1 00:00:00,000 --> 00:00:03,160 2020 trying to kill this pandemic really hit. 2 00:00:03,160 --> 00:00:11,260 I went ahead and scanned the internet and took the top 10 countries with assets that say hello to the internet. 3 00:00:11,500 --> 00:00:13,760 And that's in the yellowish. 4 00:00:13,900 --> 00:00:18,440 I'm not sure how much you can see because of the big Defcon logo. 5 00:00:18,720 --> 00:00:36,600 And in the orangish bar, those are remote-only access protocols that I was looking for, and also certain versions, older versions of SSH, FTP, remote desktop protocol, etc. 6 00:00:36,700 --> 00:00:44,720 So what I found was, for instance, the United States has 47,500,000 assets. 7 00:00:44,720 --> 00:00:59,620 Out of those assets, when I was looking only for known exploitable remote access vulnerabilities, there were almost 12.5 million ones that I could find for the United States, which is not a great ratio. 8 00:00:59,620 --> 00:01:05,380 However, I will say that some of the assets that I scanned, they can have multiple vulnerabilities. 9 00:01:06,500 --> 00:01:08,700 Looking at between the U.S. 10 00:01:08,700 --> 00:01:21,900 and China, China has almost eight and a half million, but almost, assets on the internet that say hello, but almost five million of those are remotable with no exploits and vulnerabilities in them. 11 00:01:22,640 --> 00:01:40,520 The one country that did fairly well was actually the United Kingdom, with their ratio between assets and exploitable vulnerabilities, and one of the reasons for that was several years ago, they did something very fantastic. 12 00:01:40,520 --> 00:02:03,380 They instituted this thing, a cyber program for anyone doing business with the UK, and also critical infrastructure, had to really take a look at their stuff and go ahead and pass an audit, in most cases, a self-audit, depending on your level of access with the government and also critical infrastructure, 13 00:02:03,380 --> 00:02:12,700 and they were able to get a head start, and so they actually are doing fairly well in comparison to the rest of the top tenors. 14 00:02:13,720 --> 00:02:28,880 So another thing that we have to consider is because things are now industrial IoT devices, or IoT devices, this means that you can have a control system that is IoT enabled. 15 00:02:28,880 --> 00:02:34,560 Now, in this case, I like to take a look at Tesla stuff, because I just do. 16 00:02:34,560 --> 00:02:45,120 And you can actually use census.io, what I call census.org, to find various Tesla power walls. 17 00:02:45,420 --> 00:03:01,540 And what's interesting about this is, even though Tesla has some security, it's still single-factor authentication, there's still a web interface, the customer doesn't necessarily have to set up any real security, so there's admin-admin kind of stuff, 18 00:03:01,540 --> 00:03:05,080 depending on the version of the software. 19 00:03:05,160 --> 00:03:15,280 Tesla does not force down updates like Windows 10, or their cars, so there are a lot of old versions. 20 00:03:15,280 --> 00:03:29,900 And what you can actually pull back is the configuration of the power walls, the versions, timestamps, showing the last login, how long it's been up, if it's updating or not, and a bevy of other diagnostic information. 21 00:03:30,200 --> 00:03:42,540 And what's unfortunate is, if you're able to get into some of these systems, which you can, you can do more nefarious things. 22 00:03:42,560 --> 00:03:50,360 Like, imagine a region of power walls that suddenly all of their electricity got dumped on the energy grid. 23 00:03:50,360 --> 00:03:52,340 That would be a very bad thing. 24 00:03:52,340 --> 00:04:00,600 Or if it was connected to some sort of crucial hardware, that would be a bad thing. 25 00:04:00,600 --> 00:04:05,200 And in this particular case, this one was connected to a crane. 26 00:04:05,200 --> 00:04:07,620 Who doesn't want to own their own crane? 27 00:04:07,620 --> 00:04:09,260 Well, you can too. 28 00:04:09,820 --> 00:04:22,720 So, you have to understand that if it's running a web server, I don't care if it's, I don't know, power bank, or a piece of industrial equipment, or whatever, you can hack it like a web server. 29 00:04:22,720 --> 00:04:23,920 Remember that. 30 00:04:24,680 --> 00:04:27,780 So, I do a lot in aviation. 31 00:04:28,180 --> 00:04:32,720 Sometimes that's good, sometimes they hate me. 32 00:04:33,740 --> 00:04:36,320 So, either way, you know. 33 00:04:36,740 --> 00:04:45,660 So, there are various ways to get into various things, and one of the dangers that we have is a lot of remote desktop protocol. 34 00:04:45,660 --> 00:04:56,280 You can actually buy exploited systems on the scary dark web from a dollar to ten dollars a piece. 35 00:04:56,280 --> 00:05:02,240 If they have RDP, ten dollars is for typically US military assets that are found. 36 00:05:02,240 --> 00:05:10,020 In this case, this one belongs to Airbus, where luckily the admin happens to be logged in. 37 00:05:10,020 --> 00:05:12,880 I wonder what the password might be. 38 00:05:13,100 --> 00:05:19,940 The CN is actually the certificate, which I could match up to absolutely belonging to Airbus. 39 00:05:20,240 --> 00:05:28,900 Another fun fact is depending on the aircraft, some Airbus aircraft actually use Windows CE in their aircraft. 40 00:05:28,900 --> 00:05:29,640 Yay! 41 00:05:31,460 --> 00:05:41,480 So, I'm not sure you may or may not have heard much about Boeing, other than some of their planes like to fall from the sky because they have software issues. 42 00:05:41,700 --> 00:05:55,920 And starting last year, one of the things I did, and by the way, hi, Boeing, I know you still want to put me in jail, was that I took a look around some of their infrastructure and found that it was incredibly bad. 43 00:05:56,380 --> 00:06:04,960 For instance, at the time, Boeing.com and its websites didn't even use HTTPS or any encryption for their websites. 44 00:06:04,960 --> 00:06:07,060 And this included login systems. 45 00:06:07,060 --> 00:06:08,000 Yay! 46 00:06:08,660 --> 00:06:27,440 I was able to get into the R&D section of their flight control software, which also included the 737 MAX aircraft, because to authenticate, I was using Firefox with no script running, and the website had a message, you are not running scripts. 47 00:06:27,440 --> 00:06:29,360 Please press this button. 48 00:06:29,360 --> 00:06:30,460 Press the button. 49 00:06:30,460 --> 00:06:31,620 I was in. 50 00:06:31,620 --> 00:06:33,580 How awesome is that? 51 00:06:33,660 --> 00:06:43,120 There were six cross-site scripting vulnerabilities in the live in production flight control aviation ID system. 52 00:06:43,120 --> 00:06:43,760 Woo-hoo! 53 00:06:43,760 --> 00:06:44,700 Right? 54 00:06:44,740 --> 00:07:04,120 And the interesting thing about this is, if you can get into the flight control system or software, and you know what you are doing, the process is, the technician will download what's needed for their aircraft, put it on a maintenance laptop, that maintenance laptop plugs into the aircraft itself, 55 00:07:04,120 --> 00:07:06,440 into the flight control system. 56 00:07:06,440 --> 00:07:17,000 So imagine some of the mayhem that you could do, because Boeing had zero effort and zero knowledge in security. 57 00:07:17,000 --> 00:07:24,860 Funny enough, they do sell cyber security services as consultants to the U.S. 58 00:07:24,860 --> 00:07:25,760 government. 59 00:07:25,760 --> 00:07:30,340 However, I guess they never ate their own dog food and looked at their own stuff. 60 00:07:30,340 --> 00:07:36,920 There were even hard-coded credentials in an older version of SAML that you could easily decode. 61 00:07:36,920 --> 00:07:44,920 The response from Boeing was, you're a criminal, harassment, no bug bounty. 62 00:07:45,640 --> 00:08:02,100 And it was only after my 59-page report went through and it got media attention after a disclosure period that they were forced to start their first vulnerability disclosure program, which they said it was based on my report. 63 00:08:02,100 --> 00:08:08,840 However, as far as I'm aware, Boeing still gives zero bug bounty awards. 64 00:08:10,020 --> 00:08:14,360 So agriculture is nice, because I think all of us like to eat. 65 00:08:14,360 --> 00:08:28,740 And this is an instance where it's a control system that is now an industrial IoT system that is hanging on the internet, that has a web server that has never been security tested, with no authentication. 66 00:08:28,840 --> 00:08:36,520 And it happens to be a European fish farm, a salmon farm to be exact. 67 00:08:36,520 --> 00:08:43,760 And you can actually, in real life, press the buttons and you can modify the operations of this. 68 00:08:44,940 --> 00:08:47,700 So we like water. 69 00:08:47,700 --> 00:08:58,000 Mexichem is actually a major bottled water provider, manufacturer, amongst other things, in Latin America, in South Africa. 70 00:08:58,000 --> 00:09:00,460 They do a lot of stuff. 71 00:09:00,560 --> 00:09:29,100 So I was looking around, because I get curious and bored, and I was very quickly able to find, because they allowed LDAP to be exposed to the internet, I found 24 pages of assets from the IT side on the business level, all the way down to on the control level for their Windows-based SCADA systems. 72 00:09:29,100 --> 00:09:46,820 And this was rather unfortunate, because some of the systems that I was able to find was this wonderful, what's called HMI, Human Machine Interface, the same exact version that was vulnerable to some of the black energy attacks. 73 00:09:47,160 --> 00:09:51,660 And you didn't actually have to log in, because it was never set up correctly. 74 00:09:51,800 --> 00:10:12,240 I could access the drives that it was attached to, I could import and delete recipes, which is actually the production recipe of what the machinery will be doing, and I could just click as many buttons as I wanted to. 75 00:10:12,240 --> 00:10:23,460 I could even export the administration data, all at the touch of my fingertips, from my comfortable, small Amsterdam house. 76 00:10:24,220 --> 00:10:37,700 And MexiChem also produces various different types of chemicals, some of which are more controlled, so that they don't fall in the hands of really bad people who want to make things go boom. 77 00:10:39,120 --> 00:10:48,300 So another thing to consider is, we're talking about IoT systems, they can be anywhere. 78 00:10:48,760 --> 00:11:06,420 They could be inside a hospital, they could be on sensitive networks, they could be at nuclear physics labs in Russia, and they could also be inside control systems, so that you can actually, you know, use a printer. 79 00:11:06,620 --> 00:11:24,420 And so I was able to have a bit of fun, again, being bored, don't ever let me get bored, and use census and a few other scanning tools to quickly find as many particular printers as possible. 80 00:11:25,080 --> 00:11:38,800 It stemmed from the fact I was having a problem with my printer, and I downloaded the Brother admin tool, which covers almost all of their models, and I noticed that it had never been security tested. 81 00:11:38,800 --> 00:11:46,420 So I went ahead and flipped it around and turned it into a weaponized piece of admin tool. 82 00:11:46,660 --> 00:11:53,660 And a lot of these printers will have web interfaces. 83 00:11:53,700 --> 00:12:00,380 So I had a lot of fun with cross-site scripting, but most of my fun came from using the admin tool. 84 00:12:00,380 --> 00:12:15,140 See, once you find one of these printers, it's not that difficult to find, you can use the free Brother admin tool, go ahead and put in the IP address, and then connect to somebody else's printer anywhere in the world. 85 00:12:15,140 --> 00:12:27,280 You can see how much ink they have, you can even order, if it's set up in their printer, ink and toner supplies, because, hey, toner's worth more than platinum. 86 00:12:28,160 --> 00:12:33,920 And you can also send files directly to the printer. 87 00:12:34,600 --> 00:12:57,700 So I had a lot of fun with this, but unfortunately, Brother, like most printer manufacturers, do not have a vulnerability disclosure program, nor did they ever think that you could use this lovely free tool available now to download, and you can weaponize it and really make printers' lives uncomfortable. 88 00:12:58,080 --> 00:13:21,820 Bonus item, if it's a multifunctional printer that's more of the commercial variety that has a hard drive installed, and, say, Human Resources uses it as a scanner for different types of identification systems, you can even access the hard drive where it saves those scans and get all sorts of personally identifiable information and health data just by using this tool. 89 00:13:22,340 --> 00:13:37,520 So I like space, and one of the things that is a bit problematic is, just like regular industrial systems, once you put something in space, it's expected to last a while. 90 00:13:37,520 --> 00:13:45,980 There's even a space satellite that is in a very interesting orbit that is up there for over 50 years. 91 00:13:45,980 --> 00:13:48,420 There's a lot of legacy stuff. 92 00:13:48,740 --> 00:13:52,360 Once you put something up there, it's not like you can go, hey, guess what? 93 00:13:52,360 --> 00:13:54,200 We've got this new type of encryption. 94 00:13:54,340 --> 00:13:54,820 You know what? 95 00:13:54,820 --> 00:13:57,160 It needs a chip to be able to process it. 96 00:13:57,160 --> 00:14:01,020 We're just going to replace that chip in the satellite. 97 00:14:01,020 --> 00:14:02,500 That doesn't happen. 98 00:14:03,540 --> 00:14:27,940 And what we did last year was, in the United Kingdom, thanks to Oxford who funded it and De Montfort University, we held the first space hackathon at Royal Holloway University to discuss these things with cleared PhD students who were given a lot of information by myself and others on some of the problems with current and new space assets, 99 00:14:27,940 --> 00:14:37,120 because they're really industrial IoT devices, and how to combat some of those problems, because encryption might not be there. 100 00:14:37,120 --> 00:14:45,900 I believe it was only the year before last that the FTC mandated that new space asset actually had to have the ability to use encryption. 101 00:14:45,900 --> 00:15:02,020 And we've seen some satellite systems being used in various cyber crime attacks and malware, because if you can put one of your hops and traceability on a satellite, it kind of makes it a bit hard to see who's actually behind different things. 102 00:15:02,020 --> 00:15:04,740 So a lot of cool stuff came out of this hackathon. 103 00:15:04,740 --> 00:15:08,400 PhD students were absolutely fantastic and energetic. 104 00:15:08,520 --> 00:15:21,440 They listed a lot of very pertinent risks that we had to consider, such as the current UN space treaties do not cover private companies when it comes to warfare. 105 00:15:21,760 --> 00:15:24,860 It only covers nation states. 106 00:15:24,860 --> 00:15:50,200 And the fact that some major players in the market, if you want to watch a great older movie, I believe it's called Moonraker, it's a James Bond movie, where a really rich guy with way too much money decides to go into space and then try to take over the world by going to war in space as a private company. 107 00:15:50,380 --> 00:16:05,340 And so some of the risks listed were, for example, Elon Musk and his program, because anyone can turn evil, and he already thinks that the pyramids were created by aliens. 108 00:16:06,160 --> 00:16:11,540 So to give a brief example, you can actually find some of these systems. 109 00:16:11,540 --> 00:16:16,920 Now, there's different ways that you can find various space IoT systems. 110 00:16:16,920 --> 00:16:25,620 A lot of them you'll find are actually land systems, so then communicate up, but those land systems, they can actually unfortunately be hacked. 111 00:16:25,620 --> 00:16:38,520 In this particular case, I was able to find a relay connection up to a satellite, and I didn't want to give away too much information because they have not gotten back to me. 112 00:16:38,580 --> 00:16:44,920 I was able to find this particular device was running my favorite protocol Modbus with no authentication. 113 00:16:45,080 --> 00:16:49,420 It could give the device ID, function codes, and all sorts of information about it. 114 00:16:49,420 --> 00:16:59,780 And by looking into various user manuals that are freely available, I was able to find that it was called a sunny string monitor that was attached to the satellite. 115 00:16:59,920 --> 00:17:15,480 And what it does is it looks for sun and goes ahead and opens a solar array on a satellite system to give a power or closes it down when there's nothing available, or can move it around a little bit. 116 00:17:15,480 --> 00:17:17,720 So imagine what you could do with that. 117 00:17:18,660 --> 00:17:21,900 So why is this kind of important? 118 00:17:21,980 --> 00:17:33,600 Last month, the United Nations Institute for Disarmament Research asked me to give a presentation, a closed dialogue session, to permanent member states with other member states as observers. 119 00:17:33,740 --> 00:17:39,580 And I brought up the fact that we need to be a lot more proactive. 120 00:17:40,100 --> 00:17:59,960 And although the United Nations in 2015 established that member states are responsible for securing their ICT cyberspace, that also includes space assets, that also includes industrial systems, etc., they agreed to establish a computer emergency response team. 121 00:17:59,960 --> 00:18:01,520 And that's well and good. 122 00:18:01,520 --> 00:18:02,340 It's fantastic. 123 00:18:02,340 --> 00:18:03,340 It's much needed. 124 00:18:03,340 --> 00:18:08,300 But that also is very, very reactive and constantly you're putting out fires. 125 00:18:08,340 --> 00:18:11,420 So it's very difficult for you to be proactive. 126 00:18:11,420 --> 00:18:24,560 So I brought up with them that I'm currently working with part of the European Union to actually establish their first proactive computer emergency protection team, a CEPT. 127 00:18:24,560 --> 00:18:36,500 And CERT step one, CEPT step two, to try to alleviate some of the burden and also try to catch things as quickly as possible before they become major incidents. 128 00:18:36,880 --> 00:18:49,500 Now, back in 2009, this is also another reason why it's kind of important is I detected a cyber warfare attack, the second wave of such attacks caused by malware that the North Koreans created. 129 00:18:49,500 --> 00:19:05,220 One of the things they did was they leveraged higher speed bandwidth in Northern Europe to go ahead and have those various devices aim at the South Korean infrastructure and also part of the infrastructure of the United States. 130 00:19:05,220 --> 00:19:09,460 So they attacked the South Korean version of the White House and also the U.S. 131 00:19:09,460 --> 00:19:10,820 version of the White House. 132 00:19:10,820 --> 00:19:18,000 They tried to affect the New York Stock Exchange and a lot of other very important places. 133 00:19:18,140 --> 00:19:38,160 And because we were also monitoring in my shop ICS systems that had internet connectivity, we found that some of the Windows-based stuff actually was also affected and was trying to take down part of South Korea and the U.S. 134 00:19:38,160 --> 00:19:46,460 So you can actually, unfortunately, weaponize with various types of malware, IT, IoT, and ICS as we keep seeing. 135 00:19:46,460 --> 00:19:52,100 But even in 2009, 11 years ago, we were seeing this type of stuff. 136 00:19:52,100 --> 00:20:17,260 So we need to take it much more seriously with the vendors as well as the critical infrastructure operators and get the tech community involved because academia is great, government experts are fantastic, but it's us and you watching this that have that hacker mentality and can actually express it and find ways in and out that others can't. 137 00:20:17,580 --> 00:20:23,240 So with that, I will be available on Discord for questions. 138 00:20:23,400 --> 00:20:26,020 Hopefully I get the right Discord channel. 139 00:20:26,020 --> 00:20:33,340 I wanted to give a huge shout out to Omar at Santo Omar and the Red Team Village for inviting me. 140 00:20:33,760 --> 00:20:43,260 If you also would like to contact me about things that are going on in the Middle East, I believe my contact information is now on the Middle East Institute's website. 141 00:20:43,600 --> 00:20:51,320 And feel free to contact me on Twitter and I take DMs, just no weird pictures, no weird sexy type pictures. 142 00:20:51,320 --> 00:20:52,380 Let me stress that. 143 00:20:52,380 --> 00:20:53,940 I love pictures of cats. 144 00:20:53,940 --> 00:20:56,820 So thank you very, very much, Red Team Village. 145 00:20:56,820 --> 00:20:58,700 It is greatly appreciated. 146 00:20:59,580 --> 00:21:03,220 Thank you so much for supporting us and for the great presentation. 147 00:21:03,220 --> 00:21:05,640 You are getting a lot of kudos in Discord. 148 00:21:05,640 --> 00:21:10,680 So talking about Discord, if you're joining us, you know, you can see the link in the bottom of the screen. 149 00:21:10,680 --> 00:21:21,760 There's a link to a website where, you know, has a lot of other information about the speakers, along with, you know, all the activities that are happening in, of course, in DEF CON. 150 00:21:21,980 --> 00:21:29,960 So with that said, we're going to go on a break for a few minutes, and then the next presentation will be up in probably about 15 to 20 minutes. 151 00:21:30,000 --> 00:21:31,420 So thank you again, Chris. 152 00:21:31,420 --> 00:21:32,780 Great presentation. 153 00:21:32,940 --> 00:21:33,980 Have a nice one. 154 00:21:33,980 --> 00:21:35,020 All right, cheers.