's a nice place to work.
1645110	1647250	I love that kind of audits.
1648930	1654670	So this is an overview that I found in the ECTIS installation guide.
1654670	1658750	For example from the Transas and NaviSailor MD4000.
1659070	1661390	They have a nice overview about it.
1661390	1665230	You have here two screens on the left and the right side.
1665270	1671730	And they are connected together so you can switch from one ECTIS to another.
1671730	1674350	And all the information you can also switch.
1675410	1680950	It's in the documentation. You can find it in the link I have put in my slides here.
1680950	1683510	So that you can put a look in.
1683510	1688130	It's more than 200 slides presentation for that.
1688470	1693690	But it's very nice to read because it is very detailed.
1693710	1702810	You can see how the datagrams are configured on the network.
1702810	1707910	That we will need later for Wireshark modules.
1711430	1716650	Here we have the network diagram in an overview.
1716870	1727170	And here we go a little bit more detailed in the DCU, the battery pack, the UPS, the keyboard, the monitor and the computer system itself.
1727170	1729670	And what kind of connections you have there.
1729670	1735370	Where it is going. For example you see here the S-Band radar connector.
1735370	1737330	There is a special board for that.
1738030	1740230	Here is another picture of that.
1741310	1745790	Here we have the X-Band and another one is the S-Band radar.
1746750	1748530	How it is connected.
1750390	1753750	In reality it looks a little bit more crowded like this.
1753750	1760410	You open the cabinets and then it looks like sometimes a little bit like a mess.
1760930	1764190	But yeah, it is working.
1764450	1773870	So this is pictures from the... I must think it's the 30 Meteor Yacht.
1774350	1782690	Yeah, that's from the 30 Meteor Yacht where I made my first holiday and got recordings from that.
1783590	1785850	This is then the PC.
1786370	1790430	That's for the navigation system.
1790810	1796390	So you think you have a navigation system with the electronic chart system.
1796390	1800670	So in general it is a Windows computer.
1801290	1810870	Windows computer with Windows software where you have your digital navigation charts on it where the navigator is navigating through the sea.
1810890	1812190	That's it.
1814090	1817350	It's connected with a hub and so on.
1818350	1827210	But when you now think about, okay, let's do an NMAP scan on the bridge network, I say think twice about it.
1827590	1832470	It's very legacy old stuff that you sometimes have.
1834650	1840210	On the 30 Meteor Yacht where I was on, it was a transit system.
1840210	1849130	The ship was 9 years old and the transit system at that time was a Windows XP embedded system.
1849890	1858990	And you can imagine, 9 years, not connected to the internet, no patches, no updates, nothing.
1859050	1860630	And it's still running.
1861770	1868090	So that was a point for me, okay, I don't make an NMAP scan on that network.
1868090	1873710	I passively connect to that and to see what's on the wire.
1874270	1886210	So I take in this case my Linux PC, it's a Kali Linux in that case, and configure my network interfaces to passively monitor the network.
1886210	1891350	And later we will look a little bit deeper in that how it is looking like.
1891350	1900630	So on the left you see my laptop connected and the bigger screen is already one of the datagrams you see there.
1900690	1908010	I will come later in the wire clamp demo where we can see a little bit more.
1908950	1913270	Then we have the Actis system itself.
1913270	1921910	So the Actis, it's the short abbreviation version of electronic chart display and information system.
1922030	1926010	In the past we had paper charts for navigation.
1927010	1931190	Also we are using a sync stand and a compass and whatever.
1931510	1934520	Compass is still there, GPS is also there.
1934970	1940690	But we need also electronic charts, so it's called ANGS.
1940690	1952270	So the thing is, under the IMO regulations it is now allowed that you don't need any paper charts anymore.
1952330	1957870	So unless you have two Actis devices, independently Actis devices.
1959790	1965850	So two Actis devices does not mean that you have two different Actis devices.
1965850	1975170	So when you update one and you update also the other one, the failure could be on both of the same systems.
1975410	1978370	Also they are connected in the same network.
1979150	1993290	When maybe an attacker is able to attack on the network area the devices, they will most likely be successful on both devices.
1993290	1999150	But yeah, you need two devices, then you are fulfilling your requirement, that's it.
1999670	2007290	So it's a navigation geographic information system for the nautical navigation of the ship.
2007310	2010110	So you have the position, heading, speed.
2010350	2017450	You have also deep information about the waterways there and also the waterways itself.
2017450	2027790	And you can have overlays on the Actis system from the NADAR, from NAVTEX, from the AIS system and so on.
2027790	2041750	So the Actis is more or less the main navigation system and you can have as an overlay, as an additional layer on top all the other systems like the radar.
2045920	2051120	This is then a picture of the Actis system, how it looks like.
2051760	2063320	This is in the port of Barcelona, for example, where you see then where the one ship is and all the other ships are also.
2064340	2069880	These are here, these small things here, they are laying in the docks.
2069920	2074140	Here is a big cruise ship and here is also another cruise ship.
2074140	2080440	And you have also the waterways, how to travel into the different areas there.
2082380	2089960	And here, the transats from the old system from 2011.
2089960	2101540	You see here, it's in Windows XP with default credentials because it's not connected to the internet and never changed it.
2101540	2108780	So it's a Windows XP system and the login name are as in the documentation of the system.
2109280	2117300	So people installed it and it's working like that. So nobody takes care about that.
2117900	2130000	So it's more likely when you have access to the network of it or accidentally someone connect the network to the other networks, then it would be not so good idea.
2131040	2136500	You can have also access on the Actis to all the NMEA messages.
2137080	2142200	You have special Modi where you can look at these informations.
2142680	2145250	But these informations you will also see on the network.
2146560	2148700	Yeah, the NMEA data is like that.
2149640	2156920	So two weeks ago I did a last audit on a 45 meter yacht.
2157540	2162980	And I was connecting them also to the network and then I found a nice information.
2162980	2176780	So one of the things what I do mostly is then sniff all the data and then using at first the statistical diagrams.
2176780	2183800	So to get an overview who is talking, how many packets are going to that.
2183940	2189940	And then here in this picture you see there is only one public IP address.
2190400	2194720	And it's only six packets in that time frame where I was scaling.
2194980	2201020	So in this case it is a Foruno Actis system. It's not a Transas, it's a Foruno.
2201020	2206040	So Transas is the major player, Foruno is the second biggest in that area.
2206040	2211420	So it doesn't matter. So technically they are doing all the same.
2213520	2217240	Yeah, this internet connection paid my attention.
2217240	2220760	And then I was looking, wow, what is this?
2221380	2224720	It's going to that address.
2224720	2227980	So I used a filter to look it up.
2227980	2230960	And yeah, it is an NTP protocol.
2232760	2237220	So the Actis system is connected to the normal network.
2238560	2247900	And then it makes a network time protocol call to an NTP server on the internet.
2248180	2251440	Why? So why it is?
2251440	2255800	Why should the bridge network connected to the internet?
2255800	2257940	So normally it makes no sense.
2258220	2262960	Especially not to get the network time from the internet.
2263000	2268160	It could be accurate, but what is when the network is not available?
2269280	2271760	And we have GPS systems on board.
2271760	2276460	So why don't take the GPS time as the time source?
2276960	2279780	So I then introduced the captain.
2279780	2283760	So hey, just take a network time protocol server.
2283760	2290360	It's a small box. It gets the time information from the GPS system.
2290440	2293380	And it's then acting as an NTP server.
2293380	2296900	And then you can say the Actis, okay, this is your NTP server.
2296900	2298520	Take the time from that.
2299140	2303600	And at this point, you don't need an internet connection anymore.
2308460	2312920	SATCOM is another thing I had in my last talk.
2312920	2314980	A couple of vulnerabilities.
2314980	2320060	So yesterday I looked up some systems there.
2320420	2323100	And there are still a couple of them online.
2324220	2325960	Why SATCOM?
2325960	2329820	So you have offshore internet access via SATCOM.
2330100	2332900	Patching mostly not.
2333140	2337100	And still many old versions are online and out there.
2338700	2344500	So technically you have a satellite antenna dish on top of the ship.
2344500	2347200	With an ICU unit for that.
2347200	2355760	And then under that you have a computer that's connected over a media exchange protocol system.
2356800	2358860	Then to the ICU.
2360980	2362560	That's simple.
2362560	2366320	It's a little bit more complicated, but that's how it looks like.
2368140	2377400	You can look on Shodan for a couple of satellite dishes that are vulnerable to things.
2377620	2384660	And the thing that I found was in Cobham CTEL systems in the MXP web server.
2385620	2389160	And this is the search string where you use it.
2389160	2392740	So this was 2018.
2392740	2395620	I had then 21 online.
2395620	2402740	So at that time I was thinking, okay, there are a couple of them online, but not that much.
2402740	2406040	But I find out a reason why it is.
2406780	2408740	I will explain later.
2411020	2415500	Yesterday I looked up, there are still 19 online.
2415520	2421080	Not really 19, you have here on port 80 15 devices that are still accessible.
2421600	2423280	Why not more?
2424700	2430500	Yeah, also Shodan has a live ship tracker.
2430900	2438620	So all the systems that are connected over VZ, we are available over the ship tracker.shodan.io.
2438640	2447280	But Shodan has decided, I don't know why, but yeah, it's okay to switch off those systems.
2447280	2450560	So the ship tracker is currently not anymore there.
2450560	2460240	So then I was thinking, okay, why not more set devices are in the internet to find?
2460440	2468920	And in my last audit, I also found out that depending on the VZ provider that you get,
2468920	2477620	they were using a network address translating, IP masquerading they're using.
2477620	2484820	So you have a private IP address on your modem device that's connecting over the satellite.
2485220	2493340	And the internet provider over satellite is making then the connection to the internet.
2493340	2499580	So it's hiding all the ships that are using the VZ to the internet.
2499840	2502220	So it's a good decision, yes.
2502220	2513400	But on the other hand, it's shifting the attack level from the bad guys in the internet to maybe bad guys at the internet providers.
2513700	2524220	So the internet provider has still the ability, if they want, or if they have to do by what kind of government,
2525240	2531860	they maybe have then access to the ship network over the internet because of the vulnerabilities that are still there.
2531860	2536140	So, yeah, the device is not visible to the internet.
2537220	2544520	And it gives the owner or the crew a deceptive security because, hey, my device is not findable over the internet.
2544600	2549820	But they are still there and the provider could exploit it now.
2549860	2554800	Or someone else who is working at the provider level.
2557340	2564520	And most of the devices that you find also using always the same default credentials.
2564520	2567880	So install it and change it.
2569560	2574100	Yeah, coming more or less to the end of my talk.
2575120	2580900	Yeah, I show a little bit more on Wireshark demos now.
2581580	2590400	But all of my tools I will publish on GitHub, also the decoders later on for Wireshark.
2590400	2597100	So I'm working on now to make some kind of active decoder for the datagrams that you see.
2597100	2601480	Because in Wireshark it's very hard to find out how this looks like.
2601940	2603480	Let's have a look for that.
2603480	2606680	So we have Wireshark here.
2608740	2615600	So this is from one of my first network audits we have here.
2616000	2619800	Many UDP protocols.
2619800	2625080	So what you see, I always use the statistics.
2625740	2629800	Let's look for the endpoints for example.
2631840	2637170	And then you see... yeah, no magnifying here.
2649160	2651200	Nope, not working.
2651660	2656990	You see then here the connections, but it's ok.
2658620	2664260	The thing that you see here is that we can make bigger.
2665120	2667740	Most of the information are UDP.
2667740	2673080	So the active is working with UDP broadcast.
2673080	2677660	They don't care about and acknowledge if the information is gone.
2677660	2683200	It's more or less a real-time traffic protocol, you can say.
2683780	2691020	So each device is broadcasting their information as a UDP broadcast on the network.
2691020	2696140	And the design of the protocol is then in that.
2696140	2708600	So when we look here, for example, for the UDP stream, then you see here a couple of information.
2710660	2712000	Look at this.
2715010	2716350	Oh, we have to wait.
2720180	2729030	I picked one of the biggest nodes.
2730630	2735810	Yeah, this is how it is looking then, like that.
2736030	2743510	But you then see here NMEA POS satellite GPS information.
2743790	2751110	So in this datagram, it's 462 bytes.
2753960	2759900	There are the GPS information that the GPS receiver, for example, gets.
2759900	2770240	So the thing is now to write a decoder for that data here that you can make as a Wireshark plug-in.
2770720	2773780	Information is more visible like that.
2773900	2781780	On the other hand, I have here also another network from the Furuno network.
2781780	2784200	It's a little bit more readable.
2785760	2793940	Here you see already something from the AIS system in that case.
2794880	2799380	And we just can take a UDP lookup.
2800620	2808130	And here you see a couple of error messages.
2809610	2817730	Receiving channel 2 malfunction, TX malfunction, external EPFS lost, and so on.
2817730	2827050	So at that time when I was sniffing on the network, there was an NMEA network gateway that was faulty.
2827110	2830090	And a couple of messages are missing.
2830950	2835510	Also you can find errors by analyzing those protocols.
2835510	2840610	So that was the idea to provide a filter for that.
2841650	2850370	And also at the Furuno network, everything is here in UDP broadcast.
2850650	2853370	Do I find another nice one?
2855870	2859390	This is, for example, an AIS message.
2861950	2872870	A malfunction message. Another one. Do I have a nice one?
2874750	2879550	Here we have a GPS information with the coordinates and so on.
2880730	2884590	Okay, let's switch back to the presentation.
2885750	2890530	Once I have it ready, I put it on my GitHub in the Maritime channel.
2892370	2894850	I have a couple of other sections there.
2894850	2902950	You find some X-ray pictures from devices, IoT devices that I analyze, and so on.
2902950	2905990	Feel free to look at it, and so on.
2906790	2909970	Coming to the end, my content details.
2909970	2913170	I have to say thank you for watching my talk.
2913170	2919070	And have a nice DEF CON 28. Stay safe.
2919810	2922950	And when you go out, always wear your mask.
2922950	2924990	Goodbye and thank you.