start	end	text
0	7520	Thank you. Hello everyone, this is Can from Istanbul, Turkey and I am at Starcon today
7520	12180	and we will be talking about the playing with electricity and red teaming in power distribution
12180	19180	companies or hacking in the power distribution companies. Before getting started, I would like
19180	24320	to thank the ICS village team having us. It's really great opportunity to meet you all.
24440	29220	We really like to be part of the community activities all over the world. We also some
29220	36000	community activities in Turkey as well. So it's really great to be meeting you all over here.
36220	43760	Basically, we have one hour with you and basically we have three parts of our presentation.
44620	50900	The first part is overview. We will make a brief information, give a brief information
50900	58020	about the electricity architecture and power distribution company architecture and give you
58020	64040	scale application architecture upon it. And then we will discuss red teaming scenarios.
64040	68700	And then we will perform some attacks on our simulation lab.
69780	76840	Actually, thanks to Starcon, our simulation lab had some nerve issues. We changed our
77620	84300	hardware like four times last three days. But it worked at the end of the day and we
84300	92000	deleted videos for this presentation to avoid any problems. So we will have some
92540	102100	videos and we will talk upon it. All right, so let's do it. Starcon, please go ahead and introduce
102100	108320	yourself, please. Thank you, Can. First of all, good afternoon for the American side spectator
108320	113610	and maybe good night or good evening for the European and Asian side spectator.
113610	118710	First of all, I'd like to thank you for giving us the opportunity in this beautiful organization
118710	128270	and I'd like to express my pleasure being there. Now I will give information about myself. I am
128270	134010	Serkan Temel. I am an electric and electronic engineer. I have seven years experience about
134010	139910	industrial control systems, SCADA systems, based on electric distribution, transmission,
139910	145510	power generation. For the last one year of my career, I'm focused on the cyber security
145510	150130	in SCADA systems and also focused on the industrial control system cyber security
150130	157070	topics. Thank you, Can. We can go on now. Presentation. I am also an electric and electronic
157070	162770	engineer and I have more than eight years cyber security background. And last five years,
162770	169750	I mostly concentrated on critical infrastructure and I say SCADA cyber security. At the moment,
169750	177450	we're both working cyber wise for critical infrastructure cyber security at the moment.
177450	183410	And today, as we mentioned, we will discuss electric subsector and power distribution,
183410	190430	red teaming, and cyber security. All right. We want to start with why electric matters, actually.
193030	199010	It's not just for us, but for the rest of the world. It's the backbone of all critical
199010	207370	infrastructure. When it fails, it directly affects the daily life or modern life fundamentals.
207370	215010	For example, it affects health sector, transport sector, transportation, and finance sector,
215010	222190	and so on. So, once it fails, it directly affects people and public safety and it's
222190	231250	really backbone of the critical infrastructure. So, we want to take that part and we wanted to
231250	238570	build a presentation on it. So, we will be discussing about the red teaming in power
238570	243350	distribution companies, but before it, we need to understand the electricity architecture in process
243350	250050	wise. Basically, it has three parts. We have power generation, we have transmission lines,
250050	256270	and then we have a power distribution part. Most of the time, power plants and power generation
256270	264610	locate in the out-of-city centers. That means we need to carry electricity a long way of kilometers.
264610	270350	It means we require the transmission lines. And finally, that means we need to power up-down
270350	277210	operations. Once we are over from the transmission lines, we came up to the power distribution.
277210	284550	It is the last line of the customer touch. I mean, if something fails in power distribution part,
284550	291910	it directly affects customer and our business. To be honest, the distribution companies and
291910	298110	electricity distribution process is not too much complicated when we compare it to power plants
298790	305330	or petrochemical industry. So, it is easy to attack and also it is easy to defend.
306210	310010	Serkan, would you like to add something? Yes, I would like to add some points in that
310010	316930	presentation. Today, we tell you distribution, electric distribution, but I would like to
317590	324270	be aware of this point. Transmission layer is a critical part of the electricity architecture
324270	331010	because it's a bridge between power generation and power distribution. And it's the backbone
331010	335890	of the electricity architecture. Today's topics are distribution, electricity, but
336450	341570	transmission is very, very critical in the cybersecurity perspective. And actually,
341570	347230	it depends over the countries or over the regions. Sometimes, it's operated by the government.
347230	352030	Sometimes, it's operated by the private companies. It really depends on the region and
352710	359930	country's perspective. But I will agree with you that this transmission line is also the core of
359930	367150	electricity architecture. Thank you. So, let's deep dive into the power or electricity distribution
367150	373050	infrastructure. First of all, it's a really great example of the SCADA because you have the people,
373050	379850	which means the supervisory element of the SCADA, and you have remote locations. As you can see on
379850	385390	the screen, there are lots of different substations connected via different types of communication
386110	392810	medias to do your control center or emergency control center. So, what we said, it's a great
392810	400150	example of the SCADA application because you get data from all over the different remotely located
400150	407570	substation. And sometimes, you control over the remote substations. So, on the other hand,
407570	413490	you have remote offices like payment offices, headquarters, government agencies to report for,
413490	420630	you have direct integration. For example, in Turkey, Renewable Power Plant has to report the
422030	426750	nearest power distribution company for the regulation.
427970	434370	Basically, what we can say, there are lots of remote locations we have that we need to control,
434370	440070	and that means we need different types of communication media. In distribution companies,
440070	446350	we really need to take care of the communication media security as a part of the defense
447030	453770	mechanism. On the other hand, sometimes, some companies or some governments or some
453770	459210	countries have a smart meter application, which means smart meters have direct effective
459210	467370	electricity. They open and close the electricity via metering control center through the smart
467370	474930	meters. Why I'm telling you this, because it will affect our readiness scenarios and
474930	482050	understanding the infrastructure. What we need to understand from this slide, we need lots of
482050	487430	high level of connectivity, there are different types of communication media, and we have lots
487430	493010	of different types of substation and equipments. And the rest of it, we have lots of different
493010	506970	types of integration. All right, I will give a brief information and pass to the second stage.
507430	511870	We discussed about the electricity architecture, and then we discussed about the power
511870	518670	distribution architecture. Now, we will discuss about the SCADA architecture. It's also distributed
518670	525390	in the server side. But before jumping into it, we need to understand there is a need of a high
525390	532130	level of connectivity in such a power distribution company. Sometimes, you need to connect the
532130	537450	outage management system, ERP application, call center, and so on. Maybe, Serkan, give
537450	544770	some example about that. Yes, we mentioned about the previous presentation that we said
544770	553300	that the distribution touches the customers. So, this means that in the distribution company,
553690	563030	so many customers work into them, like customers management, outage management, VFMs,
563030	571550	other stuff, so many stuff for the customers. The reason of that, the distribution SCADA systems
571550	579690	must be and have to be integrated IT software applications, like Can mentioned, that's OMS.
579690	589010	OMS, like VFM, like the other companies' third-party softwares. Because of that,
589390	595070	distribution SCADA systems are a little different from the transmission and power generation SCADA
595070	604120	systems. And also, in the distribution network, so many substations. This means that so many data,
604310	612650	so many connection stations. So, we need the power of SCADA systems. We have to separate
613460	619930	this load to separate servers, like application server, like communication server, like data server,
619930	626930	like backup server, and so on, like HMI server. So, distribution SCADA systems are a little bit
627210	634630	distributed and separated structure. It's very similar to IT environment, actually. You have
634630	640370	some type of application servers, communication servers. It does some kind of load balancing,
640370	646790	and it requires really great integration of an IT application or business application. Sometimes,
646790	652090	part of SCADA applications, like we call outage management system or call centers,
652090	657150	they are directly talking or integrating with our SCADA application. Because once you have
658370	663870	a blackout or a kind of blackout or shut down electricity, you will get some calls, you will
663870	669890	need to reach out your customers, you need to get some data from SCADA. So, it's really integrated
669890	675610	with IT applications, sometimes cloud applications. And on the other hand, you have untrusted parties
675610	681590	like vendors, remote offices, other type of control centers or government agencies. So,
681590	687310	sometimes it's done via firewall, sometimes directly connected to your initial equipments.
687310	692730	It really depends on the customer strategy, or sometimes they are not really aware of what kind
692730	699550	of communication channels they have. But what we need to remember through here,
700130	706430	our SCADA architecture is distributed as a server role, and it's like an IT application and
706930	714630	it has integration with the business side. And also, it talks to the substation through our
714630	721650	communication media. So, I will leave the comments to Serkan about substation, because he's
721650	728410	lost. We have talked about the substation architecture. In the substation architecture
728410	735530	distribution process, we have some main devices for the process we use.
735530	745670	The first one is RETU. RETU is a telecontroller which connects field devices to SCADA systems.
745670	754370	RETU is a data concentrator for data transfer devices. Energy analyzer is an energy meter
754370	762870	which gets information from the CT and VT transformer from electric sites information
763470	771370	and translates in the digital sites and directly sends this information to SCADA systems.
771370	777570	Protection relay is a critical equipment in the distribution and also transmission and also
778170	785310	generation, as you know that. Protection relay is the first IED device, first electronic device
785310	793970	connected physical electric system. It is a bridge, cyber and physical world. The reason
793970	800010	of that protection relay is the most critical part and most critical device in the distribution
800010	806890	systems. As in cyber security perspective, if you want to shut down the electricity,
806890	814270	you have to control the protection relay. But maybe you can attack the RETU, maybe attack
814270	822070	the SCADA systems. It has just blocked our monitoring from the field sites. But if we
822070	828470	want to control electricity, shut down electricity or re-energize the electricity, you have to
828470	834550	control protection relay. The fourth device is the smart meter. Smart meter, as you know,
834550	840310	that's for billing purposes and maybe low-voltage site for customer sites,
840310	849750	shut down electricity or re-energize electricity. This last two devices is physical device.
849750	856530	The first one is low-voltage circuit breaker. It is controlled electricity line.
857430	862930	And the last one is the medium-voltage cubicles. It means circuit breaker also
862930	871670	inside these cubicles. It controls the electricity line networks. Next slide, please.
872330	874270	I think... Yeah.
874270	883170	Yes. Yes, we have line IAD device, protection line device. This is... I would like to say
883170	892190	it again because it is very critical. Protection device has two parts. One of the hardware,
892190	899290	otherwise the software. The hardware side, they have unlock input, unlock output, digital input,
899290	905990	digital output, and the other server Ethernet interface. Voltage and current information
906930	915010	takes with unlock input modules and also control unlock system like set points, power,
915010	920690	like set about the frequency, let's set about the voltage. You have to send unlock output.
920970	925370	And digital input and digital output is mostly critical because digital input comes from
925370	930890	basically circuit breaker position, isolated position, the other information about the
930890	937610	systems. And digital output is control the circuit breakers, means that you control the
937610	942370	electricity. Because of that, in the SCADA systems and most of the communication protocols
942370	948570	or animal detection or cybersecurity perspective, we focus on the digital output signal.
949390	954750	In the beginning of this device, they have serial interface because in that time,
954750	962430	Ethernet IP world. And today's most of device has Ethernet interface and it gains
963310	971990	advantage of the Ethernet IP world. But it is some cause of the side effect from cybersecurity,
971990	984730	this gains of advantages. I will tell about later. On the software side, communication protocols,
984730	996550	protocols like ISP104, DNP3, the other. This helps communicate with R2 or communicate with
996550	1003550	the SCADA systems to send information to the upper level. Logic functions control like circuit
1003550	1011110	breaker or other blocking material functions, logic functions, and configuration interface.
1011110	1016590	Critical part of the IoT device, as I mentioned, they have Ethernet interface.
1016670	1022950	Most of IoT device nowadays use web service interface for configuration
1023830	1028210	software or configuration interface. This is some vulnerability about
1030210	1034530	systems as the weak point of this IoT device nowadays.
1034530	1043390	Thank you, Serkan. Actually, we always get afraid or get freak about touch such intelligent
1043390	1048550	electronic devices because as you mentioned, one part is physical that controls electricity and
1048550	1058270	one part is cyber. It's R2 or SCADA applications and it's like a last line of the physical and
1058270	1065910	cyber breach. Once you control it, you control the electricity, you can control it through the
1065910	1072650	R2 or you can directly send commands to the IAD or you can trigger some SCADA application
1072650	1077570	set points and it will directly affect the intelligent electronic devices. But
1077570	1083990	once you're planning a red teaming or pen testing activity, you need to be aware of
1085130	1092810	such devices can affect the electricity and you need to be really careful what you're playing with.
1093910	1101380	All right, so now we can discuss about red teaming approach and red teaming scenarios.
1103090	1112870	Before jumping into the details, I want to discuss how much red is that because since
1112870	1118450	it's a critical infrastructure, since it's a last line of the custom touch,
1118450	1125830	can we be really free to be really red teaming? In that case, most of the asset owners and most
1125830	1134930	of the cybersecurity companies get afraid to or avoid the consequences of bad thing happens. So
1134930	1143890	I may say that nobody does direct red teaming, maybe it's like light pink teaming, let's say,
1143890	1149430	because we really need to be aware of that the public safety and process safety is much more
1149430	1158690	important than your color activity. So you need to take care of the process, you need to take care
1158690	1164770	of the public safety because we always think in that way if we shut down electricity for the
1164770	1172130	hospital and if we kill someone in that hospital because of no electricity. So it really has a
1172130	1178370	great boundary for us to do our test or pen testing activities or red teaming activities
1178470	1185790	in a controlled way. So it's not really red, light pink maybe, but to understand each other
1185790	1191670	in a better way, I want to express that part as well. So I would like to mention about the
1191670	1198810	core steps. We divide into five main steps. Actually, we discussed about the first two of them
1199490	1205270	to understand the process, understand the architecture. Once you do any red teaming
1205270	1211390	activity in any kind of ICS infrastructure, in that case, we are talking about the power
1211390	1216310	distribution. We gave brief information about the electricity architecture, distribution
1216310	1225010	architecture, scale architecture, and substation architecture. And we thought that the power
1225010	1231330	distribution company's process is not too much complicated. We have very limited type of signals
1231330	1238230	compared to power plants and petrochemicals. So it's a really easy process. It's easy to attack
1238230	1245090	and easy to defend. Now we need to define our landscape and then we will try to create some
1245090	1254650	kind of scenarios to directly develop for red teaming activity usage. And then finally,
1254650	1261530	we will perform some kind of attacks in our simulation lab. I don't want to talk about
1261530	1268990	the IT-based or getting into the IT and then jumping into OT kind of red teaming activities
1268990	1275510	or landscape. But once you are talking about the power distribution red teaming,
1275510	1281510	we wanted to give you brief landscape information that what you need to know,
1281510	1287970	what you are going to face, and how it will affect your planning. So basically, we have
1287970	1293130	eight categories that we will discuss today. The first one is protocols. There are different types
1293130	1299430	of protocols you will see in the field in the distribution companies. Basically, in scale apart,
1299430	1305650	I mean the wide area network, you will see ISC-104 and DMP3. And substation level, you will
1305650	1313170	see different types of protocols, sometimes goes MMS and so on. And upper level, in supervisory
1313170	1320810	level, you will see soft bus and the control level, you will see Modbus, TCPR2, even sometimes
1320810	1326890	Serif protocol. And then if you have smart meters and even in SCADA application, you may have the
1326890	1332930	power line communication. It's not, it's still PLC, but it's a different term. We will discuss
1332930	1338650	it today as well. And then we said that communication media is very important. If you
1338650	1346430	get into the communication media somehow, let's say you get into the APN network based on GSM or
1346430	1355410	you get into the RF signals, you then directly interact with substations, interact with RTUs
1355410	1360550	and interact with control center equipments and emergency control center equipments. So
1360550	1367990	communication media is also too much important for us to rectify in planning. On the other hand,
1367990	1374090	you need to be aware of the third part integration. There are different types of integration. It
1374090	1381370	depends on the country and region and the regulation. You see some of them in our list.
1381370	1388330	And also as a asset owner, you have some kind of remote locations or local locations like control
1388330	1393130	center, energy control center, material control center, headquarters, payment offices, or
1393130	1402530	communication center for like RF towers. So asset owner locations also matter to us.
1403090	1410190	On the other hand, substation is very important for us because it is remote located and physical
1410190	1417610	and cyber control is very limited compared to control center or emergency control center or
1417610	1423330	headquarters. In that case, you will be facing industry protocols on industrial devices
1423330	1430390	and you may apply some kind of hooping attacks. What I mean by that, once you get into the
1430970	1437550	specific remote substation, you can jump over the other substation, you can jump over the
1437550	1444150	control center or emergency control center, you may create some fake signals. It's like coming
1444150	1450990	from the old remote substation and so on. So it's a very great entry point and great
1452710	1459570	defense point for us. But I should stress out that in substation, we have some physical
1459570	1464550	controls. For example, if someone opens the door or if someone opens the cabinet, if someone
1465190	1471330	moving in the substation, it creates some alerts and sends signals over the 104 to the control
1471330	1478190	center. So we still have some type of controls that we need to be aware of when we plan SOC
1478190	1482830	activities or when we plan red teaming activities. On the other hand, technology,
1483490	1490290	I'm sure that all the villagers have a proper knowledge of them. I don't want to express each
1490290	1497030	of them because it's like the IT-wise pan testing or red teaming because it's server, network devices
1497030	1503050	and some kind of field devices. So I don't want to go each of them.
1503050	1507070	And on the other hand, we have people, for example, in Turkey, we have a specific regulation
1507070	1513490	for assessment in the power generation and distribution companies and it requires social
1513490	1521450	engineering activities for the energy people, let's say the asset owner people. Sometimes we
1521450	1527810	see that some red teaming activities hit the vendor engineers or OT partner or engineering
1527810	1541310	company engineers. So people's segment is also really varied and different types of mechanisms
1541310	1546270	they have. For example, in Turkey, we need to do physical pan testing, we need to do
1546990	1555150	phone calling, we need to do email-based social engineering. It's all written down by the
1555150	1561850	regulation. And also yet another landscape for us, the industrial process, and we will discuss it yet
1561850	1569490	in another conference because since it is the less signals and it's less complicated in the
1569490	1576970	power distribution and power industry, the industrial process vulnerabilities may affect
1576970	1588090	public safety directly. So we avoid to mention the entry points of process vulnerabilities,
1588090	1595250	but we can discuss it later for another industries on the following days.
1595250	1602470	All right, so I hope we understood the process, we understood the architecture, and defined some
1602470	1610110	kind of landscape. Again, it may change the region, country, and regulation, but we need to understand
1611010	1617930	the basics of a distribution. So we need to create some kind of scenarios. In this presentation,
1617930	1626370	we created three types of scenarios. We have created a specific table for that. I will discuss
1626370	1635630	it through them. And it's again not IT-based red teaming or pan testing. We try to create some kind
1635630	1647610	of direct effect on electricity-based scenarios. So in the scenario, we have a chance to work with
1647610	1653730	IoT team leader and hardware security leader with Fatih Kayran. Actually, he developed this
1653730	1658570	scenario and applied it in the field. Once upon a time, we were in the distribution company
1659210	1665550	and came up with the idea that we figured out somehow the smart meters were controlling the
1667930	1677530	city's electricity, which means if we could find a way to send a proper comment to smart meters,
1677610	1683770	it will directly shut down the electricity. In that case, the smart meters were talking through
1683770	1690570	the power line communication. And so we created our scenario based on this. So to understand
1690570	1697470	the team mates to each other in a better way, we create such a table to define our success
1697470	1704350	criterias, difficulty factors, and decide if key change is required or not. I will walk through
1704350	1711910	the one table and I will pass through the rest of it because we will perform a real-time simulation
1711910	1720410	for the rest of it. In this scenario, we targeted the shutdown electricity. But before jumping into
1720410	1728450	that, we classified our tactics and techniques based on MITRE, manipulation of control and
1728450	1734270	manipulation of weave. And our entry point was smart meters power line communication.
1734330	1742750	Complexity in this scenario was high. Difficulty was high because unknown protocols were there,
1742750	1748330	specific hardware design is required, and high-voltage work environment can be dangerous
1748950	1755630	because we lost one of our laptops and one of our team members got injured during this test
1755630	1760170	because we worked with the high voltage directly with the plugs.
1760850	1766550	To better understanding, you plug the smart meter into the
1768190	1777550	city network. So you turn into that specific smart meter into weapon to target the electricity.
1777830	1783810	For a better understanding, I will discuss it through this presentation. So dependency was
1783810	1789130	communication interface reverse engineering or protocol reverse engineering. Required time was
1789130	1796010	high for us. And also, what was our success criteria? Understand the protocol, send and
1796010	1803530	receive packets on the power line, send command to cut off the electricity for a defined area.
1804350	1812190	Sometimes we create some SOC success criteria for our customers to detect better the next attacks.
1812190	1817930	In that case, it could be hardware or smart meter log management, OMS log management,
1817930	1821710	call center log management, or smart meter application log management could be a success
1821710	1828990	criteria in that case. We define log sources for red teaming activities, and then we define a
1828990	1835170	purpose, method, and kill chain activity. In that case, our proposal was to shut down the electricity
1836010	1843730	unexpected point of entry through unexpected communication media, turn plug-in meters into
1843730	1852890	industrial attack equipment. So our idea was simple. So power line communication works through
1852890	1862630	the power signals. You modulate it and put your data into the electricity signals. So it directly
1863270	1871330	talks through the electricity. I think yesterday, there was a specific session about that.
1871330	1878610	In that case, we will look into how it's used in distribution companies. In that case,
1878610	1883090	we have the pack concentrator, which is directly connected to different types of customers,
1883090	1888590	almost lightning, and there are smart meters, and there are some power line communication
1889270	1894930	interfaces, and it connects to the backend system through the APN, in that case,
1894930	1901310	over the internet. So guess what? It was the broadcast messages going through the specific
1901310	1908750	power line. If you have specific hardware, you can develop it, or you can turn smart meter into
1908750	1917590	your tool. In that case, we made it, and we were able to understand the reading data,
1917590	1923830	and they shut down the electricity commons. So since it's broadcast, each of smart meters get
1923830	1931270	the data, and once you give order, everyone gets the order, but one of them apply it and report
1931270	1940550	back to center. So once you sniff the data, you see the smart meter ID, and in that case,
1940550	1949210	power line communication, we're using a DLSM-QSAM protocol. In that case, that specific number
1949210	1955730	defines the shutdown electricity command, like the double command in 104, very similar.
1956070	1964250	And also, in that case, we were able to get readout data. In this case, this is the readout
1964250	1975150	for DLSM-QSAM protocol. What we are trying to say is that you don't directly attack the SCADA
1975150	1986310	application, RTUs, or IEDs. The best way, and easy way, is to find yet another proper line
1986830	1993650	to end of your goal. So in that case, the power line communication and smart meters
1996150	2003270	gave us a chance to shut down the electricity, but you need to deal with high voltage electricity,
2003270	2008990	you need to deal with power line communication, new type of protocols, modulation, demodulation,
2008990	2016730	encryption, type of things require much more time. But most of the time, the asset owners and
2016730	2024250	the pen tester doesn't pay attention on the deck channel. So you really create a volume for your
2024250	2033210	customer and people safety in that case. So as I know, the European countries also have great
2033210	2040010	implementation of smart meters. We need to take care of these standards as well.
2044160	2052060	So our last two scenarios, based on the RTUs and industrial protocols,
2052060	2059040	we will show how to do industrial red teaming in a real lab environment, which took days for
2059040	2068160	Serkan and got old during these sessions. Basically, we have two different scenarios
2068660	2076040	for this presentation. One of them, extracting data from config files without further reverse
2076040	2082140	engineering or further implementation of anything. The thing about that, you have some type of
2082140	2088980	configuration files, you don't have any access to OT environment or substation yet, but you will
2088980	2097360	figure out some type of data to plan your next session of red teaming activities. We have a
2097360	2106380	specific example of that. Since I discussed deeply and very detailed the last table, I don't want to
2106380	2112760	discuss it, losing any time on that. So I will jump into the next one, because we will discuss
2112760	2120220	real scenario. Yet another scenario for this session is the remote substation protocol attack.
2120720	2127600	In that case, the attacker needs to interact with the substation equipments. It can be done
2127600	2133940	via Raspberry Pi implementation and connect through the Wi-Fi and so on, like we did in our
2134560	2141060	lab environment. And we will shut down the electricity using the protocol
2141760	2148420	commands. Once we understand what kind of protocols used and how, once we understand the
2148420	2155300	protocols, we will figure out where to send the data and finally send the data to shut down the
2155300	2163540	electricity. To have better understanding each other, what we are trying to say,
2164540	2171040	if you are planning to red teaming activity in a power distribution company or assessment,
2171500	2177300	you need to understand the process, you need to understand the architecture, you need to
2177300	2182740	understand the landscape. Once you have a tree element, then you can create your scenarios.
2182740	2191520	You need to think out of the box, but that box doesn't mean you can go out public safety rules
2191520	2196700	or process safety rules. So it's really hard to balance.
2197260	2206900	And we want to give you some simple ideas to reach out your end goal,
2207380	2213260	rather than implementing some IT-based or IT-related red teaming activities.
2214660	2224180	I think I can be free from now and put the second into fire.
2225020	2232200	As a tradition, we are face to face with the Murphy's rule.
2232220	2241220	But finally, we succeed on the setup a lab. Now I have new information about lab setup.
2241220	2250680	It's a very simple part of substation process. We have one RTOS, ABB 140,
2251960	2261260	and one IAD device, one SCADA server, SCADA PCs, and also one switch.
2261260	2270120	We use CapWare software as a SCADA master. And also we use Modbus-TC protocol and also
2270120	2283240	ISU-104 protocol. Modbus-TCP used in IAD device between R2 and ISU-104. We use it R2 between
2283240	2292560	SCADA and CapWare device. The tricky part is the implemented hardware substation as an attacker.
2292560	2299360	We think that we have some Raspberry Pi device or the other device as attacker machine.
2301440	2308100	Now, before jumping into details, I would like to mention that this setup doesn't indicate
2308100	2315400	any one of these on ABB RTOS. It's just a simple RTOS that we could use on the market,
2315400	2322460	and we knew how to configure it. So we will do some protocol-based simulation,
2322460	2328100	but it doesn't just affect the ABB. It's based on the leverage of the protocol usage,
2328100	2332480	to avoid any misunderstanding. And also it is a very common
2333240	2340900	RTOS used in Europe and Asian sites. And also this is the second reason we chose this RTOS.
2340940	2350420	Now we can jump into the labs video. All right, so we will start with interfaces and signals.
2351640	2359710	Well, first we do this about configuration RTU. I'll jump into that, just a second.
2362440	2370660	Yes, we use RTU 500 software for programming RTU, configuration RTU.
2378690	2385650	We created it before and open existing projects. This part a little bit takes time.
2385650	2396330	It may be boring. They hide the project file deep inside my file system.
2398530	2410250	Yes, a Turkish character error. Now, this is the RTU 500 software interface. This is the network
2410250	2417910	tree. We have three communication lines. One is IEC 1 and 4 for SCADA communication. The other
2417910	2425650	one is Modbus TCP for IED device, Modbus communication line. You can easily see that
2425650	2434610	some parameter of the communication protocol. Yes, it is the 1 and 4 communication protocol setup.
2437130	2444390	As you see, that's us-to-address, us-to-address structure, informal structure, maximum length of
2444390	2453410	IDLE. And then, this is the Modbus TCP site configuration.
2458760	2467880	This is network tree. Now, we are in hardware tree. In the hardware site, we choose our RTU
2468420	2476140	main CPU model. And also, we add the field level signal information in that site, hardware site.
2476140	2483060	And also, as you see, that the Modbus TCP communication configuration zone.
2483600	2487040	This is the IP address of the IED device.
2488320	2501190	And also, again, 104 configuration section. Now, this is the RTU interfaces.
2502270	2509470	It has two Ethernet interfaces. As you see, that's IP address of the interfaces.
2514300	2521060	And this site, we configured our field level signal, like active power. That is the Modbus
2521060	2529660	site, withholding register, index number 13. And this is the SCADA ISC 104 site, us-to-address 1,
2529660	2538960	information object address 103. And the other signals, like phase A current, phase B current.
2539540	2544680	We record all and show the all parameters of the signal.
2551960	2560700	And maybe you want to replay your own lab. So, we wanted to give you brief info in this section.
2560700	2568280	The other sections will be much more faster, let's say. But once you understand that part,
2568280	2574960	configuration, it's much more easier to understand the rest of the simulation.
2575080	2578580	This is the type of the Modbus signal. As you see, that's force
2579540	2585720	commands, signal commands, and register read-call status. Read-call status is used for the
2585720	2591560	information, single point information, digital inputs, like position of the circuit breaker.
2592960	2597580	And switch control means that sends control command to the circuit breaker.
2598280	2605120	Power limit set points, and the other mid-range information, phase A current,
2605120	2611980	phase B current, phase C current. It's a very simple model of the substation.
2616260	2619880	So, we can jump into the second report.
2619880	2621860	Second report.
2624360	2633340	In this report, we directly connect the radio web interfaces. As you see, this is the IP address of
2633340	2643460	the first Ethernet interface. Use username and passport. In that site, you can easily see that
2643460	2648700	configuration management site. You'll see that the configuration file, which configuration is now
2648700	2657360	active, when you update this configuration file, and also get configuration file from the device,
2657360	2663200	and also delete this configuration, etc. And also, directly on site, you can easily monitor
2663200	2668320	signal system log, system event status, and client session log, and also hardware tree.
2668320	2678100	Hardware tree is the live monitoring about R2, especially in the site, you see that R2 is active,
2678100	2686800	R2 is operable, means that it's connected to a device. As you see, that CPI switch position is on,
2686800	2691960	and also metering information about systems.
2694140	2697460	It is live data, real-time data.
2701060	2707940	Now, I can talk about a little bit configuration file, if you wish. Our third video related the
2707940	2714620	configuration file and extracting some data. Again, it doesn't indicate any vulnerabilities
2714620	2721080	on the R2, but somehow, if you reach out to backup systems, or if you reach out the file
2721080	2727880	server in the IT system, once we have a configuration file, now we will download it
2727880	2735640	and extract some data from it. It's really easy, actually, before furthering reverse engineering
2736250	2743420	implementation. In that case, we are not into the remote substation, we are not in the control room.
2743420	2749180	Somehow, we get data about the configuration file. It can be an engineering workstation,
2749180	2756750	file server again, or a backup system, maybe an engineering partner workstation.
2757100	2763680	Once I get the configuration file, I am directly able to see what kind of R2 is used,
2763680	2771040	what version, what purpose they are using, what kind of interfaces, and what kind of IP addresses
2771900	2780720	they have. And also, what kind of protocols they have. It will affect my further planning,
2780720	2787540	actually, in the red teaming activity. What kind of devices connected to that R2 in substation,
2787540	2795060	and what kind of signal parameters they are looking for it. So once I have that information
2795060	2803620	without any probing, any scanning activity, or any physical attachment, it's really leverage
2803620	2812660	of your effort once you have that kind of specific knowledge. We have also some specific
2812660	2822200	projects that the worst engineering read all the data, not people readable format at the moment,
2822200	2832600	you have much more better information and knowledge about the targeted system. So in that case,
2832600	2839740	we want to show you, you don't need to go to the control center or remote substation. Somehow,
2839740	2847680	if you are able to get config files, you may read directly with the Notepad++ and read some data,
2847680	2853480	understand the process, understand the protocols, interfaces, and plan a better red teaming activity
2853480	2861540	or targeted attack into the targeted system. So I will jump into your part, Serkan.
2862100	2868760	Yes, the fourth video is about the normal traditional application and communication
2868760	2877820	with SCADA systems and RETU. First of all, I will show to my IP address and same subnets with the
2877820	2887810	R2 interface one. And then we use, said before, CAPS server as a SCADA software, SCADA master
2887810	2895570	program. This is the configuration of the master site, CAPS player site, CAPS server site
2895570	2903370	configuration file. As you see that communication address, common address,
2909160	2916560	advanced settings, network interface, as we have same subnets, same IP address,
2916560	2925140	more advanced parameters for IEC 1 and 4, originator address, like, and also network
2925140	2932920	interface. Network interface means that this is the IP of the RETU and the port of the IEC 1 over 4.
2936420	2946000	And this site, we also configure our signal. This means that it is analog short float volume.
2948640	2957900	Australia is 1 over 3. So it is the breaker control commands, single commands means.
2961840	2968860	Actually, it will directly affect the open and close breakers. Later then we will apply some
2968860	2974040	scenarios. It's really important to understand what type of parameter and what type of
2974040	2980080	commands they take. Now we connected to RETU. As you see that this is the real-time data.
2980420	2987880	As you see, active power 2400. And also breaker control is zero. Breaker position is one,
2987880	2995700	means that the closed. Now we sent the breaker control. Control command is one.
2997320	3002120	Yes, it takes the commands. In the real-time and real-time operation,
3002120	3008880	when we send this command, we re-energize that circuit breaker or shut down the circuit breaker
3008880	3025660	with this command. All right. Now, and also I would like to show some wire shack
3026780	3031220	traffics between CAPWARE and RETU.
3032740	3039560	This is the Ethernet. We apply our display filter for IS104.
3046700	3051000	Yes, as you see that this is a test frame in the protocol.
3052020	3057860	Now we re-send the command again and show the traffic.
3061360	3066360	Yes, this is commands, single command.
3068580	3077060	Astro address 107. As you see that this is the wire shack single command.
3078760	3087520	Address is one. IO address is 107. And also set commands value is zero. As you see,
3087520	3095360	you can easily get this information from the wire shack because the IS104 is an open-text protocol,
3095360	3102140	not encrypted or hashing protocol. You can easily get information from the traffic.
3103380	3111860	In that case, you see that the single or double commands take place in IS104. In that case,
3111860	3121320	we send a specific shutdown or open command in a targeted area. In case it was zero, it means
3121320	3129680	we shut down the electricity through a legitimate traffic. I mean, it was a traffic generated by the
3129680	3137900	control center. Now we will try to apply as an attacker point of view who is in the remote
3137900	3146580	substation via implemented hardware. This is the fifth video of us.
3147960	3157480	Yes, we have information about the second interface, about R2. Now in the attacker machine,
3157960	3163940	I configure my IP address for the second interface of the R2, as you see.
3164320	3167220	Okay, now
3169760	3178740	I use mmap for some research on some search vulnerability or open ports.
3180420	3187320	In that case, we are looking for who has an IS104. In that case, in that protocol,
3187320	3193680	use specific ports if nobody changes it. So we are looking for the same subnet
3194260	3202620	if someone has that specific protocol. Please be aware it's an attacker point of view and
3202620	3211780	got into the substation looking for some IS104 endpoints and two devices. We found it. This is
3212320	3222080	retail device as you see from the IP address and also IS104 is open port and also services up.
3224700	3231260	But now we have only information about R2's protocols and R2's IP address, but we don't
3231260	3239640	have any information about the signal and signal address. Now we use CAPWARE again. We
3241420	3261870	configure CAPWARE again, as you see. We tried it once. Now it's connected to R2.
3262930	3271710	Now in the protocol structure, we have general integration commands. When we send this command,
3271710	3279090	R2 gets a response and sends all information about in this R2 insight.
3280730	3286470	We send GI commands to the retail. I don't know any information about the object address, but
3286470	3293910	when we send this command, R2 responds to this command and now we can easily observe which
3294690	3300430	address and which type of information inside of it. As you see that
3300430	3314290	address is 1, IO address is 100 and value is also, as you see, 332, etc, etc.
3316290	3324810	So basically protocol gives an opportunity to us to pull all kind of signals and data from the R2
3324810	3330530	for a specific protocol line. As an attacker, we use the exact same
3332050	3337990	tool, but it's a simulation environment. Again, you can use your lab environment,
3337990	3344330	that specific tool. Yet another tool we have, it's developed by, I think, the master degree
3344330	3354510	student in Germany. It's called ISE test. And to make sure all of you, we will send the latest
3354510	3363170	command to that specific tool. Next, again, R2. Now we send command again.
3363650	3373770	Get information from traffic and also we send commands to 107. As you see from Wireshark
3373770	3386680	traffic, we send commands and also on of on commands. And also as you, from traffic, it is
3386680	3402140	action confirmation from the R2 in number of line 18 and 37. GCSCNA at confirmation. As you see,
3402140	3405040	this means that R2 accepts this command.
3408260	3415140	Once you get into the substation, you pull data through the protocol and you send the command
3415140	3420900	through the protocol again. In that case, single command or double command supported by the 104.
3421140	3429440	And then you are able to shut down the electricity. In that case, if it's your end goal,
3429440	3435480	you may apply very different type of scenarios and red teaming activities, but we want to show
3435480	3441780	you that it can be done. There are some safety mechanisms or configuration mechanisms to avoid
3441780	3447080	it. Sometimes you implement the IP based solution or animal detection solution to
3447080	3454460	count that kind of activities. So in this session, we are end of our presentation with takeaways.
3454460	3460420	We would like to stress out during red teaming activity, we need to think out of the box,
3460420	3466340	but we still need to take care of public and process safety. It's really a rule of thumb
3466340	3472500	for us. Power distribution environment is not complicated as process-wise when compared to
3472500	3478740	power plants or petrochemical, but it has directly affected the other critical infrastructures and
3478740	3485300	customers directly. Power distribution companies have lots of different interdependencies.
3485640	3489620	Therefore, information getters could be a role for red teaming activities.
3490420	3494720	And power distribution companies are easy targets and easy to defend compared to other
3494720	3504140	ICS infrastructure. So we have two minutes left. If you have any questions, please feel free to
3504140	3513040	ask. We will be on Discord as well, as well as we can. So Serkan, if you have any comment,
3513040	3522180	please do it, or we can get to questions. If you have any questions, we will be in Discord.
3523220	3526980	We will be happy to answer your questions.
3528380	3534980	John and Serkan, thank you for your talk. I noted in the Discord speaker Q&A that I consider
3534980	3540940	this a mandatory talk to watch for both learning about 101 and assessments. So I really, really
3540940	3548600	appreciate y'all dialing in and supporting us. Thank you very much for having us. I hope you enjoyed.