Thank you. Hello everyone, this is Can from Istanbul, Turkey and I am at Starcon today
and we will be talking about the playing with electricity and red teaming in power distribution
companies or hacking in the power distribution companies. Before getting started, I would like
to thank the ICS village team having us. It's really great opportunity to meet you all.
We really like to be part of the community activities all over the world. We also some
community activities in Turkey as well. So it's really great to be meeting you all over here.
Basically, we have one hour with you and basically we have three parts of our presentation.
The first part is overview. We will make a brief information, give a brief information
about the electricity architecture and power distribution company architecture and give you
scale application architecture upon it. And then we will discuss red teaming scenarios.
And then we will perform some attacks on our simulation lab.
Actually, thanks to Starcon, our simulation lab had some nerve issues. We changed our
hardware like four times last three days. But it worked at the end of the day and we
deleted videos for this presentation to avoid any problems. So we will have some
videos and we will talk upon it. All right, so let's do it. Starcon, please go ahead and introduce
yourself, please. Thank you, Can. First of all, good afternoon for the American side spectator
and maybe good night or good evening for the European and Asian side spectator.
First of all, I'd like to thank you for giving us the opportunity in this beautiful organization
and I'd like to express my pleasure being there. Now I will give information about myself. I am
Serkan Temel. I am an electric and electronic engineer. I have seven years experience about
industrial control systems, SCADA systems, based on electric distribution, transmission,
power generation. For the last one year of my career, I'm focused on the cyber security
in SCADA systems and also focused on the industrial control system cyber security
topics. Thank you, Can. We can go on now. Presentation. I am also an electric and electronic
engineer and I have more than eight years cyber security background. And last five years,
I mostly concentrated on critical infrastructure and I say SCADA cyber security. At the moment,
we're both working cyber wise for critical infrastructure cyber security at the moment.
And today, as we mentioned, we will discuss electric subsector and power distribution,
red teaming, and cyber security. All right. We want to start with why electric matters, actually.
It's not just for us, but for the rest of the world. It's the backbone of all critical
infrastructure. When it fails, it directly affects the daily life or modern life fundamentals.
For example, it affects health sector, transport sector, transportation, and finance sector,
and so on. So, once it fails, it directly affects people and public safety and it's
really backbone of the critical infrastructure. So, we want to take that part and we wanted to
build a presentation on it. So, we will be discussing about the red teaming in power
distribution companies, but before it, we need to understand the electricity architecture in process
wise. Basically, it has three parts. We have power generation, we have transmission lines,
and then we have a power distribution part. Most of the time, power plants and power generation
locate in the out-of-city centers. That means we need to carry electricity a long way of kilometers.
It means we require the transmission lines. And finally, that means we need to power up-down
operations. Once we are over from the transmission lines, we came up to the power distribution.
It is the last line of the customer touch. I mean, if something fails in power distribution part,
it directly affects customer and our business. To be honest, the distribution companies and
electricity distribution process is not too much complicated when we compare it to power plants
or petrochemical industry. So, it is easy to attack and also it is easy to defend.
Serkan, would you like to add something? Yes, I would like to add some points in that
presentation. Today, we tell you distribution, electric distribution, but I would like to
be aware of this point. Transmission layer is a critical part of the electricity architecture
because it's a bridge between power generation and power distribution. And it's the backbone
of the electricity architecture. Today's topics are distribution, electricity, but
transmission is very, very critical in the cybersecurity perspective. And actually,
it depends over the countries or over the regions. Sometimes, it's operated by the government.
Sometimes, it's operated by the private companies. It really depends on the region and
country's perspective. But I will agree with you that this transmission line is also the core of
electricity architecture. Thank you. So, let's deep dive into the power or electricity distribution
infrastructure. First of all, it's a really great example of the SCADA because you have the people,
which means the supervisory element of the SCADA, and you have remote locations. As you can see on
the screen, there are lots of different substations connected via different types of communication
medias to do your control center or emergency control center. So, what we said, it's a great
example of the SCADA application because you get data from all over the different remotely located
substation. And sometimes, you control over the remote substations. So, on the other hand,
you have remote offices like payment offices, headquarters, government agencies to report for,
you have direct integration. For example, in Turkey, Renewable Power Plant has to report the
nearest power distribution company for the regulation.
Basically, what we can say, there are lots of remote locations we have that we need to control,
and that means we need different types of communication media. In distribution companies,
we really need to take care of the communication media security as a part of the defense
mechanism. On the other hand, sometimes, some companies or some governments or some
countries have a smart meter application, which means smart meters have direct effective
electricity. They open and close the electricity via metering control center through the smart
meters. Why I'm telling you this, because it will affect our readiness scenarios and
understanding the infrastructure. What we need to understand from this slide, we need lots of
high level of connectivity, there are different types of communication media, and we have lots
of different types of substation and equipments. And the rest of it, we have lots of different
types of integration. All right, I will give a brief information and pass to the second stage.
We discussed about the electricity architecture, and then we discussed about the power
distribution architecture. Now, we will discuss about the SCADA architecture. It's also distributed
in the server side. But before jumping into it, we need to understand there is a need of a high
level of connectivity in such a power distribution company. Sometimes, you need to connect the
outage management system, ERP application, call center, and so on. Maybe, Serkan, give
some example about that. Yes, we mentioned about the previous presentation that we said
that the distribution touches the customers. So, this means that in the distribution company,
so many customers work into them, like customers management, outage management, VFMs,
other stuff, so many stuff for the customers. The reason of that, the distribution SCADA systems
must be and have to be integrated IT software applications, like Can mentioned, that's OMS.
OMS, like VFM, like the other companies' third-party softwares. Because of that,
distribution SCADA systems are a little different from the transmission and power generation SCADA
systems. And also, in the distribution network, so many substations. This means that so many data,
so many connection stations. So, we need the power of SCADA systems. We have to separate
this load to separate servers, like application server, like communication server, like data server,
like backup server, and so on, like HMI server. So, distribution SCADA systems are a little bit
distributed and separated structure. It's very similar to IT environment, actually. You have
some type of application servers, communication servers. It does some kind of load balancing,
and it requires really great integration of an IT application or business application. Sometimes,
part of SCADA applications, like we call outage management system or call centers,
they are directly talking or integrating with our SCADA application. Because once you have
a blackout or a kind of blackout or shut down electricity, you will get some calls, you will
need to reach out your customers, you need to get some data from SCADA. So, it's really integrated
with IT applications, sometimes cloud applications. And on the other hand, you have untrusted parties
like vendors, remote offices, other type of control centers or government agencies. So,
sometimes it's done via firewall, sometimes directly connected to your initial equipments.
It really depends on the customer strategy, or sometimes they are not really aware of what kind
of communication channels they have. But what we need to remember through here,
our SCADA architecture is distributed as a server role, and it's like an IT application and
it has integration with the business side. And also, it talks to the substation through our
communication media. So, I will leave the comments to Serkan about substation, because he's
lost. We have talked about the substation architecture. In the substation architecture
distribution process, we have some main devices for the process we use.
The first one is RETU. RETU is a telecontroller which connects field devices to SCADA systems.
RETU is a data concentrator for data transfer devices. Energy analyzer is an energy meter
which gets information from the CT and VT transformer from electric sites information
and translates in the digital sites and directly sends this information to SCADA systems.
Protection relay is a critical equipment in the distribution and also transmission and also
generation, as you know that. Protection relay is the first IED device, first electronic device
connected physical electric system. It is a bridge, cyber and physical world. The reason
of that protection relay is the most critical part and most critical device in the distribution
systems. As in cyber security perspective, if you want to shut down the electricity,
you have to control the protection relay. But maybe you can attack the RETU, maybe attack
the SCADA systems. It has just blocked our monitoring from the field sites. But if we
want to control electricity, shut down electricity or re-energize the electricity, you have to
control protection relay. The fourth device is the smart meter. Smart meter, as you know,
that's for billing purposes and maybe low-voltage site for customer sites,
shut down electricity or re-energize electricity. This last two devices is physical device.
The first one is low-voltage circuit breaker. It is controlled electricity line.
And the last one is the medium-voltage cubicles. It means circuit breaker also
inside these cubicles. It controls the electricity line networks. Next slide, please.
I think... Yeah.
Yes. Yes, we have line IAD device, protection line device. This is... I would like to say
it again because it is very critical. Protection device has two parts. One of the hardware,
otherwise the software. The hardware side, they have unlock input, unlock output, digital input,
digital output, and the other server Ethernet interface. Voltage and current information
takes with unlock input modules and also control unlock system like set points, power,
like set about the frequency, let's set about the voltage. You have to send unlock output.
And digital input and digital output is mostly critical because digital input comes from
basically circuit breaker position, isolated position, the other information about the
systems. And digital output is control the circuit breakers, means that you control the
electricity. Because of that, in the SCADA systems and most of the communication protocols
or animal detection or cybersecurity perspective, we focus on the digital output signal.
In the beginning of this device, they have serial interface because in that time,
Ethernet IP world. And today's most of device has Ethernet interface and it gains
advantage of the Ethernet IP world. But it is some cause of the side effect from cybersecurity,
this gains of advantages. I will tell about later. On the software side, communication protocols,
protocols like ISP104, DNP3, the other. This helps communicate with R2 or communicate with
the SCADA systems to send information to the upper level. Logic functions control like circuit
breaker or other blocking material functions, logic functions, and configuration interface.
Critical part of the IoT device, as I mentioned, they have Ethernet interface.
Most of IoT device nowadays use web service interface for configuration
software or configuration interface. This is some vulnerability about
systems as the weak point of this IoT device nowadays.
Thank you, Serkan. Actually, we always get afraid or get freak about touch such intelligent
electronic devices because as you mentioned, one part is physical that controls electricity and
one part is cyber. It's R2 or SCADA applications and it's like a last line of the physical and
cyber breach. Once you control it, you control the electricity, you can control it through the
R2 or you can directly send commands to the IAD or you can trigger some SCADA application
set points and it will directly affect the intelligent electronic devices. But
once you're planning a red teaming or pen testing activity, you need to be aware of
such devices can affect the electricity and you need to be really careful what you're playing with.
All right, so now we can discuss about red teaming approach and red teaming scenarios.
Before jumping into the details, I want to discuss how much red is that because since
it's a critical infrastructure, since it's a last line of the custom touch,
can we be really free to be really red teaming? In that case, most of the asset owners and most
of the cybersecurity companies get afraid to or avoid the consequences of bad thing happens. So
I may say that nobody does direct red teaming, maybe it's like light pink teaming, let's say,
because we really need to be aware of that the public safety and process safety is much more
important than your color activity. So you need to take care of the process, you need to take care
of the public safety because we always think in that way if we shut down electricity for the
hospital and if we kill someone in that hospital because of no electricity. So it really has a
great boundary for us to do our test or pen testing activities or red teaming activities
in a controlled way. So it's not really red, light pink maybe, but to understand each other
in a better way, I want to express that part as well. So I would like to mention about the
core steps. We divide into five main steps. Actually, we discussed about the first two of them
to understand the process, understand the architecture. Once you do any red teaming
activity in any kind of ICS infrastructure, in that case, we are talking about the power
distribution. We gave brief information about the electricity architecture, distribution
architecture, scale architecture, and substation architecture. And we thought that the power
distribution company's process is not too much complicated. We have very limited type of signals
compared to power plants and petrochemicals. So it's a really easy process. It's easy to attack
and easy to defend. Now we need to define our landscape and then we will try to create some
kind of scenarios to directly develop for red teaming activity usage. And then finally,
we will perform some kind of attacks in our simulation lab. I don't want to talk about
the IT-based or getting into the IT and then jumping into OT kind of red teaming activities
or landscape. But once you are talking about the power distribution red teaming,
we wanted to give you brief landscape information that what you need to know,
what you are going to face, and how it will affect your planning. So basically, we have
eight categories that we will discuss today. The first one is protocols. There are different types
of protocols you will see in the field in the distribution companies. Basically, in scale apart,
I mean the wide area network, you will see ISC-104 and DMP3. And substation level, you will
see different types of protocols, sometimes goes MMS and so on. And upper level, in supervisory
level, you will see soft bus and the control level, you will see Modbus, TCPR2, even sometimes
Serif protocol. And then if you have smart meters and even in SCADA application, you may have the
power line communication. It's not, it's still PLC, but it's a different term. We will discuss
it today as well. And then we said that communication media is very important. If you
get into the communication media somehow, let's say you get into the APN network based on GSM or
you get into the RF signals, you then directly interact with substations, interact with RTUs
and interact with control center equipments and emergency control center equipments. So
communication media is also too much important for us to rectify in planning. On the other hand,
you need to be aware of the third part integration. There are different types of integration. It
depends on the country and region and the regulation. You see some of them in our list.
And also as a asset owner, you have some kind of remote locations or local locations like control
center, energy control center, material control center, headquarters, payment offices, or
communication center for like RF towers. So asset owner locations also matter to us.
On the other hand, substation is very important for us because it is remote located and physical
and cyber control is very limited compared to control center or emergency control center or
headquarters. In that case, you will be facing industry protocols on industrial devices
and you may apply some kind of hooping attacks. What I mean by that, once you get into the
specific remote substation, you can jump over the other substation, you can jump over the
control center or emergency control center, you may create some fake signals. It's like coming
from the old remote substation and so on. So it's a very great entry point and great
defense point for us. But I should stress out that in substation, we have some physical
controls. For example, if someone opens the door or if someone opens the cabinet, if someone
moving in the substation, it creates some alerts and sends signals over the 104 to the control
center. So we still have some type of controls that we need to be aware of when we plan SOC
activities or when we plan red teaming activities. On the other hand, technology,
I'm sure that all the villagers have a proper knowledge of them. I don't want to express each
of them because it's like the IT-wise pan testing or red teaming because it's server, network devices
and some kind of field devices. So I don't want to go each of them.
And on the other hand, we have people, for example, in Turkey, we have a specific regulation
for assessment in the power generation and distribution companies and it requires social
engineering activities for the energy people, let's say the asset owner people. Sometimes we
see that some red teaming activities hit the vendor engineers or OT partner or engineering
company engineers. So people's segment is also really varied and different types of mechanisms
they have. For example, in Turkey, we need to do physical pan testing, we need to do
phone calling, we need to do email-based social engineering. It's all written down by the
regulation. And also yet another landscape for us, the industrial process, and we will discuss it yet
in another conference because since it is the less signals and it's less complicated in the
power distribution and power industry, the industrial process vulnerabilities may affect
public safety directly. So we avoid to mention the entry points of process vulnerabilities,
but we can discuss it later for another industries on the following days.
All right, so I hope we understood the process, we understood the architecture, and defined some
kind of landscape. Again, it may change the region, country, and regulation, but we need to understand
the basics of a distribution. So we need to create some kind of scenarios. In this presentation,
we created three types of scenarios. We have created a specific table for that. I will discuss
it through them. And it's again not IT-based red teaming or pan testing. We try to create some kind
of direct effect on electricity-based scenarios. So in the scenario, we have a chance to work with
IoT team leader and hardware security leader with Fatih Kayran. Actually, he developed this
scenario and applied it in the field. Once upon a time, we were in the distribution company
and came up with the idea that we figured out somehow the smart meters were controlling the
city's electricity, which means if we could find a way to send a proper comment to smart meters,
it will directly shut down the electricity. In that case, the smart meters were talking through
the power line communication. And so we created our scenario based on this. So to understand
the team mates to each other in a better way, we create such a table to define our success
criterias, difficulty factors, and decide if key change is required or not. I will walk through
the one table and I will pass through the rest of it because we will perform a real-time simulation
for the rest of it. In this scenario, we targeted the shutdown electricity. But before jumping into
that, we classified our tactics and techniques based on MITRE, manipulation of control and
manipulation of weave. And our entry point was smart meters power line communication.
Complexity in this scenario was high. Difficulty was high because unknown protocols were there,
specific hardware design is required, and high-voltage work environment can be dangerous
because we lost one of our laptops and one of our team members got injured during this test
because we worked with the high voltage directly with the plugs.
To better understanding, you plug the smart meter into the
city network. So you turn into that specific smart meter into weapon to target the electricity.
For a better understanding, I will discuss it through this presentation. So dependency was
communication interface reverse engineering or protocol reverse engineering. Required time was
high for us. And also, what was our success criteria? Understand the protocol, send and
receive packets on the power line, send command to cut off the electricity for a defined area.
Sometimes we create some SOC success criteria for our customers to detect better the next attacks.
In that case, it could be hardware or smart meter log management, OMS log management,
call center log management, or smart meter application log management could be a success
criteria in that case. We define log sources for red teaming activities, and then we define a
purpose, method, and kill chain activity. In that case, our proposal was to shut down the electricity
unexpected point of entry through unexpected communication media, turn plug-in meters into
industrial attack equipment. So our idea was simple. So power line communication works through
the power signals. You modulate it and put your data into the electricity signals. So it directly
talks through the electricity. I think yesterday, there was a specific session about that.
In that case, we will look into how it's used in distribution companies. In that case,
we have the pack concentrator, which is directly connected to different types of customers,
almost lightning, and there are smart meters, and there are some power line communication
interfaces, and it connects to the backend system through the APN, in that case,
over the internet. So guess what? It was the broadcast messages going through the specific
power line. If you have specific hardware, you can develop it, or you can turn smart meter into
your tool. In that case, we made it, and we were able to understand the reading data,
and they shut down the electricity commons. So since it's broadcast, each of smart meters get
the data, and once you give order, everyone gets the order, but one of them apply it and report
back to center. So once you sniff the data, you see the smart meter ID, and in that case,
power line communication, we're using a DLSM-QSAM protocol. In that case, that specific number
defines the shutdown electricity command, like the double command in 104, very similar.
And also, in that case, we were able to get readout data. In this case, this is the readout
for DLSM-QSAM protocol. What we are trying to say is that you don't directly attack the SCADA
application, RTUs, or IEDs. The best way, and easy way, is to find yet another proper line
to end of your goal. So in that case, the power line communication and smart meters
gave us a chance to shut down the electricity, but you need to deal with high voltage electricity,
you need to deal with power line communication, new type of protocols, modulation, demodulation,
encryption, type of things require much more time. But most of the time, the asset owners and
the pen tester doesn't pay attention on the deck channel. So you really create a volume for your
customer and people safety in that case. So as I know, the European countries also have great
implementation of smart meters. We need to take care of these standards as well.
So our last two scenarios, based on the RTUs and industrial protocols,
we will show how to do industrial red teaming in a real lab environment, which took days for
Serkan and got old during these sessions. Basically, we have two different scenarios
for this presentation. One of them, extracting data from config files without further reverse
engineering or further implementation of anything. The thing about that, you have some type of
configuration files, you don't have any access to OT environment or substation yet, but you will
figure out some type of data to plan your next session of red teaming activities. We have a
specific example of that. Since I discussed deeply and very detailed the last table, I don't want to
discuss it, losing any time on that. So I will jump into the next one, because we will discuss
real scenario. Yet another scenario for this session is the remote substation protocol attack.
In that case, the attacker needs to interact with the substation equipments. It can be done
via Raspberry Pi implementation and connect through the Wi-Fi and so on, like we did in our
lab environment. And we will shut down the electricity using the protocol
commands. Once we understand what kind of protocols used and how, once we understand the
protocols, we will figure out where to send the data and finally send the data to shut down the
electricity. To have better understanding each other, what we are trying to say,
if you are planning to red teaming activity in a power distribution company or assessment,
you need to understand the process, you need to understand the architecture, you need to
understand the landscape. Once you have a tree element, then you can create your scenarios.
You need to think out of the box, but that box doesn't mean you can go out public safety rules
or process safety rules. So it's really hard to balance.
And we want to give you some simple ideas to reach out your end goal,
rather than implementing some IT-based or IT-related red teaming activities.
I think I can be free from now and put the second into fire.
As a tradition, we are face to face with the Murphy's rule.
But finally, we succeed on the setup a lab. Now I have new information about lab setup.
It's a very simple part of substation process. We have one RTOS, ABB 140,
and one IAD device, one SCADA server, SCADA PCs, and also one switch.
We use CapWare software as a SCADA master. And also we use Modbus-TC protocol and also
ISU-104 protocol. Modbus-TCP used in IAD device between R2 and ISU-104. We use it R2 between
SCADA and CapWare device. The tricky part is the implemented hardware substation as an attacker.
We think that we have some Raspberry Pi device or the other device as attacker machine.
Now, before jumping into details, I would like to mention that this setup doesn't indicate
any one of these on ABB RTOS. It's just a simple RTOS that we could use on the market,
and we knew how to configure it. So we will do some protocol-based simulation,
but it doesn't just affect the ABB. It's based on the leverage of the protocol usage,
to avoid any misunderstanding. And also it is a very common
RTOS used in Europe and Asian sites. And also this is the second reason we chose this RTOS.
Now we can jump into the labs video. All right, so we will start with interfaces and signals.
Well, first we do this about configuration RTU. I'll jump into that, just a second.
Yes, we use RTU 500 software for programming RTU, configuration RTU.
We created it before and open existing projects. This part a little bit takes time.
It may be boring. They hide the project file deep inside my file system.
Yes, a Turkish character error. Now, this is the RTU 500 software interface. This is the network
tree. We have three communication lines. One is IEC 1 and 4 for SCADA communication. The other
one is Modbus TCP for IED device, Modbus communication line. You can easily see that
some parameter of the communication protocol. Yes, it is the 1 and 4 communication protocol setup.
As you see, that's us-to-address, us-to-address structure, informal structure, maximum length of
IDLE. And then, this is the Modbus TCP site configuration.
This is network tree. Now, we are in hardware tree. In the hardware site, we choose our RTU
main CPU model. And also, we add the field level signal information in that site, hardware site.
And also, as you see, that the Modbus TCP communication configuration zone.
This is the IP address of the IED device.
And also, again, 104 configuration section. Now, this is the RTU interfaces.
It has two Ethernet interfaces. As you see, that's IP address of the interfaces.
And this site, we configured our field level signal, like active power. That is the Modbus
site, withholding register, index number 13. And this is the SCADA ISC 104 site, us-to-address 1,
information object address 103. And the other signals, like phase A current, phase B current.
We record all and show the all parameters of the signal.
And maybe you want to replay your own lab. So, we wanted to give you brief info in this section.
The other sections will be much more faster, let's say. But once you understand that part,
configuration, it's much more easier to understand the rest of the simulation.
This is the type of the Modbus signal. As you see, that's force
commands, signal commands, and register read-call status. Read-call status is used for the
information, single point information, digital inputs, like position of the circuit breaker.
And switch control means that sends control command to the circuit breaker.
Power limit set points, and the other mid-range information, phase A current,
phase B current, phase C current. It's a very simple model of the substation.
So, we can jump into the second report.
Second report.
In this report, we directly connect the radio web interfaces. As you see, this is the IP address of
the first Ethernet interface. Use username and passport. In that site, you can easily see that
configuration management site. You'll see that the configuration file, which configuration is now
active, when you update this configuration file, and also get configuration file from the device,
and also delete this configuration, etc. And also, directly on site, you can easily monitor
signal system log, system event status, and client session log, and also hardware tree.
Hardware tree is the live monitoring about R2, especially in the site, you see that R2 is active,
R2 is operable, means that it's connected to a device. As you see, that CPI switch position is on,
and also metering information about systems.
It is live data, real-time data.
Now, I can talk about a little bit configuration file, if you wish. Our third video related the
configuration file and extracting some data. Again, it doesn't indicate any vulnerabilities
on the R2, but somehow, if you reach out to backup systems, or if you reach out the file
server in the IT system, once we have a configuration file, now we will download it
and extract some data from it. It's really easy, actually, before furthering reverse engineering
implementation. In that case, we are not into the remote substation, we are not in the control room.
Somehow, we get data about the configuration file. It can be an engineering workstation,
file server again, or a backup system, maybe an engineering partner workstation.
Once I get the configuration file, I am directly able to see what kind of R2 is used,
what version, what purpose they are using, what kind of interfaces, and what kind of IP addresses
they have. And also, what kind of protocols they have. It will affect my further planning,
actually, in the red teaming activity. What kind of devices connected to that R2 in substation,
and what kind of signal parameters they are looking for it. So once I have that information
without any probing, any scanning activity, or any physical attachment, it's really leverage
of your effort once you have that kind of specific knowledge. We have also some specific
projects that the worst engineering read all the data, not people readable format at the moment,
you have much more better information and knowledge about the targeted system. So in that case,
we want to show you, you don't need to go to the control center or remote substation. Somehow,
if you are able to get config files, you may read directly with the Notepad++ and read some data,
understand the process, understand the protocols, interfaces, and plan a better red teaming activity
or targeted attack into the targeted system. So I will jump into your part, Serkan.
Yes, the fourth video is about the normal traditional application and communication
with SCADA systems and RETU. First of all, I will show to my IP address and same subnets with the
R2 interface one. And then we use, said before, CAPS server as a SCADA software, SCADA master
program. This is the configuration of the master site, CAPS player site, CAPS server site
configuration file. As you see that communication address, common address,
advanced settings, network interface, as we have same subnets, same IP address,
more advanced parameters for IEC 1 and 4, originator address, like, and also network
interface. Network interface means that this is the IP of the RETU and the port of the IEC 1 over 4.
And this site, we also configure our signal. This means that it is analog short float volume.
Australia is 1 over 3. So it is the breaker control commands, single commands means.
Actually, it will directly affect the open and close breakers. Later then we will apply some
scenarios. It's really important to understand what type of parameter and what type of
commands they take. Now we connected to RETU. As you see that this is the real-time data.
As you see, active power 2400. And also breaker control is zero. Breaker position is one,
means that the closed. Now we sent the breaker control. Control command is one.
Yes, it takes the commands. In the real-time and real-time operation,
when we send this command, we re-energize that circuit breaker or shut down the circuit breaker
with this command. All right. Now, and also I would like to show some wire shack
traffics between CAPWARE and RETU.
This is the Ethernet. We apply our display filter for IS104.
Yes, as you see that this is a test frame in the protocol.
Now we re-send the command again and show the traffic.
Yes, this is commands, single command.
Astro address 107. As you see that this is the wire shack single command.
Address is one. IO address is 107. And also set commands value is zero. As you see,
you can easily get this information from the wire shack because the IS104 is an open-text protocol,
not encrypted or hashing protocol. You can easily get information from the traffic.
In that case, you see that the single or double commands take place in IS104. In that case,
we send a specific shutdown or open command in a targeted area. In case it was zero, it means
we shut down the electricity through a legitimate traffic. I mean, it was a traffic generated by the
control center. Now we will try to apply as an attacker point of view who is in the remote
substation via implemented hardware. This is the fifth video of us.
Yes, we have information about the second interface, about R2. Now in the attacker machine,
I configure my IP address for the second interface of the R2, as you see.
Okay, now
I use mmap for some research on some search vulnerability or open ports.
In that case, we are looking for who has an IS104. In that case, in that protocol,
use specific ports if nobody changes it. So we are looking for the same subnet
if someone has that specific protocol. Please be aware it's an attacker point of view and
got into the substation looking for some IS104 endpoints and two devices. We found it. This is
retail device as you see from the IP address and also IS104 is open port and also services up.
But now we have only information about R2's protocols and R2's IP address, but we don't
have any information about the signal and signal address. Now we use CAPWARE again. We
configure CAPWARE again, as you see. We tried it once. Now it's connected to R2.
Now in the protocol structure, we have general integration commands. When we send this command,
R2 gets a response and sends all information about in this R2 insight.
We send GI commands to the retail. I don't know any information about the object address, but
when we send this command, R2 responds to this command and now we can easily observe which
address and which type of information inside of it. As you see that
address is 1, IO address is 100 and value is also, as you see, 332, etc, etc.
So basically protocol gives an opportunity to us to pull all kind of signals and data from the R2
for a specific protocol line. As an attacker, we use the exact same
tool, but it's a simulation environment. Again, you can use your lab environment,
that specific tool. Yet another tool we have, it's developed by, I think, the master degree
student in Germany. It's called ISE test. And to make sure all of you, we will send the latest
command to that specific tool. Next, again, R2. Now we send command again.
Get information from traffic and also we send commands to 107. As you see from Wireshark
traffic, we send commands and also on of on commands. And also as you, from traffic, it is
action confirmation from the R2 in number of line 18 and 37. GCSCNA at confirmation. As you see,
this means that R2 accepts this command.
Once you get into the substation, you pull data through the protocol and you send the command
through the protocol again. In that case, single command or double command supported by the 104.
And then you are able to shut down the electricity. In that case, if it's your end goal,
you may apply very different type of scenarios and red teaming activities, but we want to show
you that it can be done. There are some safety mechanisms or configuration mechanisms to avoid
it. Sometimes you implement the IP based solution or animal detection solution to
count that kind of activities. So in this session, we are end of our presentation with takeaways.
We would like to stress out during red teaming activity, we need to think out of the box,
but we still need to take care of public and process safety. It's really a rule of thumb
for us. Power distribution environment is not complicated as process-wise when compared to
power plants or petrochemical, but it has directly affected the other critical infrastructures and
customers directly. Power distribution companies have lots of different interdependencies.
Therefore, information getters could be a role for red teaming activities.
And power distribution companies are easy targets and easy to defend compared to other
ICS infrastructure. So we have two minutes left. If you have any questions, please feel free to
ask. We will be on Discord as well, as well as we can. So Serkan, if you have any comment,
please do it, or we can get to questions. If you have any questions, we will be in Discord.
We will be happy to answer your questions.
John and Serkan, thank you for your talk. I noted in the Discord speaker Q&A that I consider
this a mandatory talk to watch for both learning about 101 and assessments. So I really, really
appreciate y'all dialing in and supporting us. Thank you very much for having us. I hope you enjoyed.