WEBVTT 00:07.010 --> 00:14.060 Hi everyone, we are AboDefense and we will make a presentation about Mexico's cybersecurity status. 00:14.180 --> 00:26.900 In this presentation we will talk around industrial cybersecurity footprint, key data, perspective, smart production, and sensor security experience, honeypot, lesson learns, and opportunities. 00:26.900 --> 00:36.180 Thank you ICI Village DEF CON 28 and the cyber colleagues on this opportunity to make a presentation about Mexico's industrial cybersecurity. 00:37.800 --> 00:45.080 Talking about Mexico facts and figures, we have facts and figures in terms of the economy. 00:45.080 --> 00:48.420 Mexico is ranking under position 12 around the world. 00:48.640 --> 00:55.690 Manufacturing services, transportation, utilities, and spending are the main economical activities in Mexico. 00:56.140 --> 01:02.960 In concern of the industrial sector, the manufacturing has an activity of 175 billion U.S. 01:02.960 --> 01:04.040 dollars. 01:04.200 --> 01:08.860 Key subject focus on IC industrial security for this presentation. 01:09.680 --> 01:15.740 The top industrial sectors are in Mexico the automotive industry. 01:15.740 --> 01:21.040 It's the top five world with OEMs and their supply chain change. 01:21.040 --> 01:25.720 Medical is the second position in Latin America behind Brazil. 01:25.720 --> 01:32.340 Aeronautics 60 percent, more competitive, and electronics the largest economical region worldwide. 01:32.500 --> 01:45.320 Also Mexico have other industries like oil, electricity, food, textiles, agriculture, chemical services, consumers, and furniture, I mean other sectors. 01:45.540 --> 01:58.580 On the industrial sectors, more are important that the main manufacturing companies use 55 percent of insulated PLCs inside the IC area. 01:58.580 --> 02:01.920 Most are insulated and most not connected to any network. 02:01.920 --> 02:08.480 Three percent of use industrial service at the shop floor and connected to the network. 02:08.800 --> 02:17.900 Most of these industrial services are set by the automotive international companies like from Germany or Japan, among other ones. 02:18.120 --> 02:21.780 Most of the industrial companies are located from center to the north of Mexico. 02:21.780 --> 02:27.420 As an example, the automotive industry is located from the center and the north of Mexico. 02:27.540 --> 02:33.220 In the case of aerospace and medical industries are situated on the northwest of Mexico. 02:33.900 --> 02:40.620 On the network subjects, we will see that the strongest future is based more in the north of Mexico. 02:41.720 --> 02:45.130 Southern Mexico is more agriculture and other topics. 02:46.170 --> 03:01.050 Mexico has around 50.3 million IP addresses, an average of 7.5 megabits and the cyber attacks around 28 from 195 countries. 03:01.090 --> 03:14.930 So basically, the most important in the case of the cyber attacks is mainly attacks to the government offices and other departments like, you know, banks and services. 03:16.790 --> 03:24.430 In terms of the SWAT, the IC security, the strengths is that Mexico is growing in the industry from point zero. 03:24.610 --> 03:35.430 It's focused to the smart production, smart logistics, smart enterprises, among other ones, which require in a short period of time the implementation of the industrial cybersecurity practices. 03:35.770 --> 03:47.790 For the U.S.-Mexico-Canada trade, which was released the 1st of July 2020, covered the topic on digital and cyber security rules and process between the countries. 03:48.110 --> 04:04.410 It's a major important thing, because, especially for Mexico, because Mexico needs to follow up and implement the good practices and lessons necessary to accomplish the digital security and internet policies from this trade. 04:04.730 --> 04:10.330 In terms of the weakness, Mexico has no deep knowledge on ICS security topics. 04:10.330 --> 04:15.930 Also, the companies and the owners have no idea, even awareness, about industrial cybersecurity. 04:16.410 --> 04:20.310 For those insecure systems, there is insufficient information. 04:20.610 --> 04:22.350 There are opportunities as well. 04:22.350 --> 04:31.250 The U.S.-Mexico-Canada trade is focused to increase commercial competitiveness region against other markets, Asian markets or European markets. 04:31.250 --> 04:36.610 These trades include specific actions to meet cybersecurity terms, as the first one. 04:37.610 --> 04:51.570 Trade, according to our experience, the most attack to industrial is related to ransomware, especially on the R&P systems, as well as on all the internal attacks, is not recorded at this time. 04:51.930 --> 05:07.390 Based on the automotive industrial sector, Mexico is located... Mexico are located American companies, as well as European and Japanese companies, which are located on the supplier chain. 05:08.730 --> 05:21.430 The European most use the industrial cybersecurity architecture, according with the ISO and the improved and performance basis 4.0. 05:22.050 --> 05:28.290 The merits of the concept are the data in real-time and non-real-time, the integration and sharing data and connectivity. 05:28.470 --> 05:39.550 For the American enterprises, they follow the American industry internal reference architecture, call it IIRA. 05:41.530 --> 05:58.250 They use it as a key merit, real-time, non-real-time integration, shared data and connectivity, but as well, they use the protocols, those protocols like a profit boost, mod boost, scan internet, profit net, and the programs like a ladder and other devices with different kind of protocols, 05:58.250 --> 06:03.410 which is one of the important things to use for industrial architecture cybersecurity. 06:04.410 --> 06:14.590 According with our experience, during the last couple of years, we implemented for the industrial sector and the architecture different kind of layers. 06:14.590 --> 06:21.670 One of the layers is the sensor integrity that we will see in the next slides, the equipment, the boost data, and the network. 06:25.020 --> 06:33.720 The word industrial is in terms of the smart factory at this time, using industry 1.0 concept. 06:34.130 --> 06:43.050 They said the connectivity between machines and PLCs and other intelligent sensors, as well other equipment. 06:43.050 --> 06:50.410 So the smart factory has integrated all the elements in the shop floor, integrated in one unit. 06:51.290 --> 06:56.750 To accomplish and fulfill this strategy, we said that a smart production concept. 06:56.890 --> 07:04.690 This smart production concept is accomplished to fulfill the strategy that we set for the smart production. 07:05.450 --> 07:11.090 The smart production is set in individual modules, which are interconnected to the smart factory. 07:11.510 --> 07:25.290 This architecture integrates components from machines, sensors, PLC, network, servers, database, machine learning, machine-to-machine analytics, visualization, and artificial intelligence, among other technology and innovations. 07:25.670 --> 07:35.030 For a clean implementation, it was a set additional smart sensors to boost the power and the brains at the shop floor to implement the full smart production. 07:35.030 --> 07:36.710 That is the new trend. 07:37.170 --> 07:40.650 On the next slide, we will talk about the smart sensor cybersecurity. 07:40.930 --> 07:50.410 One important note on this activity that I want to share with you as experience is the synchronization and speed process key factor for industrial cybersecurity. 07:50.590 --> 07:59.410 It means low timing on industrial process is not a problem as we can use and save the cybersecurity procedures. 07:59.410 --> 08:17.810 High speed industrial process, which required up and down information to act, for example, above or open a sector or review a model, less than 500 milliseconds make a major complexity to implement the smart factory with industrial cybersecurity. 08:18.550 --> 08:25.750 Also, the lesser lens about the synchronization topic give it two strategies recommendation in according with our experience. 08:26.050 --> 08:38.090 One refers to set the PLC responsibility as it was designed at the long time means that the devices was to control dedicated process and machines, only that. 08:38.610 --> 08:42.110 We not recommended that the PLC is doing extended activities. 08:42.110 --> 08:43.970 That means doing everything. 08:43.970 --> 08:49.790 So everybody can say that a PLC and share and tell you that a PLC make everything. 08:49.790 --> 08:50.770 This is not true. 08:50.770 --> 08:52.550 This is a dangerous equation. 08:52.690 --> 08:59.050 The second one is to reduce or eliminate PLC connectivity into industrial pools network. 08:59.050 --> 09:03.510 That means that the PLC has to do his own job. 09:04.230 --> 09:10.690 One is concerned, of course, if we put it the PLC on the network is to reduce the potential vulnerability. 09:10.830 --> 09:16.750 And the second one is to reduce the issue on the synchronization on the process and the boost network. 09:16.750 --> 09:24.330 One of the topics to confirm that we have experienced that is difficult to set a service security, industrial service security. 09:28.030 --> 09:41.550 For the smart sensors and service security strategy that we set as six, which means the S is a sensor, the I is integrity, the C is for connectivity and the S for security. 09:41.690 --> 09:46.230 This concept that we are implemented, we use it, we divide it in three blocks. 09:46.790 --> 09:52.390 One is related to the sensor integrity, the sensor connectivity and the sensor cybersecurity as mentioned. 09:52.390 --> 09:57.330 The sensor integrity includes physical and functionality layers. 09:57.330 --> 10:09.390 The physical take the sense of damage, which is common sometimes that people can damage during the process at the shop floor or could be not intentional to damage the sensor. 10:09.390 --> 10:18.130 So the cybersecurity protection tell us that the damage is made on the sensor and then we have to be replaced or make an action immediately. 10:18.970 --> 10:36.530 So the cycle life of the sensor is important because the cycle of the sensor, when the sensor is used by a resistance to review and sense the level of the water, that can be changed immediately when we see that the response of the information is not quite right. 10:36.530 --> 10:44.350 So we're using this information and review as a status control loop to be that the cycle life of the center is okay. 10:44.810 --> 10:53.490 Actually as well, in terms of functionality, the views of the sensor as well, the software, the program, there are many key important things. 10:53.830 --> 11:09.170 The software and the program, they can be used or that it can be as well adopted in terms of the somebody can have and connect it with our C235 or another boost communication, they can make it and change the software in the program. 11:09.190 --> 11:20.030 We as well, we set on this strategy, you know, the actions and the roadblocks and the firewall that nobody can change the software and the program. 11:20.250 --> 11:23.930 In terms of the sensor connectivity, everybody knows. 11:24.030 --> 11:27.890 ProfiBoost, MotherBoost, so this topic I will not to be in detail. 11:28.290 --> 11:38.370 And the subject of sensor cybersecurity, the status control gives us the opportunity to review that the physical and functionality, the sensor is okay. 11:38.410 --> 11:47.630 I show self-detection and self-assessment is provide as well that the system as well the protocols of the software program and communication are okay. 11:47.650 --> 12:03.310 We put an outside on this process, the cartography code, because according with the mentioned in the last slides, the synchronization on the latency of the process in terms of the high performance processes is not quite okay. 12:04.070 --> 12:06.790 We set as well an additional alert console. 12:06.790 --> 12:12.810 That means that this process, the alert console process, we set a different boost communication. 12:12.810 --> 12:18.810 It's not in the same protocol that we send it as the information data send it to the system. 12:18.810 --> 12:30.610 We send it in another channel and as well another kind of information which tell us exactly if the sensor integrity, physical and functionality is adopted. 12:33.470 --> 12:44.550 In terms of the essential of the sensor cybersecurity, it show in really two blocks, one and three blocks. 12:44.550 --> 12:48.590 One is outside of the system, which is a data interface. 12:48.590 --> 12:50.770 The other ones are connected. 12:51.730 --> 13:05.110 The detection search, which is called it on the left block now, we call it a dummy because this is essential, just one thermal part or just a resistance that they move according to the level of the water. 13:05.110 --> 13:08.050 We call it a dummy sensor. 13:08.190 --> 13:12.810 It is dummy sensor connected via an I2C protocol. 13:12.810 --> 13:15.370 This protocol has four modes. 13:15.370 --> 13:20.730 The standard mode is usually with a speed of 0.1 megabits per second. 13:21.350 --> 13:27.010 The information is digitalized and then used to perform on the program with a specific language. 13:27.010 --> 13:33.670 The program with this has an algorithm and make the action and perform the activities that which it was programming. 13:34.050 --> 13:51.870 One of them is to send the information via a standard protocol to outside of the world, which means that to send the information to the PLC or the motherboards or another kind of communication to the data interface, which is important because the different kind of net protocols, 13:51.870 --> 13:55.690 it was difficult to make a cybersecurity performance. 13:55.870 --> 14:01.870 That means experience that we have is that synchronization is a very key factor. 14:02.190 --> 14:06.250 One topic is in defense of the I2C protocol. 14:06.370 --> 14:11.790 Sensing information in some processes is a critical element, especially with a high performance process. 14:11.790 --> 14:24.930 Process with production and security information can be lost information only because the process of the boost communication synchronization is not aligned with the process synchronization. 14:24.930 --> 14:33.250 And the PLC, if it has a timer and a timing delay, if it's possible to miss key information of the process. 14:33.470 --> 14:47.030 That means on the case that latency less than 500 milliseconds and use an attractive code on this communication can be put in a dangerous situation the entire system. 14:47.070 --> 14:51.630 So we solve this issue using new security paths in the entire architecture. 14:51.810 --> 15:02.870 This is clear that integrated crypto code, as we know from the sensor to outside to the boost node, is not feasible, according to our experience today, based on the total boost and the process synchronization. 15:02.910 --> 15:09.670 Both things are important and important to do the cybersecurity, industrial cybersecurity activities. 15:10.990 --> 15:16.610 The opportunities that we have in I2C cybersecurity is in terms of the monitoring. 15:16.610 --> 15:25.310 Monitoring the sensor integrity as we saw, the equipment safely, and the boost security as main architectural visibility and center management. 15:25.350 --> 15:39.850 Defense detections in terms of the boost protocol and the peripheral devices evaluation, the threat detection as a sensor equipment, the malicious code as well, the prevention as the incident response and services, and as well the equipment risk assessment, 15:39.850 --> 15:45.610 which means to review the peripheral devices, the service equipment, and the network devices. 15:46.910 --> 15:53.970 During this process, in terms of the I2C industrial cybersecurity opportunities, we set a deception exercise. 15:54.370 --> 16:07.950 We set a honeypot, lesser lengths, and the training that my friend and colleague of this entire venture, with Alfonso as well, we will see in the next presentation from Victor. 16:08.870 --> 16:12.130 Well guys, thank you for your time. 16:12.130 --> 16:13.770 I'm glad to be here. 16:13.770 --> 16:18.210 And well, as you know, there are many experiments at previous publications about honeypots. 16:18.430 --> 16:24.370 We apply it for this work on two areas that could be joining it in a small footprint. 16:24.370 --> 16:32.110 I mean, a small footprint to detect internal events and incidents. 16:32.590 --> 16:47.410 Well, the first one is the training to learn core concepts from previous incidents and learn beyond buzzwords and clickbait cybersecurity because we think that this could be overwhelming for many of us. 16:47.410 --> 16:50.050 The second one is to be productive. 16:50.050 --> 16:56.930 I mean, to get productive data that allow us to have enough evidence to resolve an incident. 16:58.610 --> 17:20.140 To implement this, there are previous conditions, previous steps that are important to be known by the network owners, like a correct networking solution, a legal review, and patents to see results focused on ICS systems versus general malware. 17:23.170 --> 17:35.870 And the honeypots as idea and philosophy is very attractive because it's a good way to see an attack in real time. 17:35.870 --> 17:41.350 And well, you can learn from it and also helps to replicate previous attacks. 17:41.850 --> 17:46.990 In some moments, cybersecurity could be overwhelming for some people. 17:46.990 --> 17:48.630 There are too much to learn. 17:48.630 --> 17:55.750 But based on previous attacks that we saw, there are core concepts that could be studied. 17:55.930 --> 18:00.450 These concepts are covered by the major corporation matrices. 18:00.770 --> 18:04.010 And this gave us a structured way to do it. 18:04.370 --> 18:07.190 And the second one is, well, how to handle incidents. 18:07.190 --> 18:08.910 This could be learned too. 18:08.930 --> 18:15.330 And also the ICS architecture concepts are important to give a general fact. 18:15.710 --> 18:28.170 And finally, the idea of this experiment or honeypot is that could be installed by power users and not only by cybersecurity people. 18:29.890 --> 18:37.030 And learning through analyzing attacks, well, obviously, is the first option, but there is another game. 18:37.530 --> 18:42.350 A honeypot could give productive data in a traceable way. 18:42.670 --> 18:45.210 There are three main sources to start. 18:45.210 --> 18:51.190 The first one, the Windows host from the multiple layers of the ICS and enterprise network. 18:51.190 --> 18:56.210 The second one, the network in the different layers too. 18:56.210 --> 18:59.790 And finally, the emulation of the services. 18:59.790 --> 19:04.690 And well, all of this in the internal network. 19:06.130 --> 19:13.590 The first component in our architecture is the Windows host that are being used in different layers. 19:13.590 --> 19:20.470 We looked for simple components and tricks that could give us important data about malware. 19:20.470 --> 19:24.930 And well, with this setup, we got multiple samples. 19:24.930 --> 19:31.390 For example, with the file system trick, we got multiple samples. 19:31.390 --> 19:44.650 And also from the network traffic, we observed that the most popular wormhole ports are being used too. 19:45.030 --> 19:56.190 And now, regarding lateral movement and ransomware cases, we saw that the biggest and easiest exploits are being used as first option. 19:57.630 --> 20:08.150 And from the network side, another component in the architecture, our idea is to keep all the metadata possible as first priority. 20:08.150 --> 20:13.130 And the raw data from the multiple sites as second objective. 20:13.130 --> 20:20.270 This could be achieved using Seq and Moloch, these open source tools. 20:20.270 --> 20:29.670 But to implement these tools, the Malcom project helped us a lot to make a quick setup in a productive environment. 20:30.010 --> 20:41.870 With this setup, we were able to investigate multiple network movements from the multiple layers of the network, and also to detect dual home PCs. 20:44.390 --> 20:59.170 About the DMZ, as I mentioned in the first slides, our idea is to make an investigation in the internal network. 20:59.790 --> 21:06.190 However, as you know, the DMZ setup was analyzed multiple times in previous investigations. 21:06.590 --> 21:10.570 And as you know, the detection is very noisy, and also it's a high risk. 21:10.570 --> 21:14.150 So for that reason, we focus on internal networks. 21:14.150 --> 21:21.510 But some setups were exposed in a short time using Mexican IPs. 21:21.510 --> 21:25.830 And there are two important details that were to be mentioned. 21:25.830 --> 21:29.090 The first one is the timing of the attack. 21:29.090 --> 21:40.030 There is a correlation between the exposition of the IP on a network-passing SENSIC service versus non-indexed IPs. 21:40.390 --> 21:48.930 And finally, there is a gain if multiple protocols are being used instead of only one. 21:49.890 --> 22:00.190 And, well, finally, to mimic services, a simple setup was performed on these four sides. 22:00.190 --> 22:02.650 The first one is a network emulation. 22:02.950 --> 22:19.670 With this, we found that there are many pieces of software that allows you to emulate any port, to replicate any port, and copy this kind of behavior. 22:19.690 --> 22:24.130 The second one is about the file servers on the shop floor. 22:24.130 --> 22:28.490 For this, the use of honey files were the option. 22:28.890 --> 22:42.230 And for the web replication from the front-end web admin consoles, we used social engineer toolkit and also HTTP track. 22:42.450 --> 22:46.290 And, well, finally, the most important component is Compot. 22:46.290 --> 22:51.590 As you know, Compot is a very popular piece of software to deploy honeypots. 22:51.830 --> 22:58.710 And we used this with some physical components. 22:58.870 --> 23:08.110 And to make a quick setup for the power users, we used Teapot as a main platform. 23:08.110 --> 23:15.870 With this, the use of Teapot was the fastest way to make an implementation by the power users. 23:19.740 --> 23:22.320 And, well, that's it, guys. 23:22.540 --> 23:24.280 Thank you for your time. 23:25.000 --> 23:28.700 As a remark, we saw these points. 23:28.740 --> 23:34.300 The USMCA trade is an opportunity to improve the cybersecurity. 23:34.880 --> 23:40.420 The second one, well, Mexico is an undiscovered market for the ICS cybersecurity. 23:40.540 --> 23:46.520 As Octavio mentioned, there are good numbers that prove this. 23:46.900 --> 23:54.080 Also, there's an opportunity to train people in this topic. 23:54.080 --> 24:07.780 In all the industrial networks, we found that there are a lot of talented people that could learn in a very fast way. 24:07.780 --> 24:11.420 And there is a passion about this. 24:12.240 --> 24:23.940 The honeypot technology and the use of the ATTCQ metrics for ICS as part of the formal training and detection is a good trick too. 24:23.960 --> 24:32.180 And finally, the speed of the network is not a speed of the process talking about cybersecurity. 24:33.300 --> 24:35.980 And, well, thank you for your time. 24:36.400 --> 24:40.800 If you have questions, please drop us a line. 24:40.800 --> 24:44.520 We will be on the ICS Village Discord channel. 24:44.520 --> 24:46.060 Thank you for your time. 24:46.460 --> 24:47.940 Have a good day. 24:47.940 --> 24:48.720 Thank you.