WEBVTT 00:00.000 --> 00:01.560 Thank you. 00:02.680 --> 00:16.320 Hello everyone, this is Can from Istanbul, Turkey and I am at Starcon today and we will be talking about the playing with electricity and red teaming in power distribution companies or hacking in the power distribution companies. 00:16.740 --> 00:21.760 Before getting started, I would like to thank the ICS village team having us. 00:21.760 --> 00:24.320 It's really great opportunity to meet you all. 00:24.440 --> 00:28.440 We really like to be part of the community activities all over the world. 00:28.520 --> 00:31.660 We also some community activities in Turkey as well. 00:31.660 --> 00:36.000 So it's really great to be meeting you all over here. 00:36.220 --> 00:43.760 Basically, we have one hour with you and basically we have three parts of our presentation. 00:44.620 --> 00:46.820 The first part is overview. 00:46.820 --> 01:01.460 We will make a brief information, give a brief information about the electricity architecture and power distribution company architecture and give you scale application architecture upon it. 01:01.460 --> 01:04.040 And then we will discuss red teaming scenarios. 01:04.040 --> 01:08.700 And then we will perform some attacks on our simulation lab. 01:09.780 --> 01:15.900 Actually, thanks to Starcon, our simulation lab had some nerve issues. 01:15.900 --> 01:21.280 We changed our hardware like four times last three days. 01:21.280 --> 01:30.700 But it worked at the end of the day and we deleted videos for this presentation to avoid any problems. 01:30.780 --> 01:34.940 So we will have some videos and we will talk upon it. 01:35.340 --> 01:39.120 All right, so let's do it. 01:39.520 --> 01:43.380 Starcon, please go ahead and introduce yourself, please. 01:43.420 --> 01:44.180 Thank you, Can. 01:44.480 --> 01:53.610 First of all, good afternoon for the American side spectator and maybe good night or good evening for the European and Asian side spectator. 01:53.610 --> 02:02.650 First of all, I'd like to thank you for giving us the opportunity in this beautiful organization and I'd like to express my pleasure being there. 02:02.970 --> 02:08.050 Now I will give information about myself. 02:08.050 --> 02:09.110 I am Serkan Temel. 02:09.110 --> 02:11.450 I am an electric and electronic engineer. 02:11.490 --> 02:21.370 I have seven years experience about industrial control systems, SCADA systems, based on electric distribution, transmission, power generation. 02:21.490 --> 02:31.530 For the last one year of my career, I'm focused on the cyber security in SCADA systems and also focused on the industrial control system cyber security topics. 02:32.130 --> 02:32.770 Thank you, Can. 02:32.770 --> 02:33.930 We can go on now. 02:33.990 --> 02:35.110 Presentation. 02:35.150 --> 02:41.590 I am also an electric and electronic engineer and I have more than eight years cyber security background. 02:41.590 --> 02:49.070 And last five years, I mostly concentrated on critical infrastructure and I say SCADA cyber security. 02:49.070 --> 02:57.450 At the moment, we're both working cyber wise for critical infrastructure cyber security at the moment. 02:57.450 --> 03:05.410 And today, as we mentioned, we will discuss electric subsector and power distribution, red teaming, and cyber security. 03:06.090 --> 03:06.950 All right. 03:06.950 --> 03:10.430 We want to start with why electric matters, actually. 03:13.030 --> 03:17.270 It's not just for us, but for the rest of the world. 03:17.270 --> 03:19.850 It's the backbone of all critical infrastructure. 03:19.850 --> 03:27.370 When it fails, it directly affects the daily life or modern life fundamentals. 03:27.370 --> 03:35.530 For example, it affects health sector, transport sector, transportation, and finance sector, and so on. 03:35.530 --> 03:46.370 So, once it fails, it directly affects people and public safety and it's really backbone of the critical infrastructure. 03:46.390 --> 03:53.930 So, we want to take that part and we wanted to build a presentation on it. 03:53.930 --> 04:04.250 So, we will be discussing about the red teaming in power distribution companies, but before it, we need to understand the electricity architecture in process wise. 04:04.250 --> 04:06.690 Basically, it has three parts. 04:06.690 --> 04:13.450 We have power generation, we have transmission lines, and then we have a power distribution part. 04:13.450 --> 04:19.050 Most of the time, power plants and power generation locate in the out-of-city centers. 04:19.130 --> 04:24.610 That means we need to carry electricity a long way of kilometers. 04:24.610 --> 04:27.370 It means we require the transmission lines. 04:27.370 --> 04:31.650 And finally, that means we need to power up-down operations. 04:31.670 --> 04:37.210 Once we are over from the transmission lines, we came up to the power distribution. 04:37.210 --> 04:40.950 It is the last line of the customer touch. 04:40.950 --> 04:48.630 I mean, if something fails in power distribution part, it directly affects customer and our business. 04:48.630 --> 05:01.190 To be honest, the distribution companies and electricity distribution process is not too much complicated when we compare it to power plants or petrochemical industry. 05:01.190 --> 05:05.330 So, it is easy to attack and also it is easy to defend. 05:06.210 --> 05:07.590 Serkan, would you like to add something? 05:07.590 --> 05:11.210 Yes, I would like to add some points in that presentation. 05:12.110 --> 05:19.730 Today, we tell you distribution, electric distribution, but I would like to be aware of this point. 05:20.450 --> 05:30.310 Transmission layer is a critical part of the electricity architecture because it's a bridge between power generation and power distribution. 05:30.310 --> 05:32.890 And it's the backbone of the electricity architecture. 05:33.210 --> 05:40.530 Today's topics are distribution, electricity, but transmission is very, very critical in the cybersecurity perspective. 05:41.030 --> 05:45.050 And actually, it depends over the countries or over the regions. 05:45.050 --> 05:47.230 Sometimes, it's operated by the government. 05:47.230 --> 05:50.430 Sometimes, it's operated by the private companies. 05:50.430 --> 05:54.290 It really depends on the region and country's perspective. 05:54.290 --> 06:01.630 But I will agree with you that this transmission line is also the core of electricity architecture. 06:01.690 --> 06:02.730 Thank you. 06:02.750 --> 06:08.310 So, let's deep dive into the power or electricity distribution infrastructure. 06:08.310 --> 06:18.350 First of all, it's a really great example of the SCADA because you have the people, which means the supervisory element of the SCADA, and you have remote locations. 06:18.350 --> 06:30.430 As you can see on the screen, there are lots of different substations connected via different types of communication medias to do your control center or emergency control center. 06:30.430 --> 06:41.450 So, what we said, it's a great example of the SCADA application because you get data from all over the different remotely located substation. 06:41.450 --> 06:45.430 And sometimes, you control over the remote substations. 06:45.710 --> 06:55.370 So, on the other hand, you have remote offices like payment offices, headquarters, government agencies to report for, you have direct integration. 06:55.370 --> 07:06.750 For example, in Turkey, Renewable Power Plant has to report the nearest power distribution company for the regulation. 07:07.970 --> 07:18.830 Basically, what we can say, there are lots of remote locations we have that we need to control, and that means we need different types of communication media. 07:18.830 --> 07:27.890 In distribution companies, we really need to take care of the communication media security as a part of the defense mechanism. 07:27.890 --> 07:40.650 On the other hand, sometimes, some companies or some governments or some countries have a smart meter application, which means smart meters have direct effective electricity. 07:40.650 --> 07:48.370 They open and close the electricity via metering control center through the smart meters. 07:50.430 --> 07:57.130 Why I'm telling you this, because it will affect our readiness scenarios and understanding the infrastructure. 07:57.230 --> 08:10.750 What we need to understand from this slide, we need lots of high level of connectivity, there are different types of communication media, and we have lots of different types of substation and equipments. 08:10.750 --> 08:15.150 And the rest of it, we have lots of different types of integration. 08:16.130 --> 08:26.970 All right, I will give a brief information and pass to the second stage. 08:27.430 --> 08:33.290 We discussed about the electricity architecture, and then we discussed about the power distribution architecture. 08:33.290 --> 08:37.470 Now, we will discuss about the SCADA architecture. 08:37.470 --> 08:40.110 It's also distributed in the server side. 08:40.110 --> 08:50.650 But before jumping into it, we need to understand there is a need of a high level of connectivity in such a power distribution company. 08:50.650 --> 08:56.050 Sometimes, you need to connect the outage management system, ERP application, call center, and so on. 08:56.050 --> 08:59.890 Maybe, Serkan, give some example about that. 08:59.890 --> 09:09.550 Yes, we mentioned about the previous presentation that we said that the distribution touches the customers. 09:09.570 --> 09:26.810 So, this means that in the distribution company, so many customers work into them, like customers management, outage management, VFMs, other stuff, so many stuff for the customers. 09:27.350 --> 09:39.690 The reason of that, the distribution SCADA systems must be and have to be integrated IT software applications, like Can mentioned, that's OMS. 09:39.690 --> 09:47.690 OMS, like VFM, like the other companies' third-party softwares. 09:47.690 --> 09:56.190 Because of that, distribution SCADA systems are a little different from the transmission and power generation SCADA systems. 09:56.470 --> 10:01.810 And also, in the distribution network, so many substations. 10:01.810 --> 10:07.290 This means that so many data, so many connection stations. 10:07.290 --> 10:11.550 So, we need the power of SCADA systems. 10:11.550 --> 10:24.130 We have to separate this load to separate servers, like application server, like communication server, like data server, like backup server, and so on, like HMI server. 10:24.330 --> 10:30.050 So, distribution SCADA systems are a little bit distributed and separated structure. 10:30.610 --> 10:34.250 It's very similar to IT environment, actually. 10:34.250 --> 10:37.430 You have some type of application servers, communication servers. 10:37.430 --> 10:45.990 It does some kind of load balancing, and it requires really great integration of an IT application or business application. 10:45.990 --> 10:56.090 Sometimes, part of SCADA applications, like we call outage management system or call centers, they are directly talking or integrating with our SCADA application. 10:56.090 --> 11:08.410 Because once you have a blackout or a kind of blackout or shut down electricity, you will get some calls, you will need to reach out your customers, you need to get some data from SCADA. 11:08.410 --> 11:12.990 So, it's really integrated with IT applications, sometimes cloud applications. 11:13.170 --> 11:21.410 And on the other hand, you have untrusted parties like vendors, remote offices, other type of control centers or government agencies. 11:21.410 --> 11:27.310 So, sometimes it's done via firewall, sometimes directly connected to your initial equipments. 11:27.310 --> 11:36.850 It really depends on the customer strategy, or sometimes they are not really aware of what kind of communication channels they have. 11:36.850 --> 11:50.170 But what we need to remember through here, our SCADA architecture is distributed as a server role, and it's like an IT application and it has integration with the business side. 11:50.170 --> 11:56.870 And also, it talks to the substation through our communication media. 11:56.870 --> 12:02.910 So, I will leave the comments to Serkan about substation, because he's lost. 12:03.490 --> 12:07.410 We have talked about the substation architecture. 12:07.410 --> 12:15.530 In the substation architecture distribution process, we have some main devices for the process we use. 12:15.530 --> 12:17.750 The first one is RETU. 12:17.750 --> 12:25.670 RETU is a telecontroller which connects field devices to SCADA systems. 12:25.670 --> 12:31.070 RETU is a data concentrator for data transfer devices. 12:31.430 --> 12:51.370 Energy analyzer is an energy meter which gets information from the CT and VT transformer from electric sites information and translates in the digital sites and directly sends this information to SCADA systems. 12:51.370 --> 13:00.610 Protection relay is a critical equipment in the distribution and also transmission and also generation, as you know that. 13:00.610 --> 13:09.410 Protection relay is the first IED device, first electronic device connected physical electric system. 13:09.410 --> 13:13.150 It is a bridge, cyber and physical world. 13:13.490 --> 13:21.150 The reason of that protection relay is the most critical part and most critical device in the distribution systems. 13:21.950 --> 13:30.330 As in cyber security perspective, if you want to shut down the electricity, you have to control the protection relay. 13:30.550 --> 13:35.590 But maybe you can attack the RETU, maybe attack the SCADA systems. 13:35.590 --> 13:40.690 It has just blocked our monitoring from the field sites. 13:40.690 --> 13:50.870 But if we want to control electricity, shut down electricity or re-energize the electricity, you have to control protection relay. 13:51.270 --> 13:53.570 The fourth device is the smart meter. 13:53.570 --> 14:03.910 Smart meter, as you know, that's for billing purposes and maybe low-voltage site for customer sites, shut down electricity or re-energize electricity. 14:04.770 --> 14:09.750 This last two devices is physical device. 14:09.750 --> 14:13.190 The first one is low-voltage circuit breaker. 14:13.230 --> 14:16.530 It is controlled electricity line. 14:17.430 --> 14:20.830 And the last one is the medium-voltage cubicles. 14:20.830 --> 14:24.810 It means circuit breaker also inside these cubicles. 14:24.810 --> 14:28.870 It controls the electricity line networks. 14:29.670 --> 14:31.670 Next slide, please. 14:32.330 --> 14:34.270 I think... Yeah. 14:34.270 --> 14:35.350 Yes. 14:36.270 --> 14:41.290 Yes, we have line IAD device, protection line device. 14:41.290 --> 14:46.430 This is... I would like to say it again because it is very critical. 14:46.590 --> 14:51.110 Protection device has two parts. 14:51.110 --> 14:53.750 One of the hardware, otherwise the software. 14:53.750 --> 15:03.390 The hardware side, they have unlock input, unlock output, digital input, digital output, and the other server Ethernet interface. 15:03.950 --> 15:18.410 Voltage and current information takes with unlock input modules and also control unlock system like set points, power, like set about the frequency, let's set about the voltage. 15:18.410 --> 15:20.690 You have to send unlock output. 15:20.970 --> 15:31.770 And digital input and digital output is mostly critical because digital input comes from basically circuit breaker position, isolated position, the other information about the systems. 15:31.770 --> 15:38.410 And digital output is control the circuit breakers, means that you control the electricity. 15:38.410 --> 15:48.570 Because of that, in the SCADA systems and most of the communication protocols or animal detection or cybersecurity perspective, we focus on the digital output signal. 15:49.390 --> 15:57.750 In the beginning of this device, they have serial interface because in that time, Ethernet IP world. 15:57.750 --> 16:06.050 And today's most of device has Ethernet interface and it gains advantage of the Ethernet IP world. 16:06.050 --> 16:14.170 But it is some cause of the side effect from cybersecurity, this gains of advantages. 16:14.310 --> 16:17.830 I will tell about later. 16:17.830 --> 16:30.250 On the software side, communication protocols, protocols like ISP104, DNP3, the other. 16:31.390 --> 16:41.570 This helps communicate with R2 or communicate with the SCADA systems to send information to the upper level. 16:41.630 --> 16:51.110 Logic functions control like circuit breaker or other blocking material functions, logic functions, and configuration interface. 16:51.110 --> 16:56.590 Critical part of the IoT device, as I mentioned, they have Ethernet interface. 16:56.670 --> 17:05.630 Most of IoT device nowadays use web service interface for configuration software or configuration interface. 17:05.630 --> 17:14.530 This is some vulnerability about systems as the weak point of this IoT device nowadays. 17:14.530 --> 17:17.550 Thank you, Serkan. 17:17.550 --> 17:30.330 Actually, we always get afraid or get freak about touch such intelligent electronic devices because as you mentioned, one part is physical that controls electricity and one part is cyber. 17:30.530 --> 17:40.050 It's R2 or SCADA applications and it's like a last line of the physical and cyber breach. 17:40.090 --> 17:57.410 Once you control it, you control the electricity, you can control it through the R2 or you can directly send commands to the IAD or you can trigger some SCADA application set points and it will directly affect the intelligent electronic devices. 17:57.410 --> 18:12.810 But once you're planning a red teaming or pen testing activity, you need to be aware of such devices can affect the electricity and you need to be really careful what you're playing with. 18:13.910 --> 18:21.380 All right, so now we can discuss about red teaming approach and red teaming scenarios. 18:23.090 --> 18:42.630 Before jumping into the details, I want to discuss how much red is that because since it's a critical infrastructure, since it's a last line of the custom touch, can we be really free to be really red teaming? 18:42.930 --> 18:54.770 In that case, most of the asset owners and most of the cybersecurity companies get afraid to or avoid the consequences of bad thing happens. 18:54.770 --> 19:14.430 So I may say that nobody does direct red teaming, maybe it's like light pink teaming, let's say, because we really need to be aware of that the public safety and process safety is much more important than your color activity. 19:14.850 --> 19:29.410 So you need to take care of the process, you need to take care of the public safety because we always think in that way if we shut down electricity for the hospital and if we kill someone in that hospital because of no electricity. 19:29.410 --> 19:39.710 So it really has a great boundary for us to do our test or pen testing activities or red teaming activities in a controlled way. 19:39.710 --> 19:49.670 So it's not really red, light pink maybe, but to understand each other in a better way, I want to express that part as well. 19:49.670 --> 19:52.770 So I would like to mention about the core steps. 19:53.630 --> 19:56.450 We divide into five main steps. 19:56.450 --> 20:02.350 Actually, we discussed about the first two of them to understand the process, understand the architecture. 20:02.970 --> 20:12.490 Once you do any red teaming activity in any kind of ICS infrastructure, in that case, we are talking about the power distribution. 20:12.490 --> 20:20.870 We gave brief information about the electricity architecture, distribution architecture, scale architecture, and substation architecture. 20:20.890 --> 20:28.830 And we thought that the power distribution company's process is not too much complicated. 20:28.830 --> 20:34.290 We have very limited type of signals compared to power plants and petrochemicals. 20:34.290 --> 20:37.190 So it's a really easy process. 20:37.190 --> 20:39.530 It's easy to attack and easy to defend. 20:39.530 --> 20:53.310 Now we need to define our landscape and then we will try to create some kind of scenarios to directly develop for red teaming activity usage. 20:53.310 --> 20:58.130 And then finally, we will perform some kind of attacks in our simulation lab. 20:59.270 --> 21:09.910 I don't want to talk about the IT-based or getting into the IT and then jumping into OT kind of red teaming activities or landscape. 21:09.910 --> 21:26.150 But once you are talking about the power distribution red teaming, we wanted to give you brief landscape information that what you need to know, what you are going to face, and how it will affect your planning. 21:26.530 --> 21:30.930 So basically, we have eight categories that we will discuss today. 21:30.930 --> 21:32.310 The first one is protocols. 21:32.310 --> 21:37.770 There are different types of protocols you will see in the field in the distribution companies. 21:37.770 --> 21:44.170 Basically, in scale apart, I mean the wide area network, you will see ISC-104 and DMP3. 21:44.170 --> 21:50.930 And substation level, you will see different types of protocols, sometimes goes MMS and so on. 21:50.930 --> 22:01.990 And upper level, in supervisory level, you will see soft bus and the control level, you will see Modbus, TCPR2, even sometimes Serif protocol. 22:02.110 --> 22:08.330 And then if you have smart meters and even in SCADA application, you may have the power line communication. 22:08.330 --> 22:12.250 It's not, it's still PLC, but it's a different term. 22:12.250 --> 22:14.610 We will discuss it today as well. 22:15.190 --> 22:18.470 And then we said that communication media is very important. 22:18.470 --> 22:40.470 If you get into the communication media somehow, let's say you get into the APN network based on GSM or you get into the RF signals, you then directly interact with substations, interact with RTUs and interact with control center equipments and emergency control center equipments. 22:40.470 --> 22:47.070 So communication media is also too much important for us to rectify in planning. 22:47.070 --> 22:50.990 On the other hand, you need to be aware of the third part integration. 22:51.430 --> 22:53.950 There are different types of integration. 22:53.950 --> 22:57.730 It depends on the country and region and the regulation. 22:58.030 --> 23:01.370 You see some of them in our list. 23:01.370 --> 23:17.030 And also as a asset owner, you have some kind of remote locations or local locations like control center, energy control center, material control center, headquarters, payment offices, or communication center for like RF towers. 23:17.190 --> 23:22.530 So asset owner locations also matter to us. 23:23.090 --> 23:38.590 On the other hand, substation is very important for us because it is remote located and physical and cyber control is very limited compared to control center or emergency control center or headquarters. 23:38.630 --> 23:46.850 In that case, you will be facing industry protocols on industrial devices and you may apply some kind of hooping attacks. 23:46.850 --> 24:02.710 What I mean by that, once you get into the specific remote substation, you can jump over the other substation, you can jump over the control center or emergency control center, you may create some fake signals. 24:03.090 --> 24:07.710 It's like coming from the old remote substation and so on. 24:07.710 --> 24:14.910 So it's a very great entry point and great defense point for us. 24:15.530 --> 24:20.130 But I should stress out that in substation, we have some physical controls. 24:20.130 --> 24:31.790 For example, if someone opens the door or if someone opens the cabinet, if someone moving in the substation, it creates some alerts and sends signals over the 104 to the control center. 24:31.790 --> 24:40.890 So we still have some type of controls that we need to be aware of when we plan SOC activities or when we plan red teaming activities. 24:40.890 --> 24:48.230 On the other hand, technology, I'm sure that all the villagers have a proper knowledge of them. 24:48.230 --> 25:00.310 I don't want to express each of them because it's like the IT-wise pan testing or red teaming because it's server, network devices and some kind of field devices. 25:00.430 --> 25:03.050 So I don't want to go each of them. 25:03.050 --> 25:20.410 And on the other hand, we have people, for example, in Turkey, we have a specific regulation for assessment in the power generation and distribution companies and it requires social engineering activities for the energy people, let's say the asset owner people. 25:20.410 --> 25:30.270 Sometimes we see that some red teaming activities hit the vendor engineers or OT partner or engineering company engineers. 25:30.850 --> 25:42.250 So people's segment is also really varied and different types of mechanisms they have. 25:42.250 --> 25:52.790 For example, in Turkey, we need to do physical pan testing, we need to do phone calling, we need to do email-based social engineering. 25:52.790 --> 25:56.270 It's all written down by the regulation. 25:56.390 --> 26:18.790 And also yet another landscape for us, the industrial process, and we will discuss it yet in another conference because since it is the less signals and it's less complicated in the power distribution and power industry, the industrial process vulnerabilities may affect public safety directly. 26:18.790 --> 26:35.250 So we avoid to mention the entry points of process vulnerabilities, but we can discuss it later for another industries on the following days. 26:35.250 --> 26:43.770 All right, so I hope we understood the process, we understood the architecture, and defined some kind of landscape. 26:43.770 --> 26:53.410 Again, it may change the region, country, and regulation, but we need to understand the basics of a distribution. 26:53.410 --> 26:56.070 So we need to create some kind of scenarios. 26:56.070 --> 27:02.190 In this presentation, we created three types of scenarios. 27:02.190 --> 27:05.690 We have created a specific table for that. 27:05.690 --> 27:07.850 I will discuss it through them. 27:08.170 --> 27:12.990 And it's again not IT-based red teaming or pan testing. 27:12.990 --> 27:22.810 We try to create some kind of direct effect on electricity-based scenarios. 27:24.570 --> 27:32.210 So in the scenario, we have a chance to work with IoT team leader and hardware security leader with Fatih Kayran. 27:32.210 --> 27:35.910 Actually, he developed this scenario and applied it in the field. 27:35.910 --> 28:00.410 Once upon a time, we were in the distribution company and came up with the idea that we figured out somehow the smart meters were controlling the city's electricity, which means if we could find a way to send a proper comment to smart meters, it will directly shut down the electricity. 28:00.890 --> 28:05.590 In that case, the smart meters were talking through the power line communication. 28:05.590 --> 28:09.290 And so we created our scenario based on this. 28:09.290 --> 28:23.190 So to understand the team mates to each other in a better way, we create such a table to define our success criterias, difficulty factors, and decide if key change is required or not. 28:23.330 --> 28:33.850 I will walk through the one table and I will pass through the rest of it because we will perform a real-time simulation for the rest of it. 28:33.850 --> 28:39.130 In this scenario, we targeted the shutdown electricity. 28:39.150 --> 28:50.070 But before jumping into that, we classified our tactics and techniques based on MITRE, manipulation of control and manipulation of weave. 28:50.070 --> 28:54.270 And our entry point was smart meters power line communication. 28:54.330 --> 28:58.790 Complexity in this scenario was high. 28:58.790 --> 29:20.170 Difficulty was high because unknown protocols were there, specific hardware design is required, and high-voltage work environment can be dangerous because we lost one of our laptops and one of our team members got injured during this test because we worked with the high voltage directly with the plugs. 29:20.850 --> 29:29.990 To better understanding, you plug the smart meter into the city network. 29:29.990 --> 29:37.550 So you turn into that specific smart meter into weapon to target the electricity. 29:37.830 --> 29:42.830 For a better understanding, I will discuss it through this presentation. 29:42.830 --> 29:48.410 So dependency was communication interface reverse engineering or protocol reverse engineering. 29:48.410 --> 29:51.050 Required time was high for us. 29:51.150 --> 29:53.970 And also, what was our success criteria? 29:53.970 --> 30:03.530 Understand the protocol, send and receive packets on the power line, send command to cut off the electricity for a defined area. 30:04.350 --> 30:12.190 Sometimes we create some SOC success criteria for our customers to detect better the next attacks. 30:12.190 --> 30:23.450 In that case, it could be hardware or smart meter log management, OMS log management, call center log management, or smart meter application log management could be a success criteria in that case. 30:23.450 --> 30:31.510 We define log sources for red teaming activities, and then we define a purpose , method, and kill chain activity. 30:32.050 --> 30:46.270 In that case, our proposal was to shut down the electricity unexpected point of entry through unexpected communication media, turn plug-in meters into industrial attack equipment. 30:46.270 --> 30:50.250 So our idea was simple. 30:50.250 --> 30:55.570 So power line communication works through the power signals. 30:55.570 --> 31:01.550 You modulate it and put your data into the electricity signals. 31:01.550 --> 31:05.930 So it directly talks through the electricity. 31:06.310 --> 31:11.330 I think yesterday, there was a specific session about that. 31:11.330 --> 31:17.970 In that case, we will look into how it's used in distribution companies. 31:17.970 --> 31:33.970 In that case, we have the pack concentrator, which is directly connected to different types of customers, almost lightning, and there are smart meters, and there are some power line communication interfaces, and it connects to the backend system through the APN, 31:33.970 --> 31:36.390 in that case, over the internet. 31:36.590 --> 31:37.670 So guess what? 31:37.670 --> 31:43.110 It was the broadcast messages going through the specific power line. 31:43.210 --> 31:50.350 If you have specific hardware, you can develop it, or you can turn smart meter into your tool. 31:50.350 --> 32:00.250 In that case, we made it, and we were able to understand the reading data, and they shut down the electricity commons. 32:00.670 --> 32:13.590 So since it's broadcast, each of smart meters get the data, and once you give order, everyone gets the order, but one of them apply it and report back to center. 32:14.310 --> 32:26.390 So once you sniff the data, you see the smart meter ID, and in that case, power line communication, we're using a DLSM-QSAM protocol. 32:26.390 --> 32:35.730 In that case, that specific number defines the shutdown electricity command, like the double command in 104, very similar. 32:36.070 --> 32:41.650 And also, in that case, we were able to get readout data. 32:41.650 --> 32:48.370 In this case, this is the readout for DLSM-QSAM protocol. 32:49.150 --> 32:59.210 What we are trying to say is that you don't directly attack the SCADA application, RTUs, or IEDs. 32:59.270 --> 33:10.370 The best way, and easy way, is to find yet another proper line to end of your goal. 33:10.370 --> 33:28.990 So in that case, the power line communication and smart meters gave us a chance to shut down the electricity, but you need to deal with high voltage electricity, you need to deal with power line communication, new type of protocols, modulation, demodulation, 33:28.990 --> 33:33.150 encryption, type of things require much more time. 33:33.150 --> 33:40.750 But most of the time, the asset owners and the pen tester doesn't pay attention on the deck channel. 33:40.750 --> 33:48.310 So you really create a volume for your customer and people safety in that case. 33:48.310 --> 33:55.730 So as I know, the European countries also have great implementation of smart meters. 33:55.730 --> 34:00.010 We need to take care of these standards as well. 34:04.160 --> 34:24.680 So our last two scenarios, based on the RTUs and industrial protocols, we will show how to do industrial red teaming in a real lab environment, which took days for Serkan and got old during these sessions. 34:25.240 --> 34:29.960 Basically, we have two different scenarios for this presentation. 34:29.960 --> 34:39.580 One of them, extracting data from config files without further reverse engineering or further implementation of anything. 34:39.960 --> 34:56.060 The thing about that, you have some type of configuration files, you don't have any access to OT environment or substation yet, but you will figure out some type of data to plan your next session of red teaming activities. 34:56.060 --> 34:58.800 We have a specific example of that. 34:58.800 --> 35:09.580 Since I discussed deeply and very detailed the last table, I don't want to discuss it, losing any time on that. 35:09.580 --> 35:15.100 So I will jump into the next one, because we will discuss real scenario. 35:15.200 --> 35:20.220 Yet another scenario for this session is the remote substation protocol attack. 35:20.720 --> 35:26.640 In that case, the attacker needs to interact with the substation equipments. 35:26.640 --> 35:36.160 It can be done via Raspberry Pi implementation and connect through the Wi-Fi and so on, like we did in our lab environment. 35:36.380 --> 35:43.040 And we will shut down the electricity using the protocol commands. 35:43.040 --> 35:56.520 Once we understand what kind of protocols used and how, once we understand the protocols, we will figure out where to send the data and finally send the data to shut down the electricity. 35:57.920 --> 36:18.580 To have better understanding each other, what we are trying to say, if you are planning to red teaming activity in a power distribution company or assessment, you need to understand the process, you need to understand the architecture, you need to understand the landscape. 36:18.580 --> 36:22.740 Once you have a tree element, then you can create your scenarios. 36:22.740 --> 36:33.100 You need to think out of the box, but that box doesn't mean you can go out public safety rules or process safety rules. 36:33.100 --> 36:36.700 So it's really hard to balance. 36:37.260 --> 36:53.260 And we want to give you some simple ideas to reach out your end goal, rather than implementing some IT-based or IT-related red teaming activities. 36:54.660 --> 37:04.180 I think I can be free from now and put the second into fire. 37:05.020 --> 37:12.200 As a tradition, we are face to face with the Murphy's rule. 37:12.220 --> 37:15.840 But finally, we succeed on the setup a lab. 37:15.840 --> 37:21.220 Now I have new information about lab setup. 37:21.220 --> 37:25.820 It's a very simple part of substation process. 37:25.820 --> 37:41.260 We have one RTOS, ABB 140, and one IAD device, one SCADA server, SCADA PCs, and also one switch. 37:41.260 --> 37:45.180 We use CapWare software as a SCADA master. 37:45.180 --> 37:52.080 And also we use Modbus-TC protocol and also ISU-104 protocol. 37:52.080 --> 38:01.100 Modbus-TCP used in IAD device between R2 and ISU-104. 38:01.100 --> 38:06.880 We use it R2 between SCADA and CapWare device. 38:06.880 --> 38:12.560 The tricky part is the implemented hardware substation as an attacker. 38:12.560 --> 38:19.360 We think that we have some Raspberry Pi device or the other device as attacker machine. 38:21.440 --> 38:30.880 Now, before jumping into details, I would like to mention that this setup doesn't indicate any one of these on ABB RTOS. 38:30.880 --> 38:38.100 It's just a simple RTOS that we could use on the market, and we knew how to configure it. 38:38.100 --> 38:45.040 So we will do some protocol-based simulation, but it doesn't just affect the ABB. 38:45.040 --> 38:50.840 It's based on the leverage of the protocol usage, to avoid any misunderstanding. 38:51.240 --> 38:56.380 And also it is a very common RTOS used in Europe and Asian sites. 38:57.060 --> 39:00.900 And also this is the second reason we chose this RTOS. 39:00.940 --> 39:05.840 Now we can jump into the labs video. 39:06.400 --> 39:10.420 All right, so we will start with interfaces and signals. 39:11.640 --> 39:16.420 Well, first we do this about configuration RTU. 39:17.140 --> 39:19.710 I'll jump into that, just a second. 39:22.440 --> 39:30.660 Yes, we use RTU 500 software for programming RTU, configuration RTU. 39:38.690 --> 39:43.030 We created it before and open existing projects. 39:43.590 --> 39:45.650 This part a little bit takes time. 39:45.650 --> 39:49.530 It may be boring. 39:49.950 --> 39:56.330 They hide the project file deep inside my file system. 39:58.530 --> 40:03.950 Yes, a Turkish character error. 40:03.950 --> 40:09.550 Now, this is the RTU 500 software interface. 40:09.550 --> 40:10.630 This is the network tree. 40:10.630 --> 40:14.130 We have three communication lines. 40:14.130 --> 40:17.570 One is IEC 1 and 4 for SCADA communication. 40:17.570 --> 40:22.610 The other one is Modbus TCP for IED device, Modbus communication line. 40:23.690 --> 40:28.910 You can easily see that some parameter of the communication protocol. 40:28.910 --> 40:34.610 Yes, it is the 1 and 4 communication protocol setup. 40:37.130 --> 40:45.330 As you see, that's us-to-address, us-to-address structure, informal structure, maximum length of IDLE. 40:45.970 --> 40:53.410 And then, this is the Modbus TCP site configuration. 40:58.760 --> 41:00.360 This is network tree. 41:01.800 --> 41:04.620 Now, we are in hardware tree. 41:04.620 --> 41:10.180 In the hardware site, we choose our RTU main CPU model. 41:10.180 --> 41:16.140 And also, we add the field level signal information in that site, hardware site. 41:16.140 --> 41:23.060 And also, as you see, that the Modbus TCP communication configuration zone. 41:23.600 --> 41:27.040 This is the IP address of the IED device. 41:28.320 --> 41:37.340 And also, again, 104 configuration section. 41:37.340 --> 41:41.190 Now, this is the RTU interfaces. 41:42.270 --> 41:45.560 It has two Ethernet interfaces. 41:45.560 --> 41:49.470 As you see, that's IP address of the interfaces. 41:54.300 --> 42:00.180 And this site, we configured our field level signal, like active power. 42:00.180 --> 42:04.960 That is the Modbus site, withholding register, index number 13. 42:05.080 --> 42:13.900 And this is the SCADA ISC 104 site, us-to-address 1, information object address 103. 42:14.520 --> 42:18.960 And the other signals, like phase A current, phase B current. 42:19.540 --> 42:24.680 We record all and show the all parameters of the signal. 42:31.960 --> 42:35.780 And maybe you want to replay your own lab. 42:35.780 --> 42:40.700 So, we wanted to give you brief info in this section. 42:40.700 --> 42:45.460 The other sections will be much more faster, let's say. 42:46.140 --> 42:54.960 But once you understand that part, configuration, it's much more easier to understand the rest of the simulation. 42:55.080 --> 42:57.040 This is the type of the Modbus signal. 42:57.040 --> 43:04.220 As you see, that's force commands, signal commands, and register read-call status. 43:04.220 --> 43:11.560 Read-call status is used for the information, single point information, digital inputs, like position of the circuit breaker. 43:12.960 --> 43:17.580 And switch control means that sends control command to the circuit breaker. 43:18.280 --> 43:27.080 Power limit set points, and the other mid-range information, phase A current, phase B current, phase C current. 43:27.800 --> 43:31.980 It's a very simple model of the substation. 43:36.260 --> 43:39.880 So, we can jump into the second report. 43:39.880 --> 43:41.860 Second report. 43:44.360 --> 43:50.900 In this report, we directly connect the radio web interfaces. 43:50.900 --> 43:56.400 As you see, this is the IP address of the first Ethernet interface. 43:56.760 --> 44:00.100 Use username and passport. 44:00.560 --> 44:05.440 In that site, you can easily see that configuration management site. 44:05.440 --> 44:21.000 You'll see that the configuration file, which configuration is now active, when you update this configuration file, and also get configuration file from the device, and also delete this configuration, etc. 44:21.000 --> 44:28.320 And also, directly on site, you can easily monitor signal system log, system event status, and client session log, and also hardware tree. 44:28.320 --> 44:42.600 Hardware tree is the live monitoring about R2, especially in the site, you see that R2 is active, R2 is operable, means that it's connected to a device. 44:43.120 --> 44:51.960 As you see, that CPI switch position is on, and also metering information about systems. 44:54.140 --> 44:57.460 It is live data, real-time data. 45:01.060 --> 45:05.440 Now, I can talk about a little bit configuration file, if you wish. 45:05.660 --> 45:12.000 Our third video related the configuration file and extracting some data. 45:12.120 --> 45:30.140 Again, it doesn't indicate any vulnerabilities on the R2, but somehow, if you reach out to backup systems, or if you reach out the file server in the IT system, once we have a configuration file, now we will download it and extract some data from it. 45:30.140 --> 45:36.580 It's really easy, actually, before furthering reverse engineering implementation. 45:37.560 --> 45:43.420 In that case, we are not into the remote substation, we are not in the control room. 45:43.420 --> 45:47.480 Somehow, we get data about the configuration file. 45:47.480 --> 45:56.750 It can be an engineering workstation, file server again, or a backup system, maybe an engineering partner workstation. 45:57.100 --> 46:13.200 Once I get the configuration file, I am directly able to see what kind of R2 is used, what version, what purpose they are using, what kind of interfaces, and what kind of IP addresses they have. 46:13.260 --> 46:18.960 And also, what kind of protocols they have. 46:18.960 --> 46:22.560 It will affect my further planning, actually, in the red teaming activity. 46:22.560 --> 46:33.260 What kind of devices connected to that R2 in substation, and what kind of signal parameters they are looking for it. 46:33.260 --> 46:50.240 So once I have that information without any probing, any scanning activity, or any physical attachment, it's really leverage of your effort once you have that kind of specific knowledge. 46:50.420 --> 47:11.400 We have also some specific projects that the worst engineering read all the data, not people readable format at the moment, you have much more better information and knowledge about the targeted system. 47:11.400 --> 47:19.060 So in that case, we want to show you, you don't need to go to the control center or remote substation. 47:19.120 --> 47:38.820 Somehow, if you are able to get config files, you may read directly with the Notepad++ and read some data, understand the process, understand the protocols, interfaces, and plan a better red teaming activity or targeted attack into the targeted system. 47:38.820 --> 47:41.540 So I will jump into your part, Serkan. 47:42.100 --> 47:51.540 Yes, the fourth video is about the normal traditional application and communication with SCADA systems and RETU. 47:52.260 --> 47:59.480 First of all, I will show to my IP address and same subnets with the R2 interface one. 48:02.410 --> 48:09.030 And then we use, said before, CAPS server as a SCADA software, SCADA master program. 48:09.910 --> 48:17.370 This is the configuration of the master site, CAPS player site, CAPS server site configuration file. 48:17.370 --> 48:23.370 As you see that communication address, common address, 48:29.160 --> 48:46.300 advanced settings, network interface, as we have same subnets, same IP address, more advanced parameters for IEC 1 and 4, originator address, like, and also network interface. 48:46.300 --> 48:52.920 Network interface means that this is the IP of the RETU and the port of the IEC 1 over 4. 48:56.420 --> 49:01.280 And this site, we also configure our signal. 49:01.640 --> 49:06.000 This means that it is analog short float volume. 49:08.640 --> 49:11.840 Australia is 1 over 3. 49:12.320 --> 49:17.900 So it is the breaker control commands, single commands means. 49:21.840 --> 49:26.780 Actually, it will directly affect the open and close breakers. 49:26.780 --> 49:30.080 Later then we will apply some scenarios. 49:30.080 --> 49:35.580 It's really important to understand what type of parameter and what type of commands they take. 49:35.580 --> 49:37.560 Now we connected to RETU. 49:37.560 --> 49:40.080 As you see that this is the real-time data. 49:40.420 --> 49:44.320 As you see, active power 2400. 49:44.820 --> 49:46.840 And also breaker control is zero. 49:46.840 --> 49:49.200 Breaker position is one, means that the closed. 49:49.500 --> 49:51.840 Now we sent the breaker control. 49:53.420 --> 49:55.700 Control command is one. 49:57.320 --> 49:59.600 Yes, it takes the commands. 49:59.660 --> 50:10.500 In the real-time and real-time operation, when we send this command, we re-energize that circuit breaker or shut down the circuit breaker with this command. 50:15.780 --> 50:16.980 All right. 50:18.220 --> 50:31.220 Now, and also I would like to show some wire shack traffics between CAPWARE and RETU. 50:32.740 --> 50:34.720 This is the Ethernet. 50:35.120 --> 50:39.560 We apply our display filter for IS104. 50:46.700 --> 50:51.000 Yes, as you see that this is a test frame in the protocol. 50:52.020 --> 50:57.860 Now we re-send the command again and show the traffic. 51:01.360 --> 51:06.360 Yes, this is commands, single command. 51:08.580 --> 51:11.260 Astro address 107. 51:11.260 --> 51:17.060 As you see that this is the wire shack single command. 51:18.760 --> 51:20.940 Address is one. 51:20.940 --> 51:23.020 IO address is 107. 51:23.020 --> 51:26.600 And also set commands value is zero. 51:26.600 --> 51:38.640 As you see, you can easily get this information from the wire shack because the IS104 is an open-text protocol, not encrypted or hashing protocol. 51:38.640 --> 51:42.140 You can easily get information from the traffic. 51:43.380 --> 51:50.980 In that case, you see that the single or double commands take place in IS104. 51:50.980 --> 51:58.520 In that case, we send a specific shutdown or open command in a targeted area. 51:58.520 --> 52:06.080 In case it was zero, it means we shut down the electricity through a legitimate traffic. 52:06.080 --> 52:11.040 I mean, it was a traffic generated by the control center. 52:11.040 --> 52:21.780 Now we will try to apply as an attacker point of view who is in the remote substation via implemented hardware. 52:23.000 --> 52:26.580 This is the fifth video of us. 52:27.960 --> 52:34.240 Yes, we have information about the second interface, about R2. 52:34.400 --> 52:43.940 Now in the attacker machine, I configure my IP address for the second interface of the R2, as you see. 52:44.320 --> 52:58.740 Okay, now I use mmap for some research on some search vulnerability or open ports. 53:00.420 --> 53:05.040 In that case, we are looking for who has an IS104. 53:05.040 --> 53:11.760 In that case, in that protocol, use specific ports if nobody changes it. 53:11.760 --> 53:18.220 So we are looking for the same subnet if someone has that specific protocol. 53:18.220 --> 53:29.420 Please be aware it's an attacker point of view and got into the substation looking for some IS104 endpoints and two devices. 53:29.420 --> 53:30.900 We found it. 53:31.440 --> 53:42.080 This is retail device as you see from the IP address and also IS104 is open port and also services up. 53:44.700 --> 53:54.980 But now we have only information about R2's protocols and R2's IP address, but we don't have any information about the signal and signal address. 53:54.980 --> 53:58.280 Now we use CAPWARE again. 53:58.880 --> 54:04.960 We configure CAPWARE again, as you see. 54:16.470 --> 54:18.790 We tried it once. 54:19.190 --> 54:21.870 Now it's connected to R2. 54:22.930 --> 54:30.050 Now in the protocol structure, we have general integration commands. 54:30.050 --> 54:39.090 When we send this command, R2 gets a response and sends all information about in this R2 insight. 54:40.730 --> 54:43.770 We send GI commands to the retail. 54:44.010 --> 54:59.290 I don't know any information about the object address, but when we send this command, R2 responds to this command and now we can easily observe which address and which type of information inside of it. 54:59.490 --> 55:14.290 As you see that address is 1, IO address is 100 and value is also, as you see, 332, etc, etc. 55:16.290 --> 55:27.810 So basically protocol gives an opportunity to us to pull all kind of signals and data from the R2 for a specific protocol line. 55:27.810 --> 55:34.790 As an attacker, we use the exact same tool, but it's a simulation environment. 55:34.790 --> 55:39.630 Again, you can use your lab environment, that specific tool. 55:39.630 --> 55:45.970 Yet another tool we have, it's developed by, I think, the master degree student in Germany. 55:45.970 --> 55:48.330 It's called ISE test. 55:48.450 --> 55:57.670 And to make sure all of you, we will send the latest command to that specific tool. 55:58.430 --> 56:00.890 Next, again, R2. 56:00.930 --> 56:03.170 Now we send command again. 56:03.650 --> 56:11.730 Get information from traffic and also we send commands to 107. 56:11.790 --> 56:21.230 As you see from Wireshark traffic, we send commands and also on of on commands. 56:24.260 --> 56:34.480 And also as you, from traffic, it is action confirmation from the R2 in number of line 18 and 37. 56:37.100 --> 56:40.300 GCSCNA at confirmation. 56:40.300 --> 56:45.040 As you see, this means that R2 accepts this command. 56:48.260 --> 56:56.920 Once you get into the substation, you pull data through the protocol and you send the command through the protocol again. 56:56.920 --> 57:00.900 In that case, single command or double command supported by the 104. 57:01.140 --> 57:07.260 And then you are able to shut down the electricity. 57:07.260 --> 57:17.200 In that case, if it's your end goal, you may apply very different type of scenarios and red teaming activities, but we want to show you that it can be done. 57:17.200 --> 57:22.080 There are some safety mechanisms or configuration mechanisms to avoid it. 57:22.080 --> 57:29.540 Sometimes you implement the IP based solution or animal detection solution to count that kind of activities. 57:29.540 --> 57:34.460 So in this session, we are end of our presentation with takeaways. 57:34.460 --> 57:44.060 We would like to stress out during red teaming activity, we need to think out of the box, but we still need to take care of public and process safety. 57:44.060 --> 57:47.340 It's really a rule of thumb for us. 57:47.340 --> 58:00.520 Power distribution environment is not complicated as process-wise when compared to power plants or petrochemical, but it has directly affected the other critical infrastructures and customers directly. 58:00.780 --> 58:05.300 Power distribution companies have lots of different interdependencies. 58:05.640 --> 58:09.620 Therefore, information getters could be a role for red teaming activities. 58:10.420 --> 58:16.800 And power distribution companies are easy targets and easy to defend compared to other ICS infrastructure. 58:17.720 --> 58:20.640 So we have two minutes left. 58:20.640 --> 58:25.020 If you have any questions, please feel free to ask. 58:25.020 --> 58:30.720 We will be on Discord as well, as well as we can. 58:31.320 --> 58:37.640 So Serkan, if you have any comment, please do it, or we can get to questions. 58:37.800 --> 58:42.180 If you have any questions, we will be in Discord. 58:43.220 --> 58:46.980 We will be happy to answer your questions. 58:48.380 --> 58:51.920 John and Serkan, thank you for your talk. 58:51.920 --> 58:59.960 I noted in the Discord speaker Q&A that I consider this a mandatory talk to watch for both learning about 101 and assessments. 59:00.060 --> 59:04.760 So I really, really appreciate y'all dialing in and supporting us. 59:05.060 --> 59:07.120 Thank you very much for having us. 59:07.200 --> 59:08.600 I hope you enjoyed.