supporting the Red Team Village. We're very honored to have you here.
And with that said, take it away.
Well, hello everybody, and good morning if you're just waking up.
I am so happy to be giving this presentation at the Red Team Village
at DEF CON Safe Mode this year.
Coming to you live from my tiny little Amsterdam house.
And hopefully I can bring some energy and wake some people up.
So this is called Pwn the World.
So if you don't know much about me, my name is Chris Kubeka.
And I am the CEO of two companies, one in the UK and one in the Netherlands.
It deals with critical infrastructure protection and high-level incident response.
I'm also a Distinguished Non-Resident Fellow at the Middle East Institute for the Cyber Program,
dealing with a lot of these issues in the Middle East.
My areas of main concentration are critical infrastructure,
lots of different ICS, industrial IoT, and especially cyber warfare.
I've been involved with several high-level cases of cyber warfare in the past,
and continue to do so.
Previous to this, I headed the Information Protection Group
and International Intelligence Group for the Aramco family.
And not that many years ago, I won't date myself,
I was an air crew member, and also with Space Command, dealing with command and control systems.
So, let's briefly talk about what a control system is.
Because this is my favorite part of technology,
where you get to actually move things, or set things in motion,
to where once you program something, it then has a set series of responses that it does.
We see this everywhere, inside your home, inside power plants, inside aircraft, inside space assets,
all sorts of industrial things, like the manufacture of masks,
and even your coffee maker is, in and of itself, a control system.
And hopefully everybody's had loads of coffee today.
Believe it or not, I haven't. That's okay.
So, some of the things that we have to remember is this.
The previous speaker was talking about Zoom, and we're actually coming to you live over Zoom and Twitch,
is that when we're talking about technology, we have to think of the fact that
a lot of technology is pushed out there as quickly as possible to gain some sort of edge in the market.
So, it's quite common to have what I call profits over vulnerabilities.
And when we're dealing with control technology, there's also a lot of legacy devices.
Good for instance is the BART public transport system inside and outside part of San Francisco
has such old legacy equipment, they have to look on eBay to get any sort of replacements.
And I've dealt with other public transport companies where they've got signaling systems that are almost 50 years old.
Since they can no longer find these systems, they actually have to fabricate them.
And they've been trying to update them and turn them into IoT systems, which has been extremely challenging.
When you build a power plant, you expect that power plant, after you've spent millions, hundreds of millions sometimes,
or if you're talking about nuclear power, billions, you expect that type of hardware and the software running it to last for quite some time.
Of course, there's a mismatch because when we start integrating, as we have already in the past,
say Windows systems into hardware that's meant to last 10, 20, 30 years sometimes,
you obviously get this mismatch and vulnerabilities are introduced into this type of hardware.
Now, the longer something is up and running, the more things end up getting plugged into it.
And many companies, governments, etc. don't know that they've got orphan servers that are hanging out there,
that they had some sort of connection that one person knew about.
It could be anything from something stuck in a closet to run reports.
There's one case where they only found out at one organization about this because they were renovating the office building
and they found in the wall a couple of cables, a power cable and a network cable, broke the wall down and in there was a reporting server.
So these types of things happen.
But at the same time, we also have to remember that our modern world is most definitely driven on technology and digitization.
And that can also come with a bit of a cost when we discuss geopolitics.
Not everyone is friends and sometimes your friends are actually frenemies.
And we have to realize that we have become as dependent on ICT systems as we have on oxygen at this point in time.
Funny enough, oxygen is produced in a controlled system environment.
Now, to make matters even worse, lots of different companies, organizations, etc. deal with third parties.
You can't manufacture a program and do everything yourself in a closed bubble.
And sometimes that means that there could be, like in the Target situation, an HVAC company who had access to Target.
And unfortunately, they were used as a conduit for attack.
So we have to think about these things when we think about some of the risks and security challenges with control systems and technology.
So, I deal a lot with critical infrastructure.
And that's the type of stuff that really keeps the modern world going.
But interestingly enough, there's no international consensus as to what critical infrastructure is.
I was on a recent call doing a presentation for the United Nations.
And I brought up with one of the presenters that, because I live in the Netherlands, we're the second largest food exporter in the world.
It's a tiny country, 17 million people, but we produce and export number two in the world.
And the reason for that is our farmers have drones and robots, and it's highly sophisticated.
So we've got a lot of industrial IoT systems and ICS systems that are mixed in.
And I brought up the fact that for the Netherlands, for example, that agriculture should be considered part of critical infrastructure.
Of course, this varies from country to country, region to region.
I would not expect Mongolia to think of port security as critical infrastructure, but I would here in the Netherlands or the United States or any place that has a lot of different ports that they depend on.
So, one of the reasons why some of this stuff is so insecure is the companies who make the hardware and or software are not in security.
They're in it to make things interoperable so that they work together and produce what they're supposed to do.
And another very interesting factor is when you're dealing with control systems, we've seen this triad, the triangle, excuse me, of CIA, where confidentiality is queen.
However, in the industrial world, availability is.
So, if you have to pile on things like encryption or lots of authentication, you can cause a latency to encrypt, decrypt, encrypt, decrypt, etc.
And from the moment you press a button or send what's called a sec command, you want that to go through the system as quickly as possible.
And unfortunately, that means that security is actually the bottom part. It's availability, integrity, and confidentiality.
That's the order that it goes with critical infrastructure and control systems.
Now, another major factor is that the vast majority of critical infrastructure and control systems are privately owned.
So, there are limitations to what a government can regulate, legislate, and dictate to a company because there are going to be costs associated with securing this infrastructure.
And we have to ask the question, how much does water cost right now versus less risky water infrastructure?
Or are hospitals going to have to choose between tightening up and securing their ICT systems, which are included in a lot of medical IoT devices and built-in control systems?
Or are they going to buy a ventilator or an MRI machine, etc.?
So, there is an absolute cost associated with this. But at the same time, we're absolutely dependent on this stuff.
So, the other day, for this presentation, what I did was I used Census to do a massive scan across the internet using their ZMap project.
And I was trying to concentrate on things that I could immediately find that were related to industrial IoT, control systems, and things of that nature.
And the problem is, I found a heck of a lot. And this was just the top ten things.
As you'll notice, there's a lot of SCADA systems, which are Supervisory Control and Data Acquisition, which connect a lot of the backbone, so to speak, of ICS systems, built-in control systems.
These can vary from security stations. A lot of police departments use these, especially in the United States and China.
Also, HVAC, my personal favorite protocol for control systems, which is Modbus. I'll tell you why in a moment.
So, there's a lot of these things that are exposed on the internet right now. And when I say, please hack me, the reason being is, even if you've got a modern system, yay!
And when it comes to the point of, hey, we have a patch, we need to update this, a lot of organizations won't do that very quickly, because they're afraid that it will lose that interoperability function.
And you don't want to do that in, I don't know, a water processing plant, and then knock out everybody's water for a short time.
So, one of the reasons why I like Modbus is, when it was created, it was created a long time ago, there is no real, really, any authentication or security.
And here, this protocol, because it was made open source, was adopted like crazy. As quickly adopted as Zoom was during the pandemic, basically, because it didn't cost any money to do so.
And it communicates between different types of equipment. It's got to be on the same network, though.
It will also transmit all sorts of data between a SCADA system and what's called a remote access terminal unit.
One of my other favorite features is the fact that it uses ladder logic, very much like a firewall.
And if any of you have seen a firewall with 2,000 plus different rules, you'll know that if part of that ladder logic is not done correctly, then your security settings in that firewall, just like the ladder logic, will actually moot and make the oncoming settings absolutely useless.
And it also has a slave to master architecture. So it's kind of old school.
Some of the things that you'll see using Modbus are PLCs, or programmable logic controllers, remote terminal units.
There are actually some modems, industrial modems that still use this, as well as parts of some systems with certain types of SMS.
And old school paging, which happens to be used in a lot of hospitals still.
And there is some safety equipment that is actually used with Modbus, but less and less nowadays.
So I'm going to start introducing you to some tools.
Because see, Modbus, although some versions of it can run over TCP, IP4, it's not, say, directly translatable, meaning everything is in hexadecimal code.
And also a lot of the regular IT-based hacker tools and scanners can't actually reach in really, really deep to see anything past, hey, this port's open.
So we have to use some additional tools to get what we need.
One of the things I like about the tools that I'll be showing you is the fact that they are absolutely legitimate tools that would not trigger, say, an antivirus alert or a potentially unwanted program.
On the contrary, they would be expected to be used as a technician or engineer in many of these different environments.
And all of the tools that I'll be showing are free as well if you want to get started.
So Chipkin has this wonderful Modbus scanner and what you do is once you can find something that says, hey, I got port 502 open and my banner says Modbus,
you go ahead and you plug in the IP address and it will then look even deeper and what it will show you is everything that's on its network behind that IP address.
So in this particular case, it isn't just one thing that's at the IP address, it's multiple things that are at the IP address.
And we'll also show you different things like functions, which are very important in Modbus.
Now, another thing that I like, this one again is free from plcdatatools.com, is once you find an IP address, it will go ahead and scan it and tell you which type is actually running.
And sometimes you can get even more information than just what you're seeing right now on your screen.
So in this case, I took an IP address and went ahead and scanned and found the firmware version, if it's running, obviously it's running, what the code is, which is a manufacturer code, and also picked up the fact that it is running something called Siemens S7.
And this is a proprietary protocol created by Siemens. If you've never heard of Siemens S7, this was the type that was running in the Iranian nuclear enrichment program when Spexnet hit it.
So a PLC programmable logic controller running Siemens S7.
And this is quite handy, too, because if you find things that have not been updated, which the vast majority have not been updated recently, you can also couple those with various exploits that are known and use them against them.
And another thing is because it's kind of slow to do a lot of these security updates and also although Siemens does a lot nowadays for ICS security, you can use some of the exploits on multiple firmware and model numbers.
So it's quite groovy to do this. Of course, only do it legally.
And to show you, for instance, I ran across this when I was helping with some of the NATO and European Union member state cyber warfare exercises in Brussels not too long ago.
And what I found was this is an actual power station that I found using Shodan and when I went to look further with various other tools and of course with permission.
On that power plant and on the piece of Modbus hardware that they have, they also had, unfortunately, a remote access Trojan called Extreme RAT installed.
And you can see the banner that shows for this particular version of Extreme RAT.
So these things are already present and some power stations and water facilities and etc.
Now, another very common control protocol is BACnet and many of us have various different types of thermostats that are digital.
And this is just one way that you can use BACnet. It's used in a variety of different ways.
And if we take a look at this simple thermostat, we can break down what some of the digits actually mean.
And what we can do is flip that around and find some of these objects directly connected to the internet.
And BACnet does have some security features, but not that many.
So if I break down looking at census.io, these are the different types of BACnet fields that you can find,
which is quite groovy because if you want to, for instance, look at only certain firmware revisions,
or application software revisions, or model names, or vendor IDs, you can go ahead and zoom into these.
Because every vendor that uses BACnet, similar to Modbus, has to have a registered vendor ID.
So a groovy tool that I like to use with BACnet to look even further is from Contemporary Controls BACnet Discovery Tools.
And again, this is free. Unfortunately, most of these tools require Windows.
It's because there's a lot of Windows in control environments.
And you can install this groovy tool, and it does something similar to the Modbus scanner tool from Chipkin,
where it will show everything that's connected on the back end to the BACnet tool.
And it will also show, for instance, those object names, which is temperature.
And this is quite handy. Also, another thing to add is BACnet uses port 47808 and uses UDP predominantly.
So this is a very interesting protocol because it has gotten very, very big.
And it is used in all sorts of places.
And it's also had some noted security issues where it's taken time for the people behind Tritium to actually issue patches.
It is driven on Java, Java, Java.
And it could be in your elevator. It could be in a private or police security station.
It could be in your airport. Luckily, not many of us can fly, right?
It can be in a bit of everywhere.
And think about some of the mayhem that could be done if you were able to get into some of these different devices.
So it goes kind of by two names, Tritium or Fox Protocol.
And on Census, here's some of the things you can pick up on.
You can pick up on the application version, so you can go ahead and map that to any known exploits.
Or actually download the package yourself and then in your home lab, of course, with permission.
You can start fooling around with some of this stuff to see what else you can find.
You can do the host ID, which is quite handy in many different ways, the ID version, station name, etc.
And you can do a lot with this particular profile, excuse me, protocol.
So I like to have a lot of fun with Fox.
And one of the ways that you can look at some of these systems, with permission, of course,
is there is a free product for download. This will also run on Linux.
And what it does is it's open source, Java based, and it will basically connect to any embedded system that's running it.
And it tries to keep it vendor neutral, so it won't just be vendor A, B, and C, but not D.
It will basically connect to anything.
And even though there are some security settings, a lot of organizations have not actually set them up.
Yay! Please help me.
And in addition to that, I wanted to list a few more tools that might interest you.
And these are free. Chipkin is an organization that does a lot with technicians that deal with MacNet, Modbus, and a few other, we'll say, more industrial IoT and control systems.
And they've got a bevy of tools, which is fantastic, because they also do not security test their tools.
And you can weaponize them even further, if you would like, in a controlled manner, legally only.
I am not a lawyer. Remember that.
So, not long ago, I got this very interesting offer.
And one thing to remember about control systems, it's similar to what you may have heard of with cars.
A can bus is a can bus. Well, a control system is also a control system.
So even boats have these different things.
So when I talk about a boat, it's a really big boat, like liquid gas transport or cargo ships.
And there was an organization I was working with as an advisor that specialized in maritime security.
And they were trying to get the cyber part started.
The majority of the stuff they did was maritime intelligence, trying to find ships that go dark on purpose,
turning off their identification transponders so they can, I don't know, smuggle arms, people,
refuse to rescue people in the Mediterranean, if they're refugees, little things like that.
So we got an offer to hack a very, very large boat worth almost 200 million pounds.
And of course, me thinking, hmm, what are all of the lovely things that could go wrong with a very, very large boat?
So I made a few conditions. One of them was when we stole the boat, I got to wear an eyepatch.
Secondly, I got to say, once the boat was, I should say, liberated, I got to say, look at me, look at me.
I am the captain now, wearing my eyepatch.
And one of the things you have to remember about maritime is there's a lot of legacy stuff, just like industrial protection systems.
So fun fact, really big ships, their control mechanism is actually controlled via the civilian band of GPS.
And there are already known ways to exploit the civilian band. These are not tied to the military GPS control.
So the captain of a ship does control the ship. However, the majority of where the ship goes is actually controlled with the civilian GPS control system.
Another thing about maritime is a lot of them use different forms of something called Windows CE, which depending on the age of the ship and the last time it's been retrofitted,
it could be using versions that are based off of Windows XP, Windows 7, and only the newest and greatest stuff is going to be based off of Windows 10.
And one of the things that concerns many people about Windows CE is it is for embedded systems and it's in compact edition.
It doesn't have all the bells and whistles. So out of the box, it's not going to be logging everything that you would expect with professional edition.
It's also going to be slower to patch from Microsoft because they know that a lot of industrial systems use these.
And there's a bevy of wonderful mayhem that can be done with various different types of Windows CE.
Another thing to consider when we're talking about maritime is there are multiple entry and exit points on a large ship.
They have to keep in contact with a lot of different things.
There's something called the AIS system, two different forms that was mandated for larger ships to use to avoid hitting other ships, which is kind of nice.
But it also automatically has contacts with things like buoys, land stations, and other things.
And the AIS protocol... background, I've been building a few tools because I know that there are various security issues with that particular protocol.
And that's one of the ways that the ship in question was liberated.
Then you also have VSAT systems, UHF systems sometimes, and different other types of communications.
And one of the problems with these is, again, they might be legacy, but also the manufacturers are not in the security business.
So I can find, for instance, VSAT systems directly connected to the internet that's giving way too much information that could then be turned around and remotely controlled.
Because they're exploitable in many cases.
And even where there is security, several of the major manufacturers for some of these, including some of the 3G, 4G modems that are also in use with the larger ships,
is they'll use what's called known private keys, which equals, I tried to encrypt, but not really.
So even boats can be yours.
Now, many of us are not in Vegas. I'm in my tiny house in Amsterdam.
And we've done a lot of increased teleworking. Everything is remote now.
Here's a new hashtag, bring your own house.
Because the regular, say, office or power plant security is now in your living room or in your home office.
Many people have to share their home network with their partners, their Roomba, in my case, my partner,
children, or especially if you're stealing your neighbor's Wi-Fi to watch this presentation right now.
But when you have to do work, let's say you're doing sensitive stuff.
Let's say you are a process engineer that can't go into your place of work and have to do things more and more remote.
Guess what? Your infrastructure could be mine.
Because one of the problems is when things are rapidly set up, especially during a pandemic,
they might not be using the newest, greatest, most patched and updated things.
And another thing to consider is a lot of production and industrial systems,
the manufacturers will just pick one out of the air, Honeywell, for example,
they'll say, hey, we have all this equipment at your plant.
But to maintain the warranty on the service agreement, when you paid all this money for this plant,
we need a direct connection to constantly pull data and look at the infrastructure to make sure everything is working correctly.
By the way, we're going to use a really old version of BNC.
And all of our technicians use the same exact credentials to connect to all of our worldwide customers.
Yay! Otherwise known as a technician backdoor in these cases.
And if you say, hey, Honeywell, you know, that's not very secure.
And they're like, hey, you know what's even less secure?
Not having a warranty on all of your hardware.
And you're like, oh, yeah, we'll be using that old version of BNC.
So with this wonderful 2020 trying to kill this pandemic really hit,
I went ahead and scanned the Internet and took the top 10 countries with assets that say hello to the Internet.
And that's in the yellowish. I'm not sure how much you can see because of the big DEF CON logo.
And in the orangish bar, those are remote only access protocols that I was looking for and also certain versions.
Like older versions of SSH, FTP, remote desktop protocol, etc.
So what I found was, for instance, the United States has 47,500,000 assets.
Out of those assets, when I was looking only for known exploitable remote access vulnerabilities,
there were almost 12.5 million ones that I could find for the United States, which is not a great ratio.
However, I will say that some of the assets that I scanned, they can have multiple vulnerabilities.
Looking at between the U.S. and China, China has almost 8.5 million assets on the Internet that say hello,
but almost 5 million of those are remotable with no exploits and vulnerabilities in them.
The one country that did fairly well was actually the United Kingdom with their ratio between assets and exploitable vulnerabilities.
And one of the reasons for that was several years ago, they did something very fantastic.
They instituted this thing, a cyber program for anyone doing business with the U.K. and also critical infrastructure,
had to really take a look at their stuff and go ahead and pass an audit, in most cases a self-audit,
depending on your level of access with the government and also critical infrastructure.
And they were able to get a head start and so they actually are doing fairly well in comparison to the rest of the top tenors.
So another thing that we have to consider is because things are now industrial IoT devices or IoT devices,
this means that you can have a control system that is IoT enabled.
Now in this case, I like to take a look at Tesla stuff because I just do.
And you can actually use census.io, what I call census.org, to find various Tesla power walls.
And what's interesting about this is even though Tesla has some security, it's still single factor authentication.
There's still a web interface. The customer doesn't necessarily have to set up any real security.
So there's admin-admin kind of stuff, depending on the version of the software.
Tesla does not force down updates like Windows 10 or their cars, so there are a lot of old versions.
And what you can actually pull back is the configuration of the power walls.
Versions, timestamps, showing the last login, how long it's been up, if it's updating or not, and a bevy of other diagnostic information.
And what's unfortunate is if you're able to get into some of these systems, which you can, you can do more nefarious things.
Like imagine a region of power walls that suddenly all of their electricity got dumped on the energy grid. That would be a very bad thing.
Or if it was connected to some sort of crucial hardware, that would be a bad thing.
And in this particular case, this one was connected to a crane. Who doesn't want to own their own crane? Well, you can too.
So, you have to understand that if it's running a web server, I don't care if it's a power bank or a piece of industrial equipment or whatever, you can hack it like a web server. Remember that.
So, I do a lot in aviation. Sometimes that's good, sometimes they hate me.
So, either way, you know, so there are various ways to get into various things.
And one of the dangers that we have is a lot of remote desktop protocol.
You can actually buy exploited systems on the scary dark web from a dollar to ten dollars a piece if they have RDP.
Ten dollars is for typically U.S. military assets that are found.
In this case, this one belongs to Airbus, where luckily the admin happens to be logged in. I wonder what the password might be.
And the CN is actually the certificate, which I could match up to absolutely belonging to Airbus.
Another fun fact is depending on the aircraft, some Airbus aircraft actually use Windows CE in their aircraft. Yay!
So, I'm not sure you may or may not have heard much about Boeing other than some of their planes like to fall from the sky because they have software issues.
And starting last year, one of the things I did, and by the way, hi Boeing, I know you still want to put me in jail, was that I took a look around some of their infrastructure and found that it was incredibly bad.
For instance, at the time, Boeing.com and its websites didn't even use HTTPS or any encryption for their websites.
And this included login systems. Yay!
I was able to get into the R&D section of their flight control software, which also included the 737 MAX aircraft,
because to authenticate, I was using Firefox with no script running, and the website had a message, you are not running scripts, please press this button.
Press the button. I was in! How awesome is that?
There were, you know, six cross-site scripting vulnerabilities in the live in-production flight control aviation ID system. Woo-hoo-hoo! Right?
And the interesting thing about this is, if you can get into the flight control system or software, and you know what you are doing,
the process is, the technician will download what's needed for their aircraft, put it on a maintenance laptop,
that maintenance laptop then plugs into the aircraft itself, into the flight control system.
So imagine some of the mayhem that you could do, because Boeing had zero effort and zero knowledge in security.
Funny enough, they do sell cyber security services as consultants to the U.S. government.
However, I guess they never ate their own dog food and looked at their own stuff.
There were even hard-coded credentials in an older version of SAML that you could easily decode.
The response from Boeing was, you're a criminal, harassment, no bug bounty.
And it was only after my 59-page report went through and it got media attention after a disclosure period
that they were forced to start their first vulnerability disclosure program, which they said it was based on my report.
However, as far as I'm aware, Boeing still gives zero bug bounty awards.
So agriculture is nice, because I think all of us like to eat.
This is an instance where it's a control system that is now an industrial IoT system that is hanging on the Internet,
that has a web server that has never been security tested, with no authentication.
And it happens to be a European fish farm, a salmon farm to be exact.
And you can actually, in real life, press the buttons, and you can modify the operations of this.
So, we like water. Mexichem is actually a major bottled water provider, manufacturer, amongst other things, in Latin America and South Africa.
They do a lot of stuff.
So, I was looking around, because I get curious and bored.
And I was very quickly able to find, because they allowed LDAP to be exposed to the Internet,
I found 24 pages of assets from the IT side on the business level, all the way down to on the control level for their Windows-based SCADA systems.
And this was rather unfortunate, because some of the systems that I was able to find was this wonderful, what's called HMI, Human Machine Interface,
the same exact version that was vulnerable to some of the black energy attacks.
And you didn't actually have to log in, because it was never set up correctly.
I could access the drives that it was attached to.
I could import and delete recipes, which is actually the production recipe of what the machinery will be doing.
And I could just click as many buttons as I wanted to.
I could even export the administration data, all at the touch of my fingertips from my comfortable, small Amsterdam house.
And MexiChem also produces various different types of chemicals, some of which are more controlled, so that they don't fall in the hands of really bad people who want to make things go boom.
So another thing to consider is we're talking about IoT systems.
They can be anywhere.
They could be inside a hospital.
They could be on sensitive networks.
They could be at nuclear physics labs in Russia.
And they could also be inside control systems, so that you can actually, you know, use a printer.
And so I was able to have a bit of fun, again, being bored.
Don't ever let me get bored.
And use Census and a few other scanning tools to quickly find as many particular printers as possible.
It stemmed from the fact I was having a problem with my printer, and I downloaded the Brother admin tool, which covers almost all of their models.
And I noticed that it had never been security tested.
So I went ahead and flipped it around and turned it into a dual-use weaponized piece of admin tool.
And a lot of these printers will have web interfaces.
So I had a lot of fun with cross-site scripting, but most of my fun came from using the admin tool.
See, once you find one of these printers, it's not that difficult to find, you can use the free Brother admin tool, go ahead and put in the IP address, and then connect to somebody else's printer anywhere in the world.
You can see how much ink they have, you can even order, if it's set up in their printer, ink and toner supplies, because, hey, toner's worth more than platinum.
And you can also send files directly to the printer.
So I had a lot of fun with this, but unfortunately, Brother, like most printer manufacturers, do not have a vulnerability disclosure program.
Nor did they ever think that you could use this lovely free tool, available now to download, and you can weaponize it and really make printers' lives uncomfortable.
Bonus item, if it's a multifunctional printer that's more of the commercial variety that has a hard drive installed, and, say, Human Resources uses it as a scanner for different types of identification systems,
you can even access the hard drive where it saves those scans and get all sorts of personally identifiable information and health data just by using this tool.
So, I like space, and one of the things that is a bit problematic is, just like regular industrial systems, once you put something in space, it's expected to last a while.
There's even a space satellite that is in a very interesting orbit that is up there for over 50 years. There's a lot of legacy stuff.
Once you put something up there, it's not like you can go, hey, guess what? We've got this new type of encryption. You know what? It needs a chip to be able to process it.
We're just going to replace that chip in the satellite. That doesn't happen. And what we did last year was, in the United Kingdom, thanks to Oxford, who funded it, and De Montfort University, we held the first space hackathon at Royal Holloway University
to discuss these things with cleared PhD students who were given a lot of information by myself and others on some of the problems with current and new space assets, because they're really industrial IoT devices, and how to combat some of those problems.
Because encryption might not be there. I believe it was only the year before last that the FTC mandated that new space assets actually had to have the ability to use encryption. And we've seen some satellite systems being used in various cyber crime attacks and malware, because if you can put one of your hops and traceability on a satellite, it kind of makes it a bit hard to see who's actually behind different things.
So a lot of cool stuff came out of this hackathon. PhD students were absolutely fantastic and energetic. They listed a lot of very pertinent risks that we had to consider, such as the current UN space treaties do not cover private companies when it comes to warfare. It only covers nation states.
And the fact that some major players in the market, if you want to watch a great older movie, I believe it's called Moonraker, it's a James Bond movie, where a really rich guy with way too much money decides to go into space and then try to take over the world by going to war in space as a private company.
And so some of the risks listed were, for example, Elon Musk and his program, because anyone can turn evil and he already thinks that the pyramids were created by aliens.
So to give a brief example, you can actually find some of these systems. Now, there's different ways that you can find various space IoT systems. A lot of them you'll find are actually land systems that then communicate up, but those land systems, they can actually unfortunately be hacked.
In this particular case, I was able to find a relay connection up to a satellite. And I didn't want to give away too much information because they have not gotten back to me. I was able to find this particular device was running my favorite protocol Modbus with no authentication. It could give the device ID, function codes, and all sorts of information about it.
And by looking into various user manuals that are freely available, I was able to find that it was called a sunny string monitor that was attached to the satellite. And what it does is it looks for sun and goes ahead and opens a solar array on a satellite system to give a power or closes it down when there's nothing available or can move it around a little bit. So imagine what you could do with that.
Why is this kind of important? Last month, the United Nations Institute for Disarmament Research asked me to give a presentation, a closed dialogue session to permanent member states with other member states as observers.
And I brought up the fact that we need to be a lot more proactive. And although the United Nations in 2015 established that member states are responsible for securing their ICT cyberspace, that also includes space assets, that also includes industrial systems, etc.
They agreed to establish a computer emergency response team. And that's well and good. It's fantastic. It's much needed. But that also is very, very reactive and constantly you're putting out fires. So it's very difficult for you to be proactive.
So I brought up with them that I'm currently working with part of the European Union to actually establish their first proactive computer emergency protection team, a CEPT. And CERT step one, step two, to try to alleviate some of the burden and also try to catch things as quickly as possible before they become major incidents.
Now back in 2009, this is also another reason why it's kind of important, is I detected a cyber warfare attack, the second wave of such attacks caused by malware that the North Koreans created. One of the things they did was they leveraged higher speed bandwidth in Northern Europe to go ahead and have those various devices aim at the South Korean infrastructure and also part of the infrastructure of the United States.
So they attacked the South Korean version of the White House and also the U.S. version of the White House. They tried to affect the New York Stock Exchange and a lot of other very important places.
And because we were also monitoring in my shop ICS systems that had internet connectivity, we found that some of the Windows-based stuff actually was also affected and was trying to take down part of South Korea and the U.S.
So you can actually, unfortunately, weaponize with various types of malware, IT, IoT, and ICS as we keep seeing. But even in 2009, 11 years ago, we were seeing this type of stuff. So we need to take it much more seriously with the vendors as well as the critical infrastructure operators and get the tech community involved.
Because academia is great, government experts are fantastic, but it's us and you watching this that have that hacker mentality and can actually express it and find ways in and out that others can't.
So with that, I will be available on Discord for questions. Hopefully I get the right Discord channel. I wanted to give a huge shout out to Omar at Santo Omar and the Red Team Village for inviting me.
If you also would like to contact me about things that are going on in the Middle East, I believe my contact information is now on the Middle East Institute's website.
And feel free to contact me on Twitter and I take DMs. Just no weird pictures. No weird sexy time pictures. Let me stress that. I love pictures of cats. So thank you very, very much, Red Team Village. It is greatly appreciated.
Thank you so much for supporting us and for the great presentation. You're getting a lot of kudos in Discord. So talking about Discord, if you're joining us, you can see the link in the bottom of the screen. There's a link to a website where it has a lot of other information about speakers along with all the activities that are happening, of course, in DEF CON.
So with that said, we're going to go on a break for a few minutes and then the next presentation will be up in probably about 15 to 20 minutes. So thank you again, Chris. Great presentation. Have a nice one.
All right. Cheers.