1
00:00:00,000 --> 00:00:01,560
Thank you.

2
00:00:02,680 --> 00:00:16,320
Hello everyone, this is Can from Istanbul, Turkey and I am at Starcon today and we will be talking about the playing with electricity and red teaming in power distribution companies or hacking in the power distribution companies.

3
00:00:16,740 --> 00:00:21,760
Before getting started, I would like to thank the ICS village team having us.

4
00:00:21,760 --> 00:00:24,320
It's really great opportunity to meet you all.

5
00:00:24,440 --> 00:00:28,440
We really like to be part of the community activities all over the world.

6
00:00:28,520 --> 00:00:31,660
We also some community activities in Turkey as well.

7
00:00:31,660 --> 00:00:36,000
So it's really great to be meeting you all over here.

8
00:00:36,220 --> 00:00:43,760
Basically, we have one hour with you and basically we have three parts of our presentation.

9
00:00:44,620 --> 00:00:46,820
The first part is overview.

10
00:00:46,820 --> 00:01:01,460
We will make a brief information, give a brief information about the electricity architecture and power distribution company architecture and give you scale application architecture upon it.

11
00:01:01,460 --> 00:01:04,040
And then we will discuss red teaming scenarios.

12
00:01:04,040 --> 00:01:08,700
And then we will perform some attacks on our simulation lab.

13
00:01:09,780 --> 00:01:15,900
Actually, thanks to Starcon, our simulation lab had some nerve issues.

14
00:01:15,900 --> 00:01:21,280
We changed our hardware like four times last three days.

15
00:01:21,280 --> 00:01:30,700
But it worked at the end of the day and we deleted videos for this presentation to avoid any problems.

16
00:01:30,780 --> 00:01:34,940
So we will have some videos and we will talk upon it.

17
00:01:35,340 --> 00:01:39,120
All right, so let's do it.

18
00:01:39,520 --> 00:01:43,380
Starcon, please go ahead and introduce yourself, please.

19
00:01:43,420 --> 00:01:44,180
Thank you, Can.

20
00:01:44,480 --> 00:01:53,610
First of all, good afternoon for the American side spectator and maybe good night or good evening for the European and Asian side spectator.

21
00:01:53,610 --> 00:02:02,650
First of all, I'd like to thank you for giving us the opportunity in this beautiful organization and I'd like to express my pleasure being there.

22
00:02:02,970 --> 00:02:08,050
Now I will give information about myself.

23
00:02:08,050 --> 00:02:09,110
I am Serkan Temel.

24
00:02:09,110 --> 00:02:11,450
I am an electric and electronic engineer.

25
00:02:11,490 --> 00:02:21,370
I have seven years experience about industrial control systems, SCADA systems, based on electric distribution, transmission, power generation.

26
00:02:21,490 --> 00:02:31,530
For the last one year of my career, I'm focused on the cyber security in SCADA systems and also focused on the industrial control system cyber security topics.

27
00:02:32,130 --> 00:02:32,770
Thank you, Can.

28
00:02:32,770 --> 00:02:33,930
We can go on now.

29
00:02:33,990 --> 00:02:35,110
Presentation.

30
00:02:35,150 --> 00:02:41,590
I am also an electric and electronic engineer and I have more than eight years cyber security background.

31
00:02:41,590 --> 00:02:49,070
And last five years, I mostly concentrated on critical infrastructure and I say SCADA cyber security.

32
00:02:49,070 --> 00:02:57,450
At the moment, we're both working cyber wise for critical infrastructure cyber security at the moment.

33
00:02:57,450 --> 00:03:05,410
And today, as we mentioned, we will discuss electric subsector and power distribution, red teaming, and cyber security.

34
00:03:06,090 --> 00:03:06,950
All right.

35
00:03:06,950 --> 00:03:10,430
We want to start with why electric matters, actually.

36
00:03:13,030 --> 00:03:17,270
It's not just for us, but for the rest of the world.

37
00:03:17,270 --> 00:03:19,850
It's the backbone of all critical infrastructure.

38
00:03:19,850 --> 00:03:27,370
When it fails, it directly affects the daily life or modern life fundamentals.

39
00:03:27,370 --> 00:03:35,530
For example, it affects health sector, transport sector, transportation, and finance sector, and so on.

40
00:03:35,530 --> 00:03:46,370
So, once it fails, it directly affects people and public safety and it's really backbone of the critical infrastructure.

41
00:03:46,390 --> 00:03:53,930
So, we want to take that part and we wanted to build a presentation on it.

42
00:03:53,930 --> 00:04:04,250
So, we will be discussing about the red teaming in power distribution companies, but before it, we need to understand the electricity architecture in process wise.

43
00:04:04,250 --> 00:04:06,690
Basically, it has three parts.

44
00:04:06,690 --> 00:04:13,450
We have power generation, we have transmission lines, and then we have a power distribution part.

45
00:04:13,450 --> 00:04:19,050
Most of the time, power plants and power generation locate in the out-of-city centers.

46
00:04:19,130 --> 00:04:24,610
That means we need to carry electricity a long way of kilometers.

47
00:04:24,610 --> 00:04:27,370
It means we require the transmission lines.

48
00:04:27,370 --> 00:04:31,650
And finally, that means we need to power up-down operations.

49
00:04:31,670 --> 00:04:37,210
Once we are over from the transmission lines, we came up to the power distribution.

50
00:04:37,210 --> 00:04:40,950
It is the last line of the customer touch.

51
00:04:40,950 --> 00:04:48,630
I mean, if something fails in power distribution part, it directly affects customer and our business.

52
00:04:48,630 --> 00:05:01,190
To be honest, the distribution companies and electricity distribution process is not too much complicated when we compare it to power plants or petrochemical industry.

53
00:05:01,190 --> 00:05:05,330
So, it is easy to attack and also it is easy to defend.

54
00:05:06,210 --> 00:05:07,590
Serkan, would you like to add something?

55
00:05:07,590 --> 00:05:11,210
Yes, I would like to add some points in that presentation.

56
00:05:12,110 --> 00:05:19,730
Today, we tell you distribution, electric distribution, but I would like to be aware of this point.

57
00:05:20,450 --> 00:05:30,310
Transmission layer is a critical part of the electricity architecture because it's a bridge between power generation and power distribution.

58
00:05:30,310 --> 00:05:32,890
And it's the backbone of the electricity architecture.

59
00:05:33,210 --> 00:05:40,530
Today's topics are distribution, electricity, but transmission is very, very critical in the cybersecurity perspective.

60
00:05:41,030 --> 00:05:45,050
And actually, it depends over the countries or over the regions.

61
00:05:45,050 --> 00:05:47,230
Sometimes, it's operated by the government.

62
00:05:47,230 --> 00:05:50,430
Sometimes, it's operated by the private companies.

63
00:05:50,430 --> 00:05:54,290
It really depends on the region and country's perspective.

64
00:05:54,290 --> 00:06:01,630
But I will agree with you that this transmission line is also the core of electricity architecture.

65
00:06:01,690 --> 00:06:02,730
Thank you.

66
00:06:02,750 --> 00:06:08,310
So, let's deep dive into the power or electricity distribution infrastructure.

67
00:06:08,310 --> 00:06:18,350
First of all, it's a really great example of the SCADA because you have the people, which means the supervisory element of the SCADA, and you have remote locations.

68
00:06:18,350 --> 00:06:30,430
As you can see on the screen, there are lots of different substations connected via different types of communication medias to do your control center or emergency control center.

69
00:06:30,430 --> 00:06:41,450
So, what we said, it's a great example of the SCADA application because you get data from all over the different remotely located substation.

70
00:06:41,450 --> 00:06:45,430
And sometimes, you control over the remote substations.

71
00:06:45,710 --> 00:06:55,370
So, on the other hand, you have remote offices like payment offices, headquarters, government agencies to report for, you have direct integration.

72
00:06:55,370 --> 00:07:06,750
For example, in Turkey, Renewable Power Plant has to report the nearest power distribution company for the regulation.

73
00:07:07,970 --> 00:07:18,830
Basically, what we can say, there are lots of remote locations we have that we need to control, and that means we need different types of communication media.

74
00:07:18,830 --> 00:07:27,890
In distribution companies, we really need to take care of the communication media security as a part of the defense mechanism.

75
00:07:27,890 --> 00:07:40,650
On the other hand, sometimes, some companies or some governments or some countries have a smart meter application, which means smart meters have direct effective electricity.

76
00:07:40,650 --> 00:07:48,370
They open and close the electricity via metering control center through the smart meters.

77
00:07:50,430 --> 00:07:57,130
Why I'm telling you this, because it will affect our readiness scenarios and understanding the infrastructure.

78
00:07:57,230 --> 00:08:10,750
What we need to understand from this slide, we need lots of high level of connectivity, there are different types of communication media, and we have lots of different types of substation and equipments.

79
00:08:10,750 --> 00:08:15,150
And the rest of it, we have lots of different types of integration.

80
00:08:16,130 --> 00:08:26,970
All right, I will give a brief information and pass to the second stage.

81
00:08:27,430 --> 00:08:33,290
We discussed about the electricity architecture, and then we discussed about the power distribution architecture.

82
00:08:33,290 --> 00:08:37,470
Now, we will discuss about the SCADA architecture.

83
00:08:37,470 --> 00:08:40,110
It's also distributed in the server side.

84
00:08:40,110 --> 00:08:50,650
But before jumping into it, we need to understand there is a need of a high level of connectivity in such a power distribution company.

85
00:08:50,650 --> 00:08:56,050
Sometimes, you need to connect the outage management system, ERP application, call center, and so on.

86
00:08:56,050 --> 00:08:59,890
Maybe, Serkan, give some example about that.

87
00:08:59,890 --> 00:09:09,550
Yes, we mentioned about the previous presentation that we said that the distribution touches the customers.

88
00:09:09,570 --> 00:09:26,810
So, this means that in the distribution company, so many customers work into them, like customers management, outage management, VFMs, other stuff, so many stuff for the customers.

89
00:09:27,350 --> 00:09:39,690
The reason of that, the distribution SCADA systems must be and have to be integrated IT software applications, like Can mentioned, that's OMS.

90
00:09:39,690 --> 00:09:47,690
OMS, like VFM, like the other companies' third-party softwares.

91
00:09:47,690 --> 00:09:56,190
Because of that, distribution SCADA systems are a little different from the transmission and power generation SCADA systems.

92
00:09:56,470 --> 00:10:01,810
And also, in the distribution network, so many substations.

93
00:10:01,810 --> 00:10:07,290
This means that so many data, so many connection stations.

94
00:10:07,290 --> 00:10:11,550
So, we need the power of SCADA systems.

95
00:10:11,550 --> 00:10:24,130
We have to separate this load to separate servers, like application server, like communication server, like data server, like backup server, and so on, like HMI server.

96
00:10:24,330 --> 00:10:30,050
So, distribution SCADA systems are a little bit distributed and separated structure.

97
00:10:30,610 --> 00:10:34,250
It's very similar to IT environment, actually.

98
00:10:34,250 --> 00:10:37,430
You have some type of application servers, communication servers.

99
00:10:37,430 --> 00:10:45,990
It does some kind of load balancing, and it requires really great integration of an IT application or business application.

100
00:10:45,990 --> 00:10:56,090
Sometimes, part of SCADA applications, like we call outage management system or call centers, they are directly talking or integrating with our SCADA application.

101
00:10:56,090 --> 00:11:08,410
Because once you have a blackout or a kind of blackout or shut down electricity, you will get some calls, you will need to reach out your customers, you need to get some data from SCADA.

102
00:11:08,410 --> 00:11:12,990
So, it's really integrated with IT applications, sometimes cloud applications.

103
00:11:13,170 --> 00:11:21,410
And on the other hand, you have untrusted parties like vendors, remote offices, other type of control centers or government agencies.

104
00:11:21,410 --> 00:11:27,310
So, sometimes it's done via firewall, sometimes directly connected to your initial equipments.

105
00:11:27,310 --> 00:11:36,850
It really depends on the customer strategy, or sometimes they are not really aware of what kind of communication channels they have.

106
00:11:36,850 --> 00:11:50,170
But what we need to remember through here, our SCADA architecture is distributed as a server role, and it's like an IT application and it has integration with the business side.

107
00:11:50,170 --> 00:11:56,870
And also, it talks to the substation through our communication media.

108
00:11:56,870 --> 00:12:02,910
So, I will leave the comments to Serkan about substation, because he's lost.

109
00:12:03,490 --> 00:12:07,410
We have talked about the substation architecture.

110
00:12:07,410 --> 00:12:15,530
In the substation architecture distribution process, we have some main devices for the process we use.

111
00:12:15,530 --> 00:12:17,750
The first one is RETU.

112
00:12:17,750 --> 00:12:25,670
RETU is a telecontroller which connects field devices to SCADA systems.

113
00:12:25,670 --> 00:12:31,070
RETU is a data concentrator for data transfer devices.

114
00:12:31,430 --> 00:12:51,370
Energy analyzer is an energy meter which gets information from the CT and VT transformer from electric sites information and translates in the digital sites and directly sends this information to SCADA systems.

115
00:12:51,370 --> 00:13:00,610
Protection relay is a critical equipment in the distribution and also transmission and also generation, as you know that.

116
00:13:00,610 --> 00:13:09,410
Protection relay is the first IED device, first electronic device connected physical electric system.

117
00:13:09,410 --> 00:13:13,150
It is a bridge, cyber and physical world.

118
00:13:13,490 --> 00:13:21,150
The reason of that protection relay is the most critical part and most critical device in the distribution systems.

119
00:13:21,950 --> 00:13:30,330
As in cyber security perspective, if you want to shut down the electricity, you have to control the protection relay.

120
00:13:30,550 --> 00:13:35,590
But maybe you can attack the RETU, maybe attack the SCADA systems.

121
00:13:35,590 --> 00:13:40,690
It has just blocked our monitoring from the field sites.

122
00:13:40,690 --> 00:13:50,870
But if we want to control electricity, shut down electricity or re-energize the electricity, you have to control protection relay.

123
00:13:51,270 --> 00:13:53,570
The fourth device is the smart meter.

124
00:13:53,570 --> 00:14:03,910
Smart meter, as you know, that's for billing purposes and maybe low-voltage site for customer sites, shut down electricity or re-energize electricity.

125
00:14:04,770 --> 00:14:09,750
This last two devices is physical device.

126
00:14:09,750 --> 00:14:13,190
The first one is low-voltage circuit breaker.

127
00:14:13,230 --> 00:14:16,530
It is controlled electricity line.

128
00:14:17,430 --> 00:14:20,830
And the last one is the medium-voltage cubicles.

129
00:14:20,830 --> 00:14:24,810
It means circuit breaker also inside these cubicles.

130
00:14:24,810 --> 00:14:28,870
It controls the electricity line networks.

131
00:14:29,670 --> 00:14:31,670
Next slide, please.

132
00:14:32,330 --> 00:14:34,270
I think... Yeah.

133
00:14:34,270 --> 00:14:35,350
Yes.

134
00:14:36,270 --> 00:14:41,290
Yes, we have line IAD device, protection line device.

135
00:14:41,290 --> 00:14:46,430
This is... I would like to say it again because it is very critical.

136
00:14:46,590 --> 00:14:51,110
Protection device has two parts.

137
00:14:51,110 --> 00:14:53,750
One of the hardware, otherwise the software.

138
00:14:53,750 --> 00:15:03,390
The hardware side, they have unlock input, unlock output, digital input, digital output, and the other server Ethernet interface.

139
00:15:03,950 --> 00:15:18,410
Voltage and current information takes with unlock input modules and also control unlock system like set points, power, like set about the frequency, let's set about the voltage.

140
00:15:18,410 --> 00:15:20,690
You have to send unlock output.

141
00:15:20,970 --> 00:15:31,770
And digital input and digital output is mostly critical because digital input comes from basically circuit breaker position, isolated position, the other information about the systems.

142
00:15:31,770 --> 00:15:38,410
And digital output is control the circuit breakers, means that you control the electricity.

143
00:15:38,410 --> 00:15:48,570
Because of that, in the SCADA systems and most of the communication protocols or animal detection or cybersecurity perspective, we focus on the digital output signal.

144
00:15:49,390 --> 00:15:57,750
In the beginning of this device, they have serial interface because in that time, Ethernet IP world.

145
00:15:57,750 --> 00:16:06,050
And today's most of device has Ethernet interface and it gains advantage of the Ethernet IP world.

146
00:16:06,050 --> 00:16:14,170
But it is some cause of the side effect from cybersecurity, this gains of advantages.

147
00:16:14,310 --> 00:16:17,830
I will tell about later.

148
00:16:17,830 --> 00:16:30,250
On the software side, communication protocols, protocols like ISP104, DNP3, the other.

149
00:16:31,390 --> 00:16:41,570
This helps communicate with R2 or communicate with the SCADA systems to send information to the upper level.

150
00:16:41,630 --> 00:16:51,110
Logic functions control like circuit breaker or other blocking material functions, logic functions, and configuration interface.

151
00:16:51,110 --> 00:16:56,590
Critical part of the IoT device, as I mentioned, they have Ethernet interface.

152
00:16:56,670 --> 00:17:05,630
Most of IoT device nowadays use web service interface for configuration software or configuration interface.

153
00:17:05,630 --> 00:17:14,530
This is some vulnerability about systems as the weak point of this IoT device nowadays.

154
00:17:14,530 --> 00:17:17,550
Thank you, Serkan.

155
00:17:17,550 --> 00:17:30,330
Actually, we always get afraid or get freak about touch such intelligent electronic devices because as you mentioned, one part is physical that controls electricity and one part is cyber.

156
00:17:30,530 --> 00:17:40,050
It's R2 or SCADA applications and it's like a last line of the physical and cyber breach.

157
00:17:40,090 --> 00:17:57,410
Once you control it, you control the electricity, you can control it through the R2 or you can directly send commands to the IAD or you can trigger some SCADA application set points and it will directly affect the intelligent electronic devices.

158
00:17:57,410 --> 00:18:12,810
But once you're planning a red teaming or pen testing activity, you need to be aware of such devices can affect the electricity and you need to be really careful what you're playing with.

159
00:18:13,910 --> 00:18:21,380
All right, so now we can discuss about red teaming approach and red teaming scenarios.

160
00:18:23,090 --> 00:18:42,630
Before jumping into the details, I want to discuss how much red is that because since it's a critical infrastructure, since it's a last line of the custom touch, can we be really free to be really red teaming?

161
00:18:42,930 --> 00:18:54,770
In that case, most of the asset owners and most of the cybersecurity companies get afraid to or avoid the consequences of bad thing happens.

162
00:18:54,770 --> 00:19:14,430
So I may say that nobody does direct red teaming, maybe it's like light pink teaming, let's say, because we really need to be aware of that the public safety and process safety is much more important than your color activity.

163
00:19:14,850 --> 00:19:29,410
So you need to take care of the process, you need to take care of the public safety because we always think in that way if we shut down electricity for the hospital and if we kill someone in that hospital because of no electricity.

164
00:19:29,410 --> 00:19:39,710
So it really has a great boundary for us to do our test or pen testing activities or red teaming activities in a controlled way.

165
00:19:39,710 --> 00:19:49,670
So it's not really red, light pink maybe, but to understand each other in a better way, I want to express that part as well.

166
00:19:49,670 --> 00:19:52,770
So I would like to mention about the core steps.

167
00:19:53,630 --> 00:19:56,450
We divide into five main steps.

168
00:19:56,450 --> 00:20:02,350
Actually, we discussed about the first two of them to understand the process, understand the architecture.

169
00:20:02,970 --> 00:20:12,490
Once you do any red teaming activity in any kind of ICS infrastructure, in that case, we are talking about the power distribution.

170
00:20:12,490 --> 00:20:20,870
We gave brief information about the electricity architecture, distribution architecture, scale architecture, and substation architecture.

171
00:20:20,890 --> 00:20:28,830
And we thought that the power distribution company's process is not too much complicated.

172
00:20:28,830 --> 00:20:34,290
We have very limited type of signals compared to power plants and petrochemicals.

173
00:20:34,290 --> 00:20:37,190
So it's a really easy process.

174
00:20:37,190 --> 00:20:39,530
It's easy to attack and easy to defend.

175
00:20:39,530 --> 00:20:53,310
Now we need to define our landscape and then we will try to create some kind of scenarios to directly develop for red teaming activity usage.

176
00:20:53,310 --> 00:20:58,130
And then finally, we will perform some kind of attacks in our simulation lab.

177
00:20:59,270 --> 00:21:09,910
I don't want to talk about the IT-based or getting into the IT and then jumping into OT kind of red teaming activities or landscape.

178
00:21:09,910 --> 00:21:26,150
But once you are talking about the power distribution red teaming, we wanted to give you brief landscape information that what you need to know, what you are going to face, and how it will affect your planning.

179
00:21:26,530 --> 00:21:30,930
So basically, we have eight categories that we will discuss today.

180
00:21:30,930 --> 00:21:32,310
The first one is protocols.

181
00:21:32,310 --> 00:21:37,770
There are different types of protocols you will see in the field in the distribution companies.

182
00:21:37,770 --> 00:21:44,170
Basically, in scale apart, I mean the wide area network, you will see ISC-104 and DMP3.

183
00:21:44,170 --> 00:21:50,930
And substation level, you will see different types of protocols, sometimes goes MMS and so on.

184
00:21:50,930 --> 00:22:01,990
And upper level, in supervisory level, you will see soft bus and the control level, you will see Modbus, TCPR2, even sometimes Serif protocol.

185
00:22:02,110 --> 00:22:08,330
And then if you have smart meters and even in SCADA application, you may have the power line communication.

186
00:22:08,330 --> 00:22:12,250
It's not, it's still PLC, but it's a different term.

187
00:22:12,250 --> 00:22:14,610
We will discuss it today as well.

188
00:22:15,190 --> 00:22:18,470
And then we said that communication media is very important.

189
00:22:18,470 --> 00:22:40,470
If you get into the communication media somehow, let's say you get into the APN network based on GSM or you get into the RF signals, you then directly interact with substations, interact with RTUs and interact with control center equipments and emergency control center equipments.

190
00:22:40,470 --> 00:22:47,070
So communication media is also too much important for us to rectify in planning.

191
00:22:47,070 --> 00:22:50,990
On the other hand, you need to be aware of the third part integration.

192
00:22:51,430 --> 00:22:53,950
There are different types of integration.

193
00:22:53,950 --> 00:22:57,730
It depends on the country and region and the regulation.

194
00:22:58,030 --> 00:23:01,370
You see some of them in our list.

195
00:23:01,370 --> 00:23:17,030
And also as a asset owner, you have some kind of remote locations or local locations like control center, energy control center, material control center, headquarters, payment offices, or communication center for like RF towers.

196
00:23:17,190 --> 00:23:22,530
So asset owner locations also matter to us.

197
00:23:23,090 --> 00:23:38,590
On the other hand, substation is very important for us because it is remote located and physical and cyber control is very limited compared to control center or emergency control center or headquarters.

198
00:23:38,630 --> 00:23:46,850
In that case, you will be facing industry protocols on industrial devices and you may apply some kind of hooping attacks.

199
00:23:46,850 --> 00:24:02,710
What I mean by that, once you get into the specific remote substation, you can jump over the other substation, you can jump over the control center or emergency control center, you may create some fake signals.

200
00:24:03,090 --> 00:24:07,710
It's like coming from the old remote substation and so on.

201
00:24:07,710 --> 00:24:14,910
So it's a very great entry point and great defense point for us.

202
00:24:15,530 --> 00:24:20,130
But I should stress out that in substation, we have some physical controls.

203
00:24:20,130 --> 00:24:31,790
For example, if someone opens the door or if someone opens the cabinet, if someone moving in the substation, it creates some alerts and sends signals over the 104 to the control center.

204
00:24:31,790 --> 00:24:40,890
So we still have some type of controls that we need to be aware of when we plan SOC activities or when we plan red teaming activities.

205
00:24:40,890 --> 00:24:48,230
On the other hand, technology, I'm sure that all the villagers have a proper knowledge of them.

206
00:24:48,230 --> 00:25:00,310
I don't want to express each of them because it's like the IT-wise pan testing or red teaming because it's server, network devices and some kind of field devices.

207
00:25:00,430 --> 00:25:03,050
So I don't want to go each of them.

208
00:25:03,050 --> 00:25:20,410
And on the other hand, we have people, for example, in Turkey, we have a specific regulation for assessment in the power generation and distribution companies and it requires social engineering activities for the energy people, let's say the asset owner people.

209
00:25:20,410 --> 00:25:30,270
Sometimes we see that some red teaming activities hit the vendor engineers or OT partner or engineering company engineers.

210
00:25:30,850 --> 00:25:42,250
So people's segment is also really varied and different types of mechanisms they have.

211
00:25:42,250 --> 00:25:52,790
For example, in Turkey, we need to do physical pan testing, we need to do phone calling, we need to do email-based social engineering.

212
00:25:52,790 --> 00:25:56,270
It's all written down by the regulation.

213
00:25:56,390 --> 00:26:18,790
And also yet another landscape for us, the industrial process, and we will discuss it yet in another conference because since it is the less signals and it's less complicated in the power distribution and power industry, the industrial process vulnerabilities may affect public safety directly.

214
00:26:18,790 --> 00:26:35,250
So we avoid to mention the entry points of process vulnerabilities, but we can discuss it later for another industries on the following days.

215
00:26:35,250 --> 00:26:43,770
All right, so I hope we understood the process, we understood the architecture, and defined some kind of landscape.

216
00:26:43,770 --> 00:26:53,410
Again, it may change the region, country, and regulation, but we need to understand the basics of a distribution.

217
00:26:53,410 --> 00:26:56,070
So we need to create some kind of scenarios.

218
00:26:56,070 --> 00:27:02,190
In this presentation, we created three types of scenarios.

219
00:27:02,190 --> 00:27:05,690
We have created a specific table for that.

220
00:27:05,690 --> 00:27:07,850
I will discuss it through them.

221
00:27:08,170 --> 00:27:12,990
And it's again not IT-based red teaming or pan testing.

222
00:27:12,990 --> 00:27:22,810
We try to create some kind of direct effect on electricity-based scenarios.

223
00:27:24,570 --> 00:27:32,210
So in the scenario, we have a chance to work with IoT team leader and hardware security leader with Fatih Kayran.

224
00:27:32,210 --> 00:27:35,910
Actually, he developed this scenario and applied it in the field.

225
00:27:35,910 --> 00:28:00,410
Once upon a time, we were in the distribution company and came up with the idea that we figured out somehow the smart meters were controlling the city's electricity, which means if we could find a way to send a proper comment to smart meters, it will directly shut down the electricity.

226
00:28:00,890 --> 00:28:05,590
In that case, the smart meters were talking through the power line communication.

227
00:28:05,590 --> 00:28:09,290
And so we created our scenario based on this.

228
00:28:09,290 --> 00:28:23,190
So to understand the team mates to each other in a better way, we create such a table to define our success criterias, difficulty factors, and decide if key change is required or not.

229
00:28:23,330 --> 00:28:33,850
I will walk through the one table and I will pass through the rest of it because we will perform a real-time simulation for the rest of it.

230
00:28:33,850 --> 00:28:39,130
In this scenario, we targeted the shutdown electricity.

231
00:28:39,150 --> 00:28:50,070
But before jumping into that, we classified our tactics and techniques based on MITRE, manipulation of control and manipulation of weave.

232
00:28:50,070 --> 00:28:54,270
And our entry point was smart meters power line communication.

233
00:28:54,330 --> 00:28:58,790
Complexity in this scenario was high.

234
00:28:58,790 --> 00:29:20,170
Difficulty was high because unknown protocols were there, specific hardware design is required, and high-voltage work environment can be dangerous because we lost one of our laptops and one of our team members got injured during this test because we worked with the high voltage directly with the plugs.

235
00:29:20,850 --> 00:29:29,990
To better understanding, you plug the smart meter into the city network.

236
00:29:29,990 --> 00:29:37,550
So you turn into that specific smart meter into weapon to target the electricity.

237
00:29:37,830 --> 00:29:42,830
For a better understanding, I will discuss it through this presentation.

238
00:29:42,830 --> 00:29:48,410
So dependency was communication interface reverse engineering or protocol reverse engineering.

239
00:29:48,410 --> 00:29:51,050
Required time was high for us.

240
00:29:51,150 --> 00:29:53,970
And also, what was our success criteria?

241
00:29:53,970 --> 00:30:03,530
Understand the protocol, send and receive packets on the power line, send command to cut off the electricity for a defined area.

242
00:30:04,350 --> 00:30:12,190
Sometimes we create some SOC success criteria for our customers to detect better the next attacks.

243
00:30:12,190 --> 00:30:23,450
In that case, it could be hardware or smart meter log management, OMS log management, call center log management, or smart meter application log management could be a success criteria in that case.

244
00:30:23,450 --> 00:30:31,510
We define log sources for red teaming activities, and then we define a purpose , method, and kill chain activity.

245
00:30:32,050 --> 00:30:46,270
In that case, our proposal was to shut down the electricity unexpected point of entry through unexpected communication media, turn plug-in meters into industrial attack equipment.

246
00:30:46,270 --> 00:30:50,250
So our idea was simple.

247
00:30:50,250 --> 00:30:55,570
So power line communication works through the power signals.

248
00:30:55,570 --> 00:31:01,550
You modulate it and put your data into the electricity signals.

249
00:31:01,550 --> 00:31:05,930
So it directly talks through the electricity.

250
00:31:06,310 --> 00:31:11,330
I think yesterday, there was a specific session about that.

251
00:31:11,330 --> 00:31:17,970
In that case, we will look into how it's used in distribution companies.

252
00:31:17,970 --> 00:31:33,970
In that case, we have the pack concentrator, which is directly connected to different types of customers, almost lightning, and there are smart meters, and there are some power line communication interfaces, and it connects to the backend system through the APN,

253
00:31:33,970 --> 00:31:36,390
in that case, over the internet.

254
00:31:36,590 --> 00:31:37,670
So guess what?

255
00:31:37,670 --> 00:31:43,110
It was the broadcast messages going through the specific power line.

256
00:31:43,210 --> 00:31:50,350
If you have specific hardware, you can develop it, or you can turn smart meter into your tool.

257
00:31:50,350 --> 00:32:00,250
In that case, we made it, and we were able to understand the reading data, and they shut down the electricity commons.

258
00:32:00,670 --> 00:32:13,590
So since it's broadcast, each of smart meters get the data, and once you give order, everyone gets the order, but one of them apply it and report back to center.

259
00:32:14,310 --> 00:32:26,390
So once you sniff the data, you see the smart meter ID, and in that case, power line communication, we're using a DLSM-QSAM protocol.

260
00:32:26,390 --> 00:32:35,730
In that case, that specific number defines the shutdown electricity command, like the double command in 104, very similar.

261
00:32:36,070 --> 00:32:41,650
And also, in that case, we were able to get readout data.

262
00:32:41,650 --> 00:32:48,370
In this case, this is the readout for DLSM-QSAM protocol.

263
00:32:49,150 --> 00:32:59,210
What we are trying to say is that you don't directly attack the SCADA application, RTUs, or IEDs.

264
00:32:59,270 --> 00:33:10,370
The best way, and easy way, is to find yet another proper line to end of your goal.

265
00:33:10,370 --> 00:33:28,990
So in that case, the power line communication and smart meters gave us a chance to shut down the electricity, but you need to deal with high voltage electricity, you need to deal with power line communication, new type of protocols, modulation, demodulation,

266
00:33:28,990 --> 00:33:33,150
encryption, type of things require much more time.

267
00:33:33,150 --> 00:33:40,750
But most of the time, the asset owners and the pen tester doesn't pay attention on the deck channel.

268
00:33:40,750 --> 00:33:48,310
So you really create a volume for your customer and people safety in that case.

269
00:33:48,310 --> 00:33:55,730
So as I know, the European countries also have great implementation of smart meters.

270
00:33:55,730 --> 00:34:00,010
We need to take care of these standards as well.

271
00:34:04,160 --> 00:34:24,680
So our last two scenarios, based on the RTUs and industrial protocols, we will show how to do industrial red teaming in a real lab environment, which took days for Serkan and got old during these sessions.

272
00:34:25,240 --> 00:34:29,960
Basically, we have two different scenarios for this presentation.

273
00:34:29,960 --> 00:34:39,580
One of them, extracting data from config files without further reverse engineering or further implementation of anything.

274
00:34:39,960 --> 00:34:56,060
The thing about that, you have some type of configuration files, you don't have any access to OT environment or substation yet, but you will figure out some type of data to plan your next session of red teaming activities.

275
00:34:56,060 --> 00:34:58,800
We have a specific example of that.

276
00:34:58,800 --> 00:35:09,580
Since I discussed deeply and very detailed the last table, I don't want to discuss it, losing any time on that.

277
00:35:09,580 --> 00:35:15,100
So I will jump into the next one, because we will discuss real scenario.

278
00:35:15,200 --> 00:35:20,220
Yet another scenario for this session is the remote substation protocol attack.

279
00:35:20,720 --> 00:35:26,640
In that case, the attacker needs to interact with the substation equipments.

280
00:35:26,640 --> 00:35:36,160
It can be done via Raspberry Pi implementation and connect through the Wi-Fi and so on, like we did in our lab environment.

281
00:35:36,380 --> 00:35:43,040
And we will shut down the electricity using the protocol commands.

282
00:35:43,040 --> 00:35:56,520
Once we understand what kind of protocols used and how, once we understand the protocols, we will figure out where to send the data and finally send the data to shut down the electricity.

283
00:35:57,920 --> 00:36:18,580
To have better understanding each other, what we are trying to say, if you are planning to red teaming activity in a power distribution company or assessment, you need to understand the process, you need to understand the architecture, you need to understand the landscape.

284
00:36:18,580 --> 00:36:22,740
Once you have a tree element, then you can create your scenarios.

285
00:36:22,740 --> 00:36:33,100
You need to think out of the box, but that box doesn't mean you can go out public safety rules or process safety rules.

286
00:36:33,100 --> 00:36:36,700
So it's really hard to balance.

287
00:36:37,260 --> 00:36:53,260
And we want to give you some simple ideas to reach out your end goal, rather than implementing some IT-based or IT-related red teaming activities.

288
00:36:54,660 --> 00:37:04,180
I think I can be free from now and put the second into fire.

289
00:37:05,020 --> 00:37:12,200
As a tradition, we are face to face with the Murphy's rule.

290
00:37:12,220 --> 00:37:15,840
But finally, we succeed on the setup a lab.

291
00:37:15,840 --> 00:37:21,220
Now I have new information about lab setup.

292
00:37:21,220 --> 00:37:25,820
It's a very simple part of substation process.

293
00:37:25,820 --> 00:37:41,260
We have one RTOS, ABB 140, and one IAD device, one SCADA server, SCADA PCs, and also one switch.

294
00:37:41,260 --> 00:37:45,180
We use CapWare software as a SCADA master.

295
00:37:45,180 --> 00:37:52,080
And also we use Modbus-TC protocol and also ISU-104 protocol.

296
00:37:52,080 --> 00:38:01,100
Modbus-TCP used in IAD device between R2 and ISU-104.

297
00:38:01,100 --> 00:38:06,880
We use it R2 between SCADA and CapWare device.

298
00:38:06,880 --> 00:38:12,560
The tricky part is the implemented hardware substation as an attacker.

299
00:38:12,560 --> 00:38:19,360
We think that we have some Raspberry Pi device or the other device as attacker machine.

300
00:38:21,440 --> 00:38:30,880
Now, before jumping into details, I would like to mention that this setup doesn't indicate any one of these on ABB RTOS.

301
00:38:30,880 --> 00:38:38,100
It's just a simple RTOS that we could use on the market, and we knew how to configure it.

302
00:38:38,100 --> 00:38:45,040
So we will do some protocol-based simulation, but it doesn't just affect the ABB.

303
00:38:45,040 --> 00:38:50,840
It's based on the leverage of the protocol usage, to avoid any misunderstanding.

304
00:38:51,240 --> 00:38:56,380
And also it is a very common RTOS used in Europe and Asian sites.

305
00:38:57,060 --> 00:39:00,900
And also this is the second reason we chose this RTOS.

306
00:39:00,940 --> 00:39:05,840
Now we can jump into the labs video.

307
00:39:06,400 --> 00:39:10,420
All right, so we will start with interfaces and signals.

308
00:39:11,640 --> 00:39:16,420
Well, first we do this about configuration RTU.

309
00:39:17,140 --> 00:39:19,710
I'll jump into that, just a second.

310
00:39:22,440 --> 00:39:30,660
Yes, we use RTU 500 software for programming RTU, configuration RTU.

311
00:39:38,690 --> 00:39:43,030
We created it before and open existing projects.

312
00:39:43,590 --> 00:39:45,650
This part a little bit takes time.

313
00:39:45,650 --> 00:39:49,530
It may be boring.

314
00:39:49,950 --> 00:39:56,330
They hide the project file deep inside my file system.

315
00:39:58,530 --> 00:40:03,950
Yes, a Turkish character error.

316
00:40:03,950 --> 00:40:09,550
Now, this is the RTU 500 software interface.

317
00:40:09,550 --> 00:40:10,630
This is the network tree.

318
00:40:10,630 --> 00:40:14,130
We have three communication lines.

319
00:40:14,130 --> 00:40:17,570
One is IEC 1 and 4 for SCADA communication.

320
00:40:17,570 --> 00:40:22,610
The other one is Modbus TCP for IED device, Modbus communication line.

321
00:40:23,690 --> 00:40:28,910
You can easily see that some parameter of the communication protocol.

322
00:40:28,910 --> 00:40:34,610
Yes, it is the 1 and 4 communication protocol setup.

323
00:40:37,130 --> 00:40:45,330
As you see, that's us-to-address, us-to-address structure, informal structure, maximum length of IDLE.

324
00:40:45,970 --> 00:40:53,410
And then, this is the Modbus TCP site configuration.

325
00:40:58,760 --> 00:41:00,360
This is network tree.

326
00:41:01,800 --> 00:41:04,620
Now, we are in hardware tree.

327
00:41:04,620 --> 00:41:10,180
In the hardware site, we choose our RTU main CPU model.

328
00:41:10,180 --> 00:41:16,140
And also, we add the field level signal information in that site, hardware site.

329
00:41:16,140 --> 00:41:23,060
And also, as you see, that the Modbus TCP communication configuration zone.

330
00:41:23,600 --> 00:41:27,040
This is the IP address of the IED device.

331
00:41:28,320 --> 00:41:37,340
And also, again, 104 configuration section.

332
00:41:37,340 --> 00:41:41,190
Now, this is the RTU interfaces.

333
00:41:42,270 --> 00:41:45,560
It has two Ethernet interfaces.

334
00:41:45,560 --> 00:41:49,470
As you see, that's IP address of the interfaces.

335
00:41:54,300 --> 00:42:00,180
And this site, we configured our field level signal, like active power.

336
00:42:00,180 --> 00:42:04,960
That is the Modbus site, withholding register, index number 13.

337
00:42:05,080 --> 00:42:13,900
And this is the SCADA ISC 104 site, us-to-address 1, information object address 103.

338
00:42:14,520 --> 00:42:18,960
And the other signals, like phase A current, phase B current.

339
00:42:19,540 --> 00:42:24,680
We record all and show the all parameters of the signal.

340
00:42:31,960 --> 00:42:35,780
And maybe you want to replay your own lab.

341
00:42:35,780 --> 00:42:40,700
So, we wanted to give you brief info in this section.

342
00:42:40,700 --> 00:42:45,460
The other sections will be much more faster, let's say.

343
00:42:46,140 --> 00:42:54,960
But once you understand that part, configuration, it's much more easier to understand the rest of the simulation.

344
00:42:55,080 --> 00:42:57,040
This is the type of the Modbus signal.

345
00:42:57,040 --> 00:43:04,220
As you see, that's force commands, signal commands, and register read-call status.

346
00:43:04,220 --> 00:43:11,560
Read-call status is used for the information, single point information, digital inputs, like position of the circuit breaker.

347
00:43:12,960 --> 00:43:17,580
And switch control means that sends control command to the circuit breaker.

348
00:43:18,280 --> 00:43:27,080
Power limit set points, and the other mid-range information, phase A current, phase B current, phase C current.

349
00:43:27,800 --> 00:43:31,980
It's a very simple model of the substation.

350
00:43:36,260 --> 00:43:39,880
So, we can jump into the second report.

351
00:43:39,880 --> 00:43:41,860
Second report.

352
00:43:44,360 --> 00:43:50,900
In this report, we directly connect the radio web interfaces.

353
00:43:50,900 --> 00:43:56,400
As you see, this is the IP address of the first Ethernet interface.

354
00:43:56,760 --> 00:44:00,100
Use username and passport.

355
00:44:00,560 --> 00:44:05,440
In that site, you can easily see that configuration management site.

356
00:44:05,440 --> 00:44:21,000
You'll see that the configuration file, which configuration is now active, when you update this configuration file, and also get configuration file from the device, and also delete this configuration, etc.

357
00:44:21,000 --> 00:44:28,320
And also, directly on site, you can easily monitor signal system log, system event status, and client session log, and also hardware tree.

358
00:44:28,320 --> 00:44:42,600
Hardware tree is the live monitoring about R2, especially in the site, you see that R2 is active, R2 is operable, means that it's connected to a device.

359
00:44:43,120 --> 00:44:51,960
As you see, that CPI switch position is on, and also metering information about systems.

360
00:44:54,140 --> 00:44:57,460
It is live data, real-time data.

361
00:45:01,060 --> 00:45:05,440
Now, I can talk about a little bit configuration file, if you wish.

362
00:45:05,660 --> 00:45:12,000
Our third video related the configuration file and extracting some data.

363
00:45:12,120 --> 00:45:30,140
Again, it doesn't indicate any vulnerabilities on the R2, but somehow, if you reach out to backup systems, or if you reach out the file server in the IT system, once we have a configuration file, now we will download it and extract some data from it.

364
00:45:30,140 --> 00:45:36,580
It's really easy, actually, before furthering reverse engineering implementation.

365
00:45:37,560 --> 00:45:43,420
In that case, we are not into the remote substation, we are not in the control room.

366
00:45:43,420 --> 00:45:47,480
Somehow, we get data about the configuration file.

367
00:45:47,480 --> 00:45:56,750
It can be an engineering workstation, file server again, or a backup system, maybe an engineering partner workstation.

368
00:45:57,100 --> 00:46:13,200
Once I get the configuration file, I am directly able to see what kind of R2 is used, what version, what purpose they are using, what kind of interfaces, and what kind of IP addresses they have.

369
00:46:13,260 --> 00:46:18,960
And also, what kind of protocols they have.

370
00:46:18,960 --> 00:46:22,560
It will affect my further planning, actually, in the red teaming activity.

371
00:46:22,560 --> 00:46:33,260
What kind of devices connected to that R2 in substation, and what kind of signal parameters they are looking for it.

372
00:46:33,260 --> 00:46:50,240
So once I have that information without any probing, any scanning activity, or any physical attachment, it's really leverage of your effort once you have that kind of specific knowledge.

373
00:46:50,420 --> 00:47:11,400
We have also some specific projects that the worst engineering read all the data, not people readable format at the moment, you have much more better information and knowledge about the targeted system.

374
00:47:11,400 --> 00:47:19,060
So in that case, we want to show you, you don't need to go to the control center or remote substation.

375
00:47:19,120 --> 00:47:38,820
Somehow, if you are able to get config files, you may read directly with the Notepad++ and read some data, understand the process, understand the protocols, interfaces, and plan a better red teaming activity or targeted attack into the targeted system.

376
00:47:38,820 --> 00:47:41,540
So I will jump into your part, Serkan.

377
00:47:42,100 --> 00:47:51,540
Yes, the fourth video is about the normal traditional application and communication with SCADA systems and RETU.

378
00:47:52,260 --> 00:47:59,480
First of all, I will show to my IP address and same subnets with the R2 interface one.

379
00:48:02,410 --> 00:48:09,030
And then we use, said before, CAPS server as a SCADA software, SCADA master program.

380
00:48:09,910 --> 00:48:17,370
This is the configuration of the master site, CAPS player site, CAPS server site configuration file.

381
00:48:17,370 --> 00:48:23,370
As you see that communication address, common address,

382
00:48:29,160 --> 00:48:46,300
advanced settings, network interface, as we have same subnets, same IP address, more advanced parameters for IEC 1 and 4, originator address, like, and also network interface.

383
00:48:46,300 --> 00:48:52,920
Network interface means that this is the IP of the RETU and the port of the IEC 1 over 4.

384
00:48:56,420 --> 00:49:01,280
And this site, we also configure our signal.

385
00:49:01,640 --> 00:49:06,000
This means that it is analog short float volume.

386
00:49:08,640 --> 00:49:11,840
Australia is 1 over 3.

387
00:49:12,320 --> 00:49:17,900
So it is the breaker control commands, single commands means.

388
00:49:21,840 --> 00:49:26,780
Actually, it will directly affect the open and close breakers.

389
00:49:26,780 --> 00:49:30,080
Later then we will apply some scenarios.

390
00:49:30,080 --> 00:49:35,580
It's really important to understand what type of parameter and what type of commands they take.

391
00:49:35,580 --> 00:49:37,560
Now we connected to RETU.

392
00:49:37,560 --> 00:49:40,080
As you see that this is the real-time data.

393
00:49:40,420 --> 00:49:44,320
As you see, active power 2400.

394
00:49:44,820 --> 00:49:46,840
And also breaker control is zero.

395
00:49:46,840 --> 00:49:49,200
Breaker position is one, means that the closed.

396
00:49:49,500 --> 00:49:51,840
Now we sent the breaker control.

397
00:49:53,420 --> 00:49:55,700
Control command is one.

398
00:49:57,320 --> 00:49:59,600
Yes, it takes the commands.

399
00:49:59,660 --> 00:50:10,500
In the real-time and real-time operation, when we send this command, we re-energize that circuit breaker or shut down the circuit breaker with this command.

400
00:50:15,780 --> 00:50:16,980
All right.

401
00:50:18,220 --> 00:50:31,220
Now, and also I would like to show some wire shack traffics between CAPWARE and RETU.

402
00:50:32,740 --> 00:50:34,720
This is the Ethernet.

403
00:50:35,120 --> 00:50:39,560
We apply our display filter for IS104.

404
00:50:46,700 --> 00:50:51,000
Yes, as you see that this is a test frame in the protocol.

405
00:50:52,020 --> 00:50:57,860
Now we re-send the command again and show the traffic.

406
00:51:01,360 --> 00:51:06,360
Yes, this is commands, single command.

407
00:51:08,580 --> 00:51:11,260
Astro address 107.

408
00:51:11,260 --> 00:51:17,060
As you see that this is the wire shack single command.

409
00:51:18,760 --> 00:51:20,940
Address is one.

410
00:51:20,940 --> 00:51:23,020
IO address is 107.

411
00:51:23,020 --> 00:51:26,600
And also set commands value is zero.

412
00:51:26,600 --> 00:51:38,640
As you see, you can easily get this information from the wire shack because the IS104 is an open-text protocol, not encrypted or hashing protocol.

413
00:51:38,640 --> 00:51:42,140
You can easily get information from the traffic.

414
00:51:43,380 --> 00:51:50,980
In that case, you see that the single or double commands take place in IS104.

415
00:51:50,980 --> 00:51:58,520
In that case, we send a specific shutdown or open command in a targeted area.

416
00:51:58,520 --> 00:52:06,080
In case it was zero, it means we shut down the electricity through a legitimate traffic.

417
00:52:06,080 --> 00:52:11,040
I mean, it was a traffic generated by the control center.

418
00:52:11,040 --> 00:52:21,780
Now we will try to apply as an attacker point of view who is in the remote substation via implemented hardware.

419
00:52:23,000 --> 00:52:26,580
This is the fifth video of us.

420
00:52:27,960 --> 00:52:34,240
Yes, we have information about the second interface, about R2.

421
00:52:34,400 --> 00:52:43,940
Now in the attacker machine, I configure my IP address for the second interface of the R2, as you see.

422
00:52:44,320 --> 00:52:58,740
Okay, now I use mmap for some research on some search vulnerability or open ports.

423
00:53:00,420 --> 00:53:05,040
In that case, we are looking for who has an IS104.

424
00:53:05,040 --> 00:53:11,760
In that case, in that protocol, use specific ports if nobody changes it.

425
00:53:11,760 --> 00:53:18,220
So we are looking for the same subnet if someone has that specific protocol.

426
00:53:18,220 --> 00:53:29,420
Please be aware it's an attacker point of view and got into the substation looking for some IS104 endpoints and two devices.

427
00:53:29,420 --> 00:53:30,900
We found it.

428
00:53:31,440 --> 00:53:42,080
This is retail device as you see from the IP address and also IS104 is open port and also services up.

429
00:53:44,700 --> 00:53:54,980
But now we have only information about R2's protocols and R2's IP address, but we don't have any information about the signal and signal address.

430
00:53:54,980 --> 00:53:58,280
Now we use CAPWARE again.

431
00:53:58,880 --> 00:54:04,960
We configure CAPWARE again, as you see.

432
00:54:16,470 --> 00:54:18,790
We tried it once.

433
00:54:19,190 --> 00:54:21,870
Now it's connected to R2.

434
00:54:22,930 --> 00:54:30,050
Now in the protocol structure, we have general integration commands.

435
00:54:30,050 --> 00:54:39,090
When we send this command, R2 gets a response and sends all information about in this R2 insight.

436
00:54:40,730 --> 00:54:43,770
We send GI commands to the retail.

437
00:54:44,010 --> 00:54:59,290
I don't know any information about the object address, but when we send this command, R2 responds to this command and now we can easily observe which address and which type of information inside of it.

438
00:54:59,490 --> 00:55:14,290
As you see that address is 1, IO address is 100 and value is also, as you see, 332, etc, etc.

439
00:55:16,290 --> 00:55:27,810
So basically protocol gives an opportunity to us to pull all kind of signals and data from the R2 for a specific protocol line.

440
00:55:27,810 --> 00:55:34,790
As an attacker, we use the exact same tool, but it's a simulation environment.

441
00:55:34,790 --> 00:55:39,630
Again, you can use your lab environment, that specific tool.

442
00:55:39,630 --> 00:55:45,970
Yet another tool we have, it's developed by, I think, the master degree student in Germany.

443
00:55:45,970 --> 00:55:48,330
It's called ISE test.

444
00:55:48,450 --> 00:55:57,670
And to make sure all of you, we will send the latest command to that specific tool.

445
00:55:58,430 --> 00:56:00,890
Next, again, R2.

446
00:56:00,930 --> 00:56:03,170
Now we send command again.

447
00:56:03,650 --> 00:56:11,730
Get information from traffic and also we send commands to 107.

448
00:56:11,790 --> 00:56:21,230
As you see from Wireshark traffic, we send commands and also on of on commands.

449
00:56:24,260 --> 00:56:34,480
And also as you, from traffic, it is action confirmation from the R2 in number of line 18 and 37.

450
00:56:37,100 --> 00:56:40,300
GCSCNA at confirmation.

451
00:56:40,300 --> 00:56:45,040
As you see, this means that R2 accepts this command.

452
00:56:48,260 --> 00:56:56,920
Once you get into the substation, you pull data through the protocol and you send the command through the protocol again.

453
00:56:56,920 --> 00:57:00,900
In that case, single command or double command supported by the 104.

454
00:57:01,140 --> 00:57:07,260
And then you are able to shut down the electricity.

455
00:57:07,260 --> 00:57:17,200
In that case, if it's your end goal, you may apply very different type of scenarios and red teaming activities, but we want to show you that it can be done.

456
00:57:17,200 --> 00:57:22,080
There are some safety mechanisms or configuration mechanisms to avoid it.

457
00:57:22,080 --> 00:57:29,540
Sometimes you implement the IP based solution or animal detection solution to count that kind of activities.

458
00:57:29,540 --> 00:57:34,460
So in this session, we are end of our presentation with takeaways.

459
00:57:34,460 --> 00:57:44,060
We would like to stress out during red teaming activity, we need to think out of the box, but we still need to take care of public and process safety.

460
00:57:44,060 --> 00:57:47,340
It's really a rule of thumb for us.

461
00:57:47,340 --> 00:58:00,520
Power distribution environment is not complicated as process-wise when compared to power plants or petrochemical, but it has directly affected the other critical infrastructures and customers directly.

462
00:58:00,780 --> 00:58:05,300
Power distribution companies have lots of different interdependencies.

463
00:58:05,640 --> 00:58:09,620
Therefore, information getters could be a role for red teaming activities.

464
00:58:10,420 --> 00:58:16,800
And power distribution companies are easy targets and easy to defend compared to other ICS infrastructure.

465
00:58:17,720 --> 00:58:20,640
So we have two minutes left.

466
00:58:20,640 --> 00:58:25,020
If you have any questions, please feel free to ask.

467
00:58:25,020 --> 00:58:30,720
We will be on Discord as well, as well as we can.

468
00:58:31,320 --> 00:58:37,640
So Serkan, if you have any comment, please do it, or we can get to questions.

469
00:58:37,800 --> 00:58:42,180
If you have any questions, we will be in Discord.

470
00:58:43,220 --> 00:58:46,980
We will be happy to answer your questions.

471
00:58:48,380 --> 00:58:51,920
John and Serkan, thank you for your talk.

472
00:58:51,920 --> 00:58:59,960
I noted in the Discord speaker Q&A that I consider this a mandatory talk to watch for both learning about 101 and assessments.

473
00:59:00,060 --> 00:59:04,760
So I really, really appreciate y'all dialing in and supporting us.

474
00:59:05,060 --> 00:59:07,120
Thank you very much for having us.

475
00:59:07,200 --> 00:59:08,600
I hope you enjoyed.