start	end	text
0	6180	2020 trying to kill this pandemic really hit. I went ahead and scanned the internet and took the
6180	13760	top 10 countries with assets that say hello to the internet. And that's in the yellowish.
13900	22000	I'm not sure how much you can see because of the big Defcon logo. And in the orangish bar,
22000	29080	those are remote-only access protocols that I was looking for, and also certain versions,
29080	38580	older versions of SSH, FTP, remote desktop protocol, etc. So what I found was, for instance,
38580	47660	the United States has 47,500,000 assets. Out of those assets, when I was looking only for
47660	55900	known exploitable remote access vulnerabilities, there were almost 12.5 million ones that I could
55900	62180	find for the United States, which is not a great ratio. However, I will say that some of the assets
62180	69660	that I scanned, they can have multiple vulnerabilities. Looking at between the U.S. and China,
69660	75060	China has almost eight and a half million, but almost, assets on the internet that say hello,
75060	81900	but almost five million of those are remotable with no exploits and vulnerabilities in them.
82640	90280	The one country that did fairly well was actually the United Kingdom, with their ratio between
90280	96960	assets and exploitable vulnerabilities, and one of the reasons for that was several years ago,
96960	103700	they did something very fantastic. They instituted this thing,
105240	110340	a cyber program for anyone doing business with the UK, and also critical infrastructure,
110340	118500	had to really take a look at their stuff and go ahead and pass an audit, in most cases,
118560	123380	a self-audit, depending on your level of access with the government and also critical infrastructure,
123380	129760	and they were able to get a head start, and so they actually are doing fairly well in comparison
129760	137120	to the rest of the top tenors. So another thing that we have to consider is because
137120	144700	things are now industrial IoT devices, or IoT devices, this means that you can have a control
144700	152960	system that is IoT enabled. Now, in this case, I like to take a look at Tesla stuff, because
152960	162760	I just do. And you can actually use census.io, what I call census.org, to find various Tesla
162760	169960	power walls. And what's interesting about this is, even though Tesla has some security,
169960	176020	it's still single-factor authentication, there's still a web interface, the customer doesn't
176020	182380	necessarily have to set up any real security, so there's admin-admin kind of stuff, depending on
182380	192500	the version of the software. Tesla does not force down updates like Windows 10, or their cars,
192760	199440	so there are a lot of old versions. And what you can actually pull back is the configuration of
199440	205220	the power walls, the versions, timestamps, showing the last login, how long it's been up,
205220	211820	if it's updating or not, and a bevy of other diagnostic information. And what's unfortunate
211820	221440	is, if you're able to get into some of these systems, which you can, you can do more nefarious
221440	228160	things. Like, imagine a region of power walls that suddenly all of their electricity got dumped
228160	236060	on the energy grid. That would be a very bad thing. Or if it was connected to some sort of crucial
236720	242440	hardware, that would be a bad thing. And in this particular case, this one
242440	249260	was connected to a crane. Who doesn't want to own their own crane? Well, you can too.
249820	257020	So, you have to understand that if it's running a web server, I don't care if it's, I don't know,
257020	262720	power bank, or a piece of industrial equipment, or whatever, you can hack it like a web server.
262720	272720	Remember that. So, I do a lot in aviation. Sometimes that's good, sometimes they hate me.
273740	281500	So, either way, you know. So, there are various ways to get into various things, and one of the
281500	288920	dangers that we have is a lot of remote desktop protocol. You can actually buy exploited systems
288920	299160	on the scary dark web from a dollar to ten dollars a piece. If they have RDP, ten dollars is for
299160	305600	typically US military assets that are found. In this case, this one belongs to Airbus,
305600	312880	where luckily the admin happens to be logged in. I wonder what the password might be.
313100	319940	The CN is actually the certificate, which I could match up to absolutely belonging to Airbus.
320240	327200	Another fun fact is depending on the aircraft, some Airbus aircraft actually use Windows CE
327700	336540	in their aircraft. Yay! So, I'm not sure you may or may not have heard much about Boeing,
336540	341480	other than some of their planes like to fall from the sky because they have software issues.
341700	346940	And starting last year, one of the things I did, and by the way, hi, Boeing, I know you still want
346940	353400	to put me in jail, was that I took a look around some of their infrastructure and found that it was
353400	361460	incredibly bad. For instance, at the time, Boeing.com and its websites didn't even use
361460	368000	HTTPS or any encryption for their websites. And this included login systems. Yay!
368660	374660	I was able to get into the R&D section of their flight control software, which also included the
374660	383220	737 MAX aircraft, because to authenticate, I was using Firefox with no script running,
383220	389360	and the website had a message, you are not running scripts. Please press this button.
389360	397300	Press the button. I was in. How awesome is that? There were six cross-site scripting vulnerabilities
397300	404700	in the live in production flight control aviation ID system. Woo-hoo! Right?
404740	408960	And the interesting thing about this is, if you can get into the flight control system
408960	417100	or software, and you know what you are doing, the process is, the technician will download
417100	421540	what's needed for their aircraft, put it on a maintenance laptop, that maintenance laptop
421540	427900	plugs into the aircraft itself, into the flight control system. So imagine some of the mayhem
427900	438000	that you could do, because Boeing had zero effort and zero knowledge in security. Funny enough,
438000	446540	they do sell cyber security services as consultants to the U.S. government. However,
446540	450340	I guess they never ate their own dog food and looked at their own stuff.
450340	456920	There were even hard-coded credentials in an older version of SAML that you could easily decode.
456920	467020	The response from Boeing was, you're a criminal, harassment, no bug bounty. And it was only after
468080	473140	my 59-page report went through and it got media attention after a disclosure period
473140	478420	that they were forced to start their first vulnerability disclosure program,
479600	485240	which they said it was based on my report. However, as far as I'm aware, Boeing still gives
485240	494360	zero bug bounty awards. So agriculture is nice, because I think all of us like to eat.
494360	501080	And this is an instance where it's a control system that is now an industrial IoT system
501080	506440	that is hanging on the internet, that has a web server that has never been security tested,
506440	516520	with no authentication. And it happens to be a European fish farm, a salmon farm to be exact.
516520	523760	And you can actually, in real life, press the buttons and you can modify the operations of this.
524940	533020	So we like water. Mexichem is actually a major bottled water provider,
533020	540460	manufacturer, amongst other things, in Latin America, in South Africa. They do a lot of stuff.
540560	550020	So I was looking around, because I get curious and bored, and I was very quickly able to find,
550020	559100	because they allowed LDAP to be exposed to the internet, I found 24 pages of assets
559660	566040	from the IT side on the business level, all the way down to on the control level for their
566040	574920	Windows-based SCADA systems. And this was rather unfortunate, because some of the systems that I
574920	582900	was able to find was this wonderful, what's called HMI, Human Machine Interface, the same exact
582900	589100	version that was vulnerable to some of the black energy attacks. And you didn't actually have to
589100	595900	log in, because it was never set up correctly. I could access the drives that it was attached to,
595900	605200	I could import and delete recipes, which is actually the production recipe of what the
605200	613360	machinery will be doing, and I could just click as many buttons as I wanted to. I could even export
613360	622060	the administration data, all at the touch of my fingertips, from my comfortable, small Amsterdam
622060	629420	house. And MexiChem also produces various different types of chemicals, some of which are
629420	636420	more controlled, so that they don't fall in the hands of really bad people who want to make things
636420	648300	go boom. So another thing to consider is, we're talking about IoT systems, they can be anywhere.
648760	653380	They could be inside a hospital, they could be on sensitive networks, they could be
654000	664340	at nuclear physics labs in Russia, and they could also be inside control systems, so that you can
664340	673940	actually, you know, use a printer. And so I was able to have a bit of fun, again, being bored,
673940	682060	don't ever let me get bored, and use census and a few other scanning tools to quickly find as many
682060	688620	particular printers as possible. It stemmed from the fact I was having a problem with my printer,
688620	695500	and I downloaded the Brother admin tool, which covers almost all of their models, and I noticed
695500	702360	that it had never been security tested. So I went ahead and flipped it around and turned it into a
703960	714460	weaponized piece of admin tool. And a lot of these printers will have web interfaces. So I had a lot
714460	721300	of fun with cross-site scripting, but most of my fun came from using the admin tool. See, once you
721300	728160	find one of these printers, it's not that difficult to find, you can use the free Brother admin tool,
728160	734480	go ahead and put in the IP address, and then connect to somebody else's printer anywhere in
734480	741660	the world. You can see how much ink they have, you can even order, if it's set up in their printer,
742400	747280	ink and toner supplies, because, hey, toner's worth more than platinum.
748160	756760	And you can also send files directly to the printer. So I had a lot of fun with this,
757860	764220	but unfortunately, Brother, like most printer manufacturers, do not have a vulnerability
764220	771340	disclosure program, nor did they ever think that you could use this lovely free tool available now
771340	779600	to download, and you can weaponize it and really make printers' lives uncomfortable. Bonus item,
779600	784940	if it's a multifunctional printer that's more of the commercial variety that has a hard drive
784940	790620	installed, and, say, Human Resources uses it as a scanner for different types of identification
790620	796700	systems, you can even access the hard drive where it saves those scans and get all sorts of
796700	804600	personally identifiable information and health data just by using this tool. So I like space,
805260	813640	and one of the things that is a bit problematic is, just like regular industrial systems,
813640	818640	once you put something in space, it's expected to last a while. There's even a space satellite
818640	827440	that is in a very interesting orbit that is up there for over 50 years. There's a lot of legacy
827440	832880	stuff. Once you put something up there, it's not like you can go, hey, guess what? We've got this
832880	837780	new type of encryption. You know what? It needs a chip to be able to process it. We're just going
837780	845860	to replace that chip in the satellite. That doesn't happen. And what we did last year was,
845860	851420	in the United Kingdom, thanks to Oxford who funded it and De Montfort University,
851860	857780	we held the first space hackathon at Royal Holloway University to discuss these things
857780	863180	with cleared PhD students who were given a lot of information by myself and others
863180	869460	on some of the problems with current and new space assets, because they're really industrial
869460	877120	IoT devices, and how to combat some of those problems, because encryption might not be there.
877120	882340	I believe it was only the year before last that the FTC mandated that new space asset
882340	887340	actually had to have the ability to use encryption. And we've seen some satellite
887340	895560	systems being used in various cyber crime attacks and malware, because if you can put one of your
895560	900860	hops and traceability on a satellite, it kind of makes it a bit hard to see who's actually behind
900860	906480	different things. So a lot of cool stuff came out of this hackathon. PhD students were absolutely
906480	913380	fantastic and energetic. They listed a lot of very pertinent risks that we had to consider,
913380	921440	such as the current UN space treaties do not cover private companies when it comes to warfare.
921760	928200	It only covers nation states. And the fact that some major players in the market,
928960	936000	if you want to watch a great older movie, I believe it's called Moonraker, it's a James Bond
936000	943920	movie, where a really rich guy with way too much money decides to go into space and then try to
943920	953220	take over the world by going to war in space as a private company. And so some of the risks listed
953220	961360	were, for example, Elon Musk and his program, because anyone can turn evil, and he already
961360	969940	thinks that the pyramids were created by aliens. So to give a brief example, you can actually find
969940	976920	some of these systems. Now, there's different ways that you can find various space IoT systems.
976920	981680	A lot of them you'll find are actually land systems, so then communicate up, but those land
981680	988660	systems, they can actually unfortunately be hacked. In this particular case, I was able to find a
988660	996580	relay connection up to a satellite, and I didn't want to give away too much information because
996580	1002160	they have not gotten back to me. I was able to find this particular device was running my favorite
1002160	1007980	protocol Modbus with no authentication. It could give the device ID, function codes, and all sorts
1007980	1014700	of information about it. And by looking into various user manuals that are freely available,
1014700	1019780	I was able to find that it was called a sunny string monitor that was attached to the satellite.
1019920	1027860	And what it does is it looks for sun and goes ahead and opens a solar array on a satellite
1027860	1034500	system to give a power or closes it down when there's nothing available, or can move it around
1034680	1043100	a little bit. So imagine what you could do with that. So why is this kind of important? Last month,
1043100	1048080	the United Nations Institute for Disarmament Research asked me to give a presentation,
1048160	1053600	a closed dialogue session, to permanent member states with other member states as observers.
1053740	1061920	And I brought up the fact that we need to be a lot more proactive. And although the United
1061920	1069900	Nations in 2015 established that member states are responsible for securing their ICT cyberspace,
1069900	1077120	that also includes space assets, that also includes industrial systems, etc., they agreed
1077120	1082460	to establish a computer emergency response team. And that's well and good. It's fantastic. It's
1082460	1089100	much needed. But that also is very, very reactive and constantly you're putting out fires. So it's
1089100	1095180	very difficult for you to be proactive. So I brought up with them that I'm currently working
1095180	1101200	with part of the European Union to actually establish their first proactive computer
1101200	1110920	emergency protection team, a CEPT. And CERT step one, CEPT step two, to try to alleviate some of
1110920	1116500	the burden and also try to catch things as quickly as possible before they become major incidents.
1116880	1123020	Now, back in 2009, this is also another reason why it's kind of important is I detected a cyber
1123020	1129500	warfare attack, the second wave of such attacks caused by malware that the North Koreans created.
1129500	1134080	One of the things they did was they leveraged higher speed bandwidth in Northern Europe
1135140	1142840	to go ahead and have those various devices aim at the South Korean infrastructure and
1142840	1147160	also part of the infrastructure of the United States. So they attacked the South Korean version
1147160	1152420	of the White House and also the U.S. version of the White House. They tried to affect the New
1152420	1161680	York Stock Exchange and a lot of other very important places. And because we were also monitoring
1161680	1168820	in my shop ICS systems that had internet connectivity, we found that some of the
1168820	1176620	Windows-based stuff actually was also affected and was trying to take down part of South Korea
1176620	1183280	and the U.S. So you can actually, unfortunately, weaponize with various types of malware,
1183280	1191520	IT, IoT, and ICS as we keep seeing. But even in 2009, 11 years ago, we were seeing this type
1191520	1197120	of stuff. So we need to take it much more seriously with the vendors as well as the
1197120	1203400	critical infrastructure operators and get the tech community involved because academia is great,
1203400	1209020	government experts are fantastic, but it's us and you watching this that have that
1209020	1217260	hacker mentality and can actually express it and find ways in and out that others can't.
1217580	1225000	So with that, I will be available on Discord for questions. Hopefully I get the right Discord
1225000	1232040	channel. I wanted to give a huge shout out to Omar at Santo Omar and the Red Team Village for
1232040	1237380	inviting me. If you also would like to contact me about things that are going on in the Middle
1237380	1244380	East, I believe my contact information is now on the Middle East Institute's website. And feel free
1244380	1251480	to contact me on Twitter and I take DMs, just no weird pictures, no weird sexy type pictures. Let
1251480	1257240	me stress that. I love pictures of cats. So thank you very, very much, Red Team Village. It is
1257240	1263220	greatly appreciated. Thank you so much for supporting us and for the great presentation.
1263220	1267900	You are getting a lot of kudos in Discord. So talking about Discord, if you're joining us,
1267900	1271800	you know, you can see the link in the bottom of the screen. There's a link to a website
1272520	1278780	where, you know, has a lot of other information about the speakers, along with, you know, all
1278780	1283120	the activities that are happening in, of course, in DEF CON. So with that said, we're going to go
1283120	1289260	on a break for a few minutes, and then the next presentation will be up in probably about 15 to 20
1289260	1295020	minutes. So thank you again, Chris. Great presentation. Have a nice one. All right, cheers.