Hi everyone, we are AboDefense and we will make a presentation about Mexico's cybersecurity status.
In this presentation we will talk around industrial cybersecurity footprint, key data,
perspective, smart production, and sensor security experience, honeypot, lesson learns,
and opportunities. Thank you ICI Village DEF CON 28 and the cyber colleagues on this opportunity
to make a presentation about Mexico's industrial cybersecurity.
Talking about Mexico facts and figures, we have facts and figures in terms of the economy.
Mexico is ranking under position 12 around the world. Manufacturing services, transportation,
utilities, and spending are the main economical activities in Mexico.
In concern of the industrial sector, the manufacturing has an activity of 175 billion
U.S. dollars. Key subject focus on IC industrial security for this presentation.
The top industrial sectors are in Mexico the automotive industry. It's the top five world
with OEMs and their supply chain change. Medical is the second position in Latin America
behind Brazil. Aeronautics 60 percent, more competitive, and electronics the
largest economical region worldwide. Also Mexico have other industries like oil, electricity,
food, textiles, agriculture, chemical services, consumers, and furniture, I mean other sectors.
On the industrial sectors, more are important that the main manufacturing companies use 55 percent
of insulated PLCs inside the IC area. Most are insulated and most not connected to any network.
Three percent of use industrial service at the shop floor and connected to the network.
Most of these industrial services are set by the automotive international companies
like from Germany or Japan, among other ones. Most of the industrial companies are located
from center to the north of Mexico. As an example, the automotive industry is located
from the center and the north of Mexico. In the case of aerospace and medical industries are
situated on the northwest of Mexico. On the network subjects, we will see that the strongest future
is based more in the north of Mexico. Southern Mexico is more agriculture and other topics.
Mexico has around 50.3 million IP addresses, an average of 7.5 megabits and the cyber attacks
around 28 from 195 countries. So basically, the most important in the case of the cyber attacks
is mainly attacks to the government offices and other departments like, you know, banks and services.
In terms of the SWAT, the IC security, the strengths is that Mexico is growing in the industry
from point zero. It's focused to the smart production, smart logistics, smart enterprises,
among other ones, which require in a short period of time the implementation of the industrial
cybersecurity practices. For the U.S.-Mexico-Canada trade, which was released the 1st of July 2020,
covered the topic on digital and cyber security rules and process between the countries.
It's a major important thing, because, especially for Mexico, because Mexico needs to follow up
and implement the good practices and lessons necessary to accomplish the digital security
and internet policies from this trade. In terms of the weakness, Mexico has no deep
knowledge on ICS security topics. Also, the companies and the owners have no idea, even
awareness, about industrial cybersecurity. For those insecure systems, there is insufficient
information. There are opportunities as well. The U.S.-Mexico-Canada trade is focused to increase
commercial competitiveness region against other markets, Asian markets or European markets.
These trades include specific actions to meet cybersecurity terms, as the first one.
Trade, according to our experience, the most attack to industrial is related to ransomware,
especially on the R&P systems, as well as on all the internal attacks,
is not recorded at this time. Based on the automotive industrial sector,
Mexico is located... Mexico are located American companies, as well as European and Japanese
companies, which are located on the supplier chain. The European most use the industrial
cybersecurity architecture, according with the ISO and the improved and performance basis 4.0.
The merits of the concept are the data in real-time and non-real-time, the integration
and sharing data and connectivity. For the American enterprises, they follow the American
industry internal reference architecture, call it IIRA. They use it as a key merit,
real-time, non-real-time integration, shared data and connectivity, but as well,
they use the protocols, those protocols like a profit boost, mod boost, scan internet,
profit net, and the programs like a ladder and other devices with different kind of protocols,
which is one of the important things to use for industrial architecture cybersecurity.
According with our experience, during the last couple of years, we implemented for the industrial
sector and the architecture different kind of layers. One of the layers is the sensor integrity
that we will see in the next slides, the equipment, the boost data, and the network.
The word industrial is in terms of the smart factory at this time, using industry 1.0 concept.
They said the connectivity between machines and PLCs and other intelligent sensors, as well
other equipment. So the smart factory has integrated all the elements in the shop floor,
integrated in one unit. To accomplish and fulfill this strategy, we said that a smart
production concept. This smart production concept is accomplished to fulfill the strategy
that we set for the smart production. The smart production is set in individual modules, which
are interconnected to the smart factory. This architecture integrates components from machines,
sensors, PLC, network, servers, database, machine learning, machine-to-machine analytics,
visualization, and artificial intelligence, among other technology and innovations.
For a clean implementation, it was a set additional smart sensors to boost the power
and the brains at the shop floor to implement the full smart production. That is the new trend.
On the next slide, we will talk about the smart sensor cybersecurity. One important note on this
activity that I want to share with you as experience is the synchronization and speed
process key factor for industrial cybersecurity. It means low timing on industrial process is not
a problem as we can use and save the cybersecurity procedures. High speed industrial process, which
required up and down information to act, for example, above or open a sector or review
a model, less than 500 milliseconds make a major complexity to implement the smart factory
with industrial cybersecurity. Also, the lesser lens about the synchronization topic give it two
strategies recommendation in according with our experience. One refers to set the PLC
responsibility as it was designed at the long time means that the devices was to control dedicated
process and machines, only that. We not recommended that the PLC is doing extended activities. That
means doing everything. So everybody can say that a PLC and share and tell you that a PLC make
everything. This is not true. This is a dangerous equation. The second one is to reduce or eliminate
PLC connectivity into industrial pools network. That means that the PLC has to do his own job.
One is concerned, of course, if we put it the PLC on the network is to reduce the potential
vulnerability. And the second one is to reduce the issue on the synchronization on the process
and the boost network. One of the topics to confirm that we have experienced that is difficult to set
a service security, industrial service security. For the smart sensors and service security
strategy that we set as six, which means the S is a sensor, the I is integrity, the C is for
connectivity and the S for security. This concept that we are implemented, we use it, we divide it
in three blocks. One is related to the sensor integrity, the sensor connectivity and the sensor
cybersecurity as mentioned. The sensor integrity includes physical and functionality layers.
The physical take the sense of damage, which is common sometimes that people can damage during
the process at the shop floor or could be not intentional to damage the sensor. So the
cybersecurity protection tell us that the damage is made on the sensor and then we have to be
replaced or make an action immediately. So the cycle life of the sensor is important because
the cycle of the sensor, when the sensor is used by a resistance to review and sense the
level of the water, that can be changed immediately when we see that the response
of the information is not quite right. So we're using this information and review as a status
control loop to be that the cycle life of the center is okay. Actually as well, in terms of
functionality, the views of the sensor as well, the software, the program, there are many key
important things. The software and the program, they can be used or that it can be as well adopted
in terms of the somebody can have and connect it with our C235 or another boost communication,
they can make it and change the software in the program. We as well, we set on this strategy,
you know, the actions and the roadblocks and the firewall that nobody can change the software
and the program. In terms of the sensor connectivity, everybody knows. ProfiBoost,
MotherBoost, so this topic I will not to be in detail. And the subject of sensor cybersecurity,
the status control gives us the opportunity to review that the physical and functionality,
the sensor is okay. I show self-detection and self-assessment is provide as well that the
system as well the protocols of the software program and communication are okay. We put an
outside on this process, the cartography code, because according with the mentioned in the last
slides, the synchronization on the latency of the process in terms of the high performance processes
is not quite okay. We set as well an additional alert console. That means that this process,
the alert console process, we set a different boost communication. It's not in the same protocol
that we send it as the information data send it to the system. We send it in another channel
and as well another kind of information which tell us exactly if the sensor integrity,
physical and functionality is adopted. In terms of the essential of the sensor cybersecurity,
it show in really two blocks, one and three blocks. One is outside of the system,
which is a data interface. The other ones are connected. The detection search,
which is called it on the left block now, we call it a dummy because this is essential,
just one thermal part or just a resistance that they move according to the level of the water.
We call it a dummy sensor. It is dummy sensor connected via an I2C protocol.
This protocol has four modes. The standard mode is usually with a speed of 0.1 megabits per second.
The information is digitalized and then used to perform on the program with a specific language.
The program with this has an algorithm and make the action and perform the activities
that which it was programming. One of them is to send the information via a standard protocol to
outside of the world, which means that to send the information to the PLC or the motherboards
or another kind of communication to the data interface, which is important because the
different kind of net protocols, it was difficult to make a cybersecurity performance. That means
experience that we have is that synchronization is a very key factor. One topic is in defense of
the I2C protocol. Sensing information in some processes is a critical element, especially
with a high performance process. Process with production and security information can be lost
information only because the process of the boost communication synchronization is not aligned with
the process synchronization. And the PLC, if it has a timer and a timing delay,
if it's possible to miss key information of the process. That means on the case that latency
less than 500 milliseconds and use an attractive code on this communication can be put in a
dangerous situation the entire system. So we solve this issue using new security paths in
the entire architecture. This is clear that integrated crypto code, as we know from the
sensor to outside to the boost node, is not feasible, according to our experience today,
based on the total boost and the process synchronization. Both things are important
and important to do the cybersecurity, industrial cybersecurity activities.
The opportunities that we have in I2C cybersecurity is in terms of the monitoring.
Monitoring the sensor integrity as we saw, the equipment safely, and the boost security
as main architectural visibility and center management. Defense detections in terms of the
boost protocol and the peripheral devices evaluation, the threat detection as a sensor
equipment, the malicious code as well, the prevention as the incident response and services,
and as well the equipment risk assessment, which means to review the peripheral devices,
the service equipment, and the network devices.
During this process, in terms of the I2C industrial cybersecurity opportunities,
we set a deception exercise. We set a honeypot, lesser lengths, and the training that my friend
and colleague of this entire venture, with Alfonso as well, we will see in the next presentation from
Victor. Well guys, thank you for your time. I'm glad to be here. And well, as you know,
there are many experiments at previous publications about honeypots. We apply it for
this work on two areas that could be joining it in a small footprint. I mean, a small footprint
to detect internal events and incidents. Well, the first one is the training to learn core
concepts from previous incidents and learn beyond buzzwords and clickbait cybersecurity
because we think that this could be overwhelming for many of us. The second one is to be productive.
I mean, to get productive data that allow us to have enough evidence to resolve an incident.
To implement this, there are previous conditions, previous steps that are important to be known
by the network owners, like a correct networking solution, a legal review,
and patents to see results focused on ICS systems versus general malware.
And the honeypots as idea and philosophy is very attractive because it's a good way to see
an attack in real time. And well, you can learn from it and also helps to replicate previous
attacks. In some moments, cybersecurity could be overwhelming for some people. There are too
much to learn. But based on previous attacks that we saw, there are core concepts that could be
studied. These concepts are covered by the major corporation matrices. And this gave us a
structured way to do it. And the second one is, well, how to handle incidents. This could be
learned too. And also the ICS architecture concepts are important to give a general fact.
And finally, the idea of this experiment or honeypot is that could be installed by power
users and not only by cybersecurity people. And learning through analyzing attacks, well,
obviously, is the first option, but there is another game. A honeypot could give productive
data in a traceable way. There are three main sources to start. The first one, the Windows host
from the multiple layers of the ICS and enterprise network. The second one, the network
in the different layers too. And finally, the emulation of the services. And well, all of this
in the internal network. The first component in our architecture is the Windows host
that are being used in different layers. We looked for simple components and tricks
that could give us important data about malware. And well, with this setup, we got multiple samples.
For example, with the file system trick, we got multiple samples. And also from the network
traffic, we observed that the most popular wormhole ports are being used too. And now,
regarding lateral movement and ransomware cases, we saw that the biggest and easiest
exploits are being used as first option. And from the network side, another component in the
architecture, our idea is to keep all the metadata possible as first priority. And the raw data
from the multiple sites as second objective. This could be achieved using Seq and Moloch,
these open source tools. But to implement these tools, the Malcom project helped us a lot to make
a quick setup in a productive environment. With this setup, we were able to investigate
multiple network movements from the multiple layers of the network,
and also to detect dual home PCs. About the DMZ, as I mentioned in the first slides,
our idea is to make an investigation in the internal network. However, as you know, the DMZ
setup was analyzed multiple times in previous investigations. And as you know, the detection
is very noisy, and also it's a high risk. So for that reason, we focus on internal networks.
But some setups were exposed in a short time using Mexican IPs. And there are two important
details that were to be mentioned. The first one is the timing of the attack. There is a correlation
between the exposition of the IP on a network-passing SENSIC service versus non-indexed
IPs. And finally, there is a gain if multiple protocols are being used instead of only one.
And, well, finally, to mimic services, a simple setup was performed on these four sides.
The first one is a network emulation. With this, we found that there are many pieces of software
that allows you to emulate any port, to replicate any port, and copy
this kind of behavior. The second one is about the file servers on the shop floor. For this,
the use of honey files were the option. And for the web replication from the front-end
web admin consoles, we used social engineer toolkit and also HTTP track. And, well, finally,
the most important component is Compot. As you know, Compot is a very popular piece of software
to deploy honeypots. And we used this with some physical components. And to make a quick setup
for the power users, we used Teapot as a main platform. With this, the use of Teapot was the
fastest way to make an implementation by the power users. And, well, that's it, guys. Thank
you for your time. As a remark, we saw these points. The USMCA trade is an opportunity to
improve the cybersecurity. The second one, well, Mexico is an undiscovered market for the ICS
cybersecurity. As Octavio mentioned, there are good numbers that prove this. Also, there's an
opportunity to train people in this topic. In all the industrial networks, we found that there are
a lot of talented people that could learn in a very fast way. And there is a passion about this.
The honeypot technology and the use of the ATTCQ metrics for ICS as part of the formal
training and detection is a good trick too. And finally, the speed of the network is not
a speed of the process talking about cybersecurity. And, well, thank you for your time.
If you have questions, please drop us a line. We will be on the ICS Village Discord channel.
Thank you for your time. Have a good day. Thank you.