start	end	text
0	4120	supporting the Red Team Village. We're very honored to have you here.
4120	6340	And with that said, take it away.
6680	10400	Well, hello everybody, and good morning if you're just waking up.
10400	14260	I am so happy to be giving this presentation at the Red Team Village
14260	16800	at DEF CON Safe Mode this year.
16800	23100	Coming to you live from my tiny little Amsterdam house.
23220	27780	And hopefully I can bring some energy and wake some people up.
27780	29860	So this is called Pwn the World.
30360	33440	So if you don't know much about me, my name is Chris Kubeka.
33440	38720	And I am the CEO of two companies, one in the UK and one in the Netherlands.
38720	43360	It deals with critical infrastructure protection and high-level incident response.
43360	47980	I'm also a Distinguished Non-Resident Fellow at the Middle East Institute for the Cyber Program,
48300	50780	dealing with a lot of these issues in the Middle East.
50960	55140	My areas of main concentration are critical infrastructure,
55140	60380	lots of different ICS, industrial IoT, and especially cyber warfare.
60380	64400	I've been involved with several high-level cases of cyber warfare in the past,
64400	66320	and continue to do so.
66340	70040	Previous to this, I headed the Information Protection Group
70040	74360	and International Intelligence Group for the Aramco family.
74760	78700	And not that many years ago, I won't date myself,
78700	84940	I was an air crew member, and also with Space Command, dealing with command and control systems.
85440	89940	So, let's briefly talk about what a control system is.
89940	92580	Because this is my favorite part of technology,
92580	98300	where you get to actually move things, or set things in motion,
98300	106040	to where once you program something, it then has a set series of responses that it does.
106040	116380	We see this everywhere, inside your home, inside power plants, inside aircraft, inside space assets,
116380	122500	all sorts of industrial things, like the manufacture of masks,
122500	128040	and even your coffee maker is, in and of itself, a control system.
128040	131000	And hopefully everybody's had loads of coffee today.
131000	133900	Believe it or not, I haven't. That's okay.
133900	137300	So, some of the things that we have to remember is this.
137880	144960	The previous speaker was talking about Zoom, and we're actually coming to you live over Zoom and Twitch,
144960	150720	is that when we're talking about technology, we have to think of the fact that
151300	157780	a lot of technology is pushed out there as quickly as possible to gain some sort of edge in the market.
157780	162480	So, it's quite common to have what I call profits over vulnerabilities.
162480	170220	And when we're dealing with control technology, there's also a lot of legacy devices.
170440	178960	Good for instance is the BART public transport system inside and outside part of San Francisco
179480	184960	has such old legacy equipment, they have to look on eBay to get any sort of replacements.
184960	191140	And I've dealt with other public transport companies where they've got signaling systems that are almost 50 years old.
191140	196560	Since they can no longer find these systems, they actually have to fabricate them.
196560	203300	And they've been trying to update them and turn them into IoT systems, which has been extremely challenging.
203600	210500	When you build a power plant, you expect that power plant, after you've spent millions, hundreds of millions sometimes,
210500	218900	or if you're talking about nuclear power, billions, you expect that type of hardware and the software running it to last for quite some time.
218900	226380	Of course, there's a mismatch because when we start integrating, as we have already in the past,
226380	233040	say Windows systems into hardware that's meant to last 10, 20, 30 years sometimes,
233040	241240	you obviously get this mismatch and vulnerabilities are introduced into this type of hardware.
242280	248880	Now, the longer something is up and running, the more things end up getting plugged into it.
248880	256260	And many companies, governments, etc. don't know that they've got orphan servers that are hanging out there,
256260	260120	that they had some sort of connection that one person knew about.
260120	265760	It could be anything from something stuck in a closet to run reports.
265760	272360	There's one case where they only found out at one organization about this because they were renovating the office building
272360	282200	and they found in the wall a couple of cables, a power cable and a network cable, broke the wall down and in there was a reporting server.
282200	284540	So these types of things happen.
284760	294400	But at the same time, we also have to remember that our modern world is most definitely driven on technology and digitization.
294460	301000	And that can also come with a bit of a cost when we discuss geopolitics.
301000	305920	Not everyone is friends and sometimes your friends are actually frenemies.
305940	316700	And we have to realize that we have become as dependent on ICT systems as we have on oxygen at this point in time.
316700	322080	Funny enough, oxygen is produced in a controlled system environment.
322140	329480	Now, to make matters even worse, lots of different companies, organizations, etc. deal with third parties.
329480	334160	You can't manufacture a program and do everything yourself in a closed bubble.
334280	343940	And sometimes that means that there could be, like in the Target situation, an HVAC company who had access to Target.
343940	347420	And unfortunately, they were used as a conduit for attack.
347800	355820	So we have to think about these things when we think about some of the risks and security challenges with control systems and technology.
355820	359380	So, I deal a lot with critical infrastructure.
359380	363780	And that's the type of stuff that really keeps the modern world going.
363780	369660	But interestingly enough, there's no international consensus as to what critical infrastructure is.
369660	374180	I was on a recent call doing a presentation for the United Nations.
374220	381780	And I brought up with one of the presenters that, because I live in the Netherlands, we're the second largest food exporter in the world.
381780	388340	It's a tiny country, 17 million people, but we produce and export number two in the world.
388340	396140	And the reason for that is our farmers have drones and robots, and it's highly sophisticated.
396140	402100	So we've got a lot of industrial IoT systems and ICS systems that are mixed in.
402540	410420	And I brought up the fact that for the Netherlands, for example, that agriculture should be considered part of critical infrastructure.
410420	414200	Of course, this varies from country to country, region to region.
414280	427460	I would not expect Mongolia to think of port security as critical infrastructure, but I would here in the Netherlands or the United States or any place that has a lot of different ports that they depend on.
427740	438460	So, one of the reasons why some of this stuff is so insecure is the companies who make the hardware and or software are not in security.
438460	444940	They're in it to make things interoperable so that they work together and produce what they're supposed to do.
444980	457900	And another very interesting factor is when you're dealing with control systems, we've seen this triad, the triangle, excuse me, of CIA, where confidentiality is queen.
457900	462260	However, in the industrial world, availability is.
462260	472360	So, if you have to pile on things like encryption or lots of authentication, you can cause a latency to encrypt, decrypt, encrypt, decrypt, etc.
472520	479500	And from the moment you press a button or send what's called a sec command, you want that to go through the system as quickly as possible.
479500	488480	And unfortunately, that means that security is actually the bottom part. It's availability, integrity, and confidentiality.
488480	492740	That's the order that it goes with critical infrastructure and control systems.
492740	501640	Now, another major factor is that the vast majority of critical infrastructure and control systems are privately owned.
501640	512780	So, there are limitations to what a government can regulate, legislate, and dictate to a company because there are going to be costs associated with securing this infrastructure.
512980	524520	And we have to ask the question, how much does water cost right now versus less risky water infrastructure?
524520	536320	Or are hospitals going to have to choose between tightening up and securing their ICT systems, which are included in a lot of medical IoT devices and built-in control systems?
536320	542220	Or are they going to buy a ventilator or an MRI machine, etc.?
542220	551160	So, there is an absolute cost associated with this. But at the same time, we're absolutely dependent on this stuff.
551880	561140	So, the other day, for this presentation, what I did was I used Census to do a massive scan across the internet using their ZMap project.
561140	575360	And I was trying to concentrate on things that I could immediately find that were related to industrial IoT, control systems, and things of that nature.
575380	581140	And the problem is, I found a heck of a lot. And this was just the top ten things.
581140	594080	As you'll notice, there's a lot of SCADA systems, which are Supervisory Control and Data Acquisition, which connect a lot of the backbone, so to speak, of ICS systems, built-in control systems.
594080	603420	These can vary from security stations. A lot of police departments use these, especially in the United States and China.
604080	612680	Also, HVAC, my personal favorite protocol for control systems, which is Modbus. I'll tell you why in a moment.
612760	624260	So, there's a lot of these things that are exposed on the internet right now. And when I say, please hack me, the reason being is, even if you've got a modern system, yay!
624260	639480	And when it comes to the point of, hey, we have a patch, we need to update this, a lot of organizations won't do that very quickly, because they're afraid that it will lose that interoperability function.
639560	647880	And you don't want to do that in, I don't know, a water processing plant, and then knock out everybody's water for a short time.
648840	661680	So, one of the reasons why I like Modbus is, when it was created, it was created a long time ago, there is no real, really, any authentication or security.
662380	676560	And here, this protocol, because it was made open source, was adopted like crazy. As quickly adopted as Zoom was during the pandemic, basically, because it didn't cost any money to do so.
676560	683620	And it communicates between different types of equipment. It's got to be on the same network, though.
683780	691400	It will also transmit all sorts of data between a SCADA system and what's called a remote access terminal unit.
692020	697580	One of my other favorite features is the fact that it uses ladder logic, very much like a firewall.
697580	724440	And if any of you have seen a firewall with 2,000 plus different rules, you'll know that if part of that ladder logic is not done correctly, then your security settings in that firewall, just like the ladder logic, will actually moot and make the oncoming settings absolutely useless.
724440	733140	And it also has a slave to master architecture. So it's kind of old school.
733140	740620	Some of the things that you'll see using Modbus are PLCs, or programmable logic controllers, remote terminal units.
740620	750650	There are actually some modems, industrial modems that still use this, as well as parts of some systems with certain types of SMS.
750650	756890	And old school paging, which happens to be used in a lot of hospitals still.
757430	764450	And there is some safety equipment that is actually used with Modbus, but less and less nowadays.
764810	767970	So I'm going to start introducing you to some tools.
767970	783910	Because see, Modbus, although some versions of it can run over TCP, IP4, it's not, say, directly translatable, meaning everything is in hexadecimal code.
783910	798130	And also a lot of the regular IT-based hacker tools and scanners can't actually reach in really, really deep to see anything past, hey, this port's open.
798330	803270	So we have to use some additional tools to get what we need.
803270	816670	One of the things I like about the tools that I'll be showing you is the fact that they are absolutely legitimate tools that would not trigger, say, an antivirus alert or a potentially unwanted program.
816750	824730	On the contrary, they would be expected to be used as a technician or engineer in many of these different environments.
826810	834130	And all of the tools that I'll be showing are free as well if you want to get started.
834990	846890	So Chipkin has this wonderful Modbus scanner and what you do is once you can find something that says, hey, I got port 502 open and my banner says Modbus,
846890	857750	you go ahead and you plug in the IP address and it will then look even deeper and what it will show you is everything that's on its network behind that IP address.
857750	865010	So in this particular case, it isn't just one thing that's at the IP address, it's multiple things that are at the IP address.
865010	870330	And we'll also show you different things like functions, which are very important in Modbus.
871350	887250	Now, another thing that I like, this one again is free from plcdatatools.com, is once you find an IP address, it will go ahead and scan it and tell you which type is actually running.
887250	894270	And sometimes you can get even more information than just what you're seeing right now on your screen.
894270	912450	So in this case, I took an IP address and went ahead and scanned and found the firmware version, if it's running, obviously it's running, what the code is, which is a manufacturer code, and also picked up the fact that it is running something called Siemens S7.
912450	930110	And this is a proprietary protocol created by Siemens. If you've never heard of Siemens S7, this was the type that was running in the Iranian nuclear enrichment program when Spexnet hit it.
930110	935640	So a PLC programmable logic controller running Siemens S7.
935640	950780	And this is quite handy, too, because if you find things that have not been updated, which the vast majority have not been updated recently, you can also couple those with various exploits that are known and use them against them.
950780	968040	And another thing is because it's kind of slow to do a lot of these security updates and also although Siemens does a lot nowadays for ICS security, you can use some of the exploits on multiple firmware and model numbers.
968440	974560	So it's quite groovy to do this. Of course, only do it legally.
974560	989580	And to show you, for instance, I ran across this when I was helping with some of the NATO and European Union member state cyber warfare exercises in Brussels not too long ago.
989580	1001640	And what I found was this is an actual power station that I found using Shodan and when I went to look further with various other tools and of course with permission.
1002000	1016280	On that power plant and on the piece of Modbus hardware that they have, they also had, unfortunately, a remote access Trojan called Extreme RAT installed.
1016280	1022720	And you can see the banner that shows for this particular version of Extreme RAT.
1022720	1030440	So these things are already present and some power stations and water facilities and etc.
1030840	1042620	Now, another very common control protocol is BACnet and many of us have various different types of thermostats that are digital.
1042620	1047920	And this is just one way that you can use BACnet. It's used in a variety of different ways.
1048360	1057260	And if we take a look at this simple thermostat, we can break down what some of the digits actually mean.
1057980	1065600	And what we can do is flip that around and find some of these objects directly connected to the internet.
1065700	1071820	And BACnet does have some security features, but not that many.
1072660	1080040	So if I break down looking at census.io, these are the different types of BACnet fields that you can find,
1080040	1088800	which is quite groovy because if you want to, for instance, look at only certain firmware revisions,
1088800	1099960	or application software revisions, or model names, or vendor IDs, you can go ahead and zoom into these.
1099960	1107740	Because every vendor that uses BACnet, similar to Modbus, has to have a registered vendor ID.
1110380	1119500	So a groovy tool that I like to use with BACnet to look even further is from Contemporary Controls BACnet Discovery Tools.
1119500	1124660	And again, this is free. Unfortunately, most of these tools require Windows.
1124660	1128800	It's because there's a lot of Windows in control environments.
1128800	1136460	And you can install this groovy tool, and it does something similar to the Modbus scanner tool from Chipkin,
1136460	1142140	where it will show everything that's connected on the back end to the BACnet tool.
1142140	1148700	And it will also show, for instance, those object names, which is temperature.
1148700	1160950	And this is quite handy. Also, another thing to add is BACnet uses port 47808 and uses UDP predominantly.
1162360	1169080	So this is a very interesting protocol because it has gotten very, very big.
1169080	1172340	And it is used in all sorts of places.
1172340	1182660	And it's also had some noted security issues where it's taken time for the people behind Tritium to actually issue patches.
1183220	1186740	It is driven on Java, Java, Java.
1186740	1194540	And it could be in your elevator. It could be in a private or police security station.
1194940	1199600	It could be in your airport. Luckily, not many of us can fly, right?
1199600	1202820	It can be in a bit of everywhere.
1202940	1208980	And think about some of the mayhem that could be done if you were able to get into some of these different devices.
1210640	1214820	So it goes kind of by two names, Tritium or Fox Protocol.
1214960	1218580	And on Census, here's some of the things you can pick up on.
1218840	1224900	You can pick up on the application version, so you can go ahead and map that to any known exploits.
1224900	1233800	Or actually download the package yourself and then in your home lab, of course, with permission.
1234040	1238860	You can start fooling around with some of this stuff to see what else you can find.
1238860	1247200	You can do the host ID, which is quite handy in many different ways, the ID version, station name, etc.
1247520	1253700	And you can do a lot with this particular profile, excuse me, protocol.
1253700	1256620	So I like to have a lot of fun with Fox.
1257640	1262940	And one of the ways that you can look at some of these systems, with permission, of course,
1262940	1267940	is there is a free product for download. This will also run on Linux.
1268980	1278660	And what it does is it's open source, Java based, and it will basically connect to any embedded system that's running it.
1278660	1286920	And it tries to keep it vendor neutral, so it won't just be vendor A, B, and C, but not D.
1286920	1289480	It will basically connect to anything.
1289620	1297860	And even though there are some security settings, a lot of organizations have not actually set them up.
1297860	1300980	Yay! Please help me.
1301720	1307200	And in addition to that, I wanted to list a few more tools that might interest you.
1307200	1321640	And these are free. Chipkin is an organization that does a lot with technicians that deal with MacNet, Modbus, and a few other, we'll say, more industrial IoT and control systems.
1321640	1328620	And they've got a bevy of tools, which is fantastic, because they also do not security test their tools.
1328620	1336620	And you can weaponize them even further, if you would like, in a controlled manner, legally only.
1337460	1340000	I am not a lawyer. Remember that.
1341000	1347000	So, not long ago, I got this very interesting offer.
1347300	1353500	And one thing to remember about control systems, it's similar to what you may have heard of with cars.
1353560	1358100	A can bus is a can bus. Well, a control system is also a control system.
1358100	1361340	So even boats have these different things.
1361340	1369640	So when I talk about a boat, it's a really big boat, like liquid gas transport or cargo ships.
1370140	1379700	And there was an organization I was working with as an advisor that specialized in maritime security.
1380200	1383340	And they were trying to get the cyber part started.
1383340	1390880	The majority of the stuff they did was maritime intelligence, trying to find ships that go dark on purpose,
1390880	1397380	turning off their identification transponders so they can, I don't know, smuggle arms, people,
1397380	1403580	refuse to rescue people in the Mediterranean, if they're refugees, little things like that.
1403580	1414760	So we got an offer to hack a very, very large boat worth almost 200 million pounds.
1415240	1424080	And of course, me thinking, hmm, what are all of the lovely things that could go wrong with a very, very large boat?
1424480	1432620	So I made a few conditions. One of them was when we stole the boat, I got to wear an eyepatch.
1432620	1442720	Secondly, I got to say, once the boat was, I should say, liberated, I got to say, look at me, look at me.
1442720	1446460	I am the captain now, wearing my eyepatch.
1446460	1458200	And one of the things you have to remember about maritime is there's a lot of legacy stuff, just like industrial protection systems.
1458200	1470580	So fun fact, really big ships, their control mechanism is actually controlled via the civilian band of GPS.
1470580	1479800	And there are already known ways to exploit the civilian band. These are not tied to the military GPS control.
1479800	1492970	So the captain of a ship does control the ship. However, the majority of where the ship goes is actually controlled with the civilian GPS control system.
1493520	1508580	Another thing about maritime is a lot of them use different forms of something called Windows CE, which depending on the age of the ship and the last time it's been retrofitted,
1508580	1521800	it could be using versions that are based off of Windows XP, Windows 7, and only the newest and greatest stuff is going to be based off of Windows 10.
1521960	1534020	And one of the things that concerns many people about Windows CE is it is for embedded systems and it's in compact edition.
1534020	1544900	It doesn't have all the bells and whistles. So out of the box, it's not going to be logging everything that you would expect with professional edition.
1544920	1553060	It's also going to be slower to patch from Microsoft because they know that a lot of industrial systems use these.
1554540	1562240	And there's a bevy of wonderful mayhem that can be done with various different types of Windows CE.
1562240	1571040	Another thing to consider when we're talking about maritime is there are multiple entry and exit points on a large ship.
1571040	1575740	They have to keep in contact with a lot of different things.
1575740	1588200	There's something called the AIS system, two different forms that was mandated for larger ships to use to avoid hitting other ships, which is kind of nice.
1588200	1596480	But it also automatically has contacts with things like buoys, land stations, and other things.
1596480	1608160	And the AIS protocol... background, I've been building a few tools because I know that there are various security issues with that particular protocol.
1608160	1615320	And that's one of the ways that the ship in question was liberated.
1616240	1623640	Then you also have VSAT systems, UHF systems sometimes, and different other types of communications.
1624780	1632900	And one of the problems with these is, again, they might be legacy, but also the manufacturers are not in the security business.
1632900	1644620	So I can find, for instance, VSAT systems directly connected to the internet that's giving way too much information that could then be turned around and remotely controlled.
1644620	1647890	Because they're exploitable in many cases.
1648340	1659480	And even where there is security, several of the major manufacturers for some of these, including some of the 3G, 4G modems that are also in use with the larger ships,
1659480	1667910	is they'll use what's called known private keys, which equals, I tried to encrypt, but not really.
1668240	1671580	So even boats can be yours.
1671580	1676840	Now, many of us are not in Vegas. I'm in my tiny house in Amsterdam.
1677260	1683420	And we've done a lot of increased teleworking. Everything is remote now.
1683420	1686340	Here's a new hashtag, bring your own house.
1686340	1697440	Because the regular, say, office or power plant security is now in your living room or in your home office.
1697440	1705780	Many people have to share their home network with their partners, their Roomba, in my case, my partner,
1705780	1713360	children, or especially if you're stealing your neighbor's Wi-Fi to watch this presentation right now.
1713400	1717340	But when you have to do work, let's say you're doing sensitive stuff.
1717340	1724800	Let's say you are a process engineer that can't go into your place of work and have to do things more and more remote.
1724800	1728800	Guess what? Your infrastructure could be mine.
1729240	1734500	Because one of the problems is when things are rapidly set up, especially during a pandemic,
1734500	1739520	they might not be using the newest, greatest, most patched and updated things.
1740320	1744900	And another thing to consider is a lot of production and industrial systems,
1744900	1749680	the manufacturers will just pick one out of the air, Honeywell, for example,
1749680	1752500	they'll say, hey, we have all this equipment at your plant.
1752680	1759520	But to maintain the warranty on the service agreement, when you paid all this money for this plant,
1759520	1768180	we need a direct connection to constantly pull data and look at the infrastructure to make sure everything is working correctly.
1768640	1772800	By the way, we're going to use a really old version of BNC.
1772800	1779580	And all of our technicians use the same exact credentials to connect to all of our worldwide customers.
1779580	1784180	Yay! Otherwise known as a technician backdoor in these cases.
1784180	1787980	And if you say, hey, Honeywell, you know, that's not very secure.
1787980	1790580	And they're like, hey, you know what's even less secure?
1791300	1795060	Not having a warranty on all of your hardware.
1795260	1800060	And you're like, oh, yeah, we'll be using that old version of BNC.
1802080	1808120	So with this wonderful 2020 trying to kill this pandemic really hit,
1808120	1816240	I went ahead and scanned the Internet and took the top 10 countries with assets that say hello to the Internet.
1816440	1823400	And that's in the yellowish. I'm not sure how much you can see because of the big DEF CON logo.
1823400	1834060	And in the orangish bar, those are remote only access protocols that I was looking for and also certain versions.
1834060	1841600	Like older versions of SSH, FTP, remote desktop protocol, etc.
1841720	1849700	So what I found was, for instance, the United States has 47,500,000 assets.
1849700	1855860	Out of those assets, when I was looking only for known exploitable remote access vulnerabilities,
1856280	1864640	there were almost 12.5 million ones that I could find for the United States, which is not a great ratio.
1864680	1870400	However, I will say that some of the assets that I scanned, they can have multiple vulnerabilities.
1871360	1880080	Looking at between the U.S. and China, China has almost 8.5 million assets on the Internet that say hello,
1880080	1886640	but almost 5 million of those are remotable with no exploits and vulnerabilities in them.
1887300	1898880	The one country that did fairly well was actually the United Kingdom with their ratio between assets and exploitable vulnerabilities.
1898880	1905540	And one of the reasons for that was several years ago, they did something very fantastic.
1905540	1915580	They instituted this thing, a cyber program for anyone doing business with the U.K. and also critical infrastructure,
1915580	1924140	had to really take a look at their stuff and go ahead and pass an audit, in most cases a self-audit,
1924140	1928200	depending on your level of access with the government and also critical infrastructure.
1928200	1937540	And they were able to get a head start and so they actually are doing fairly well in comparison to the rest of the top tenors.
1938560	1947820	So another thing that we have to consider is because things are now industrial IoT devices or IoT devices,
1947820	1953940	this means that you can have a control system that is IoT enabled.
1953940	1959220	Now in this case, I like to take a look at Tesla stuff because I just do.
1959560	1970100	And you can actually use census.io, what I call census.org, to find various Tesla power walls.
1970100	1977820	And what's interesting about this is even though Tesla has some security, it's still single factor authentication.
1977820	1984160	There's still a web interface. The customer doesn't necessarily have to set up any real security.
1984160	1990120	So there's admin-admin kind of stuff, depending on the version of the software.
1990120	2000280	Tesla does not force down updates like Windows 10 or their cars, so there are a lot of old versions.
2000280	2005640	And what you can actually pull back is the configuration of the power walls.
2005780	2014920	Versions, timestamps, showing the last login, how long it's been up, if it's updating or not, and a bevy of other diagnostic information.
2015200	2027560	And what's unfortunate is if you're able to get into some of these systems, which you can, you can do more nefarious things.
2027560	2037320	Like imagine a region of power walls that suddenly all of their electricity got dumped on the energy grid. That would be a very bad thing.
2037320	2045600	Or if it was connected to some sort of crucial hardware, that would be a bad thing.
2045600	2054260	And in this particular case, this one was connected to a crane. Who doesn't want to own their own crane? Well, you can too.
2054260	2068920	So, you have to understand that if it's running a web server, I don't care if it's a power bank or a piece of industrial equipment or whatever, you can hack it like a web server. Remember that.
2069720	2077700	So, I do a lot in aviation. Sometimes that's good, sometimes they hate me.
2078580	2085560	So, either way, you know, so there are various ways to get into various things.
2085560	2090660	And one of the dangers that we have is a lot of remote desktop protocol.
2090660	2102940	You can actually buy exploited systems on the scary dark web from a dollar to ten dollars a piece if they have RDP.
2102940	2107400	Ten dollars is for typically U.S. military assets that are found.
2107400	2117840	In this case, this one belongs to Airbus, where luckily the admin happens to be logged in. I wonder what the password might be.
2118260	2124900	And the CN is actually the certificate, which I could match up to absolutely belonging to Airbus.
2125040	2134980	Another fun fact is depending on the aircraft, some Airbus aircraft actually use Windows CE in their aircraft. Yay!
2136360	2146440	So, I'm not sure you may or may not have heard much about Boeing other than some of their planes like to fall from the sky because they have software issues.
2146660	2160700	And starting last year, one of the things I did, and by the way, hi Boeing, I know you still want to put me in jail, was that I took a look around some of their infrastructure and found that it was incredibly bad.
2160700	2169980	For instance, at the time, Boeing.com and its websites didn't even use HTTPS or any encryption for their websites.
2169980	2172960	And this included login systems. Yay!
2173640	2182160	I was able to get into the R&D section of their flight control software, which also included the 737 MAX aircraft,
2182160	2194360	because to authenticate, I was using Firefox with no script running, and the website had a message, you are not running scripts, please press this button.
2194360	2198540	Press the button. I was in! How awesome is that?
2198660	2209440	There were, you know, six cross-site scripting vulnerabilities in the live in-production flight control aviation ID system. Woo-hoo-hoo! Right?
2209440	2218500	And the interesting thing about this is, if you can get into the flight control system or software, and you know what you are doing,
2219620	2225660	the process is, the technician will download what's needed for their aircraft, put it on a maintenance laptop,
2225660	2231360	that maintenance laptop then plugs into the aircraft itself, into the flight control system.
2231360	2241680	So imagine some of the mayhem that you could do, because Boeing had zero effort and zero knowledge in security.
2241980	2250760	Funny enough, they do sell cyber security services as consultants to the U.S. government.
2250760	2255340	However, I guess they never ate their own dog food and looked at their own stuff.
2255340	2261640	There were even hard-coded credentials in an older version of SAML that you could easily decode.
2261960	2269540	The response from Boeing was, you're a criminal, harassment, no bug bounty.
2270460	2278160	And it was only after my 59-page report went through and it got media attention after a disclosure period
2278160	2287060	that they were forced to start their first vulnerability disclosure program, which they said it was based on my report.
2287060	2293820	However, as far as I'm aware, Boeing still gives zero bug bounty awards.
2295100	2299360	So agriculture is nice, because I think all of us like to eat.
2299360	2307660	This is an instance where it's a control system that is now an industrial IoT system that is hanging on the Internet,
2307660	2313500	that has a web server that has never been security tested, with no authentication.
2313700	2321540	And it happens to be a European fish farm, a salmon farm to be exact.
2321540	2328760	And you can actually, in real life, press the buttons, and you can modify the operations of this.
2329920	2342920	So, we like water. Mexichem is actually a major bottled water provider, manufacturer, amongst other things, in Latin America and South Africa.
2342920	2345400	They do a lot of stuff.
2345480	2350400	So, I was looking around, because I get curious and bored.
2350400	2359700	And I was very quickly able to find, because they allowed LDAP to be exposed to the Internet,
2359700	2373860	I found 24 pages of assets from the IT side on the business level, all the way down to on the control level for their Windows-based SCADA systems.
2373860	2386740	And this was rather unfortunate, because some of the systems that I was able to find was this wonderful, what's called HMI, Human Machine Interface,
2386740	2391720	the same exact version that was vulnerable to some of the black energy attacks.
2391920	2396580	And you didn't actually have to log in, because it was never set up correctly.
2396580	2400920	I could access the drives that it was attached to.
2400920	2412420	I could import and delete recipes, which is actually the production recipe of what the machinery will be doing.
2412420	2417240	And I could just click as many buttons as I wanted to.
2417240	2428420	I could even export the administration data, all at the touch of my fingertips from my comfortable, small Amsterdam house.
2429200	2442740	And MexiChem also produces various different types of chemicals, some of which are more controlled, so that they don't fall in the hands of really bad people who want to make things go boom.
2443840	2450360	So another thing to consider is we're talking about IoT systems.
2450360	2453720	They can be anywhere.
2453760	2455960	They could be inside a hospital.
2455960	2457640	They could be on sensitive networks.
2457640	2462480	They could be at nuclear physics labs in Russia.
2463400	2471280	And they could also be inside control systems, so that you can actually, you know, use a printer.
2471280	2478960	And so I was able to have a bit of fun, again, being bored.
2478960	2480680	Don't ever let me get bored.
2480680	2489540	And use Census and a few other scanning tools to quickly find as many particular printers as possible.
2490160	2499940	It stemmed from the fact I was having a problem with my printer, and I downloaded the Brother admin tool, which covers almost all of their models.
2499940	2503800	And I noticed that it had never been security tested.
2503800	2511420	So I went ahead and flipped it around and turned it into a dual-use weaponized piece of admin tool.
2511640	2518580	And a lot of these printers will have web interfaces.
2518580	2525420	So I had a lot of fun with cross-site scripting, but most of my fun came from using the admin tool.
2525420	2540120	See, once you find one of these printers, it's not that difficult to find, you can use the free Brother admin tool, go ahead and put in the IP address, and then connect to somebody else's printer anywhere in the world.
2540120	2552260	You can see how much ink they have, you can even order, if it's set up in their printer, ink and toner supplies, because, hey, toner's worth more than platinum.
2552980	2559080	And you can also send files directly to the printer.
2559260	2571200	So I had a lot of fun with this, but unfortunately, Brother, like most printer manufacturers, do not have a vulnerability disclosure program.
2571200	2582660	Nor did they ever think that you could use this lovely free tool, available now to download, and you can weaponize it and really make printers' lives uncomfortable.
2583140	2596900	Bonus item, if it's a multifunctional printer that's more of the commercial variety that has a hard drive installed, and, say, Human Resources uses it as a scanner for different types of identification systems,
2596900	2606820	you can even access the hard drive where it saves those scans and get all sorts of personally identifiable information and health data just by using this tool.
2607320	2622520	So, I like space, and one of the things that is a bit problematic is, just like regular industrial systems, once you put something in space, it's expected to last a while.
2622520	2633400	There's even a space satellite that is in a very interesting orbit that is up there for over 50 years. There's a lot of legacy stuff.
2633800	2642180	Once you put something up there, it's not like you can go, hey, guess what? We've got this new type of encryption. You know what? It needs a chip to be able to process it.
2642180	2660900	We're just going to replace that chip in the satellite. That doesn't happen. And what we did last year was, in the United Kingdom, thanks to Oxford, who funded it, and De Montfort University, we held the first space hackathon at Royal Holloway University
2660900	2679740	to discuss these things with cleared PhD students who were given a lot of information by myself and others on some of the problems with current and new space assets, because they're really industrial IoT devices, and how to combat some of those problems.
2679740	2706880	Because encryption might not be there. I believe it was only the year before last that the FTC mandated that new space assets actually had to have the ability to use encryption. And we've seen some satellite systems being used in various cyber crime attacks and malware, because if you can put one of your hops and traceability on a satellite, it kind of makes it a bit hard to see who's actually behind different things.
2706880	2729840	So a lot of cool stuff came out of this hackathon. PhD students were absolutely fantastic and energetic. They listed a lot of very pertinent risks that we had to consider, such as the current UN space treaties do not cover private companies when it comes to warfare. It only covers nation states.
2729840	2755060	And the fact that some major players in the market, if you want to watch a great older movie, I believe it's called Moonraker, it's a James Bond movie, where a really rich guy with way too much money decides to go into space and then try to take over the world by going to war in space as a private company.
2755060	2770460	And so some of the risks listed were, for example, Elon Musk and his program, because anyone can turn evil and he already thinks that the pyramids were created by aliens.
2770460	2790620	So to give a brief example, you can actually find some of these systems. Now, there's different ways that you can find various space IoT systems. A lot of them you'll find are actually land systems that then communicate up, but those land systems, they can actually unfortunately be hacked.
2790620	2814340	In this particular case, I was able to find a relay connection up to a satellite. And I didn't want to give away too much information because they have not gotten back to me. I was able to find this particular device was running my favorite protocol Modbus with no authentication. It could give the device ID, function codes, and all sorts of information about it.
2814340	2842720	And by looking into various user manuals that are freely available, I was able to find that it was called a sunny string monitor that was attached to the satellite. And what it does is it looks for sun and goes ahead and opens a solar array on a satellite system to give a power or closes it down when there's nothing available or can move it around a little bit. So imagine what you could do with that.
2844500	2858760	Why is this kind of important? Last month, the United Nations Institute for Disarmament Research asked me to give a presentation, a closed dialogue session to permanent member states with other member states as observers.
2858760	2879460	And I brought up the fact that we need to be a lot more proactive. And although the United Nations in 2015 established that member states are responsible for securing their ICT cyberspace, that also includes space assets, that also includes industrial systems, etc.
2880920	2896420	They agreed to establish a computer emergency response team. And that's well and good. It's fantastic. It's much needed. But that also is very, very reactive and constantly you're putting out fires. So it's very difficult for you to be proactive.
2896420	2921500	So I brought up with them that I'm currently working with part of the European Union to actually establish their first proactive computer emergency protection team, a CEPT. And CERT step one, step two, to try to alleviate some of the burden and also try to catch things as quickly as possible before they become major incidents.
2921500	2950240	Now back in 2009, this is also another reason why it's kind of important, is I detected a cyber warfare attack, the second wave of such attacks caused by malware that the North Koreans created. One of the things they did was they leveraged higher speed bandwidth in Northern Europe to go ahead and have those various devices aim at the South Korean infrastructure and also part of the infrastructure of the United States.
2950240	2962820	So they attacked the South Korean version of the White House and also the U.S. version of the White House. They tried to affect the New York Stock Exchange and a lot of other very important places.
2962820	2983200	And because we were also monitoring in my shop ICS systems that had internet connectivity, we found that some of the Windows-based stuff actually was also affected and was trying to take down part of South Korea and the U.S.
2983200	3006200	So you can actually, unfortunately, weaponize with various types of malware, IT, IoT, and ICS as we keep seeing. But even in 2009, 11 years ago, we were seeing this type of stuff. So we need to take it much more seriously with the vendors as well as the critical infrastructure operators and get the tech community involved.
3006200	3022320	Because academia is great, government experts are fantastic, but it's us and you watching this that have that hacker mentality and can actually express it and find ways in and out that others can't.
3022320	3038360	So with that, I will be available on Discord for questions. Hopefully I get the right Discord channel. I wanted to give a huge shout out to Omar at Santo Omar and the Red Team Village for inviting me.
3038520	3048300	If you also would like to contact me about things that are going on in the Middle East, I believe my contact information is now on the Middle East Institute's website.
3048300	3063880	And feel free to contact me on Twitter and I take DMs. Just no weird pictures. No weird sexy time pictures. Let me stress that. I love pictures of cats. So thank you very, very much, Red Team Village. It is greatly appreciated.
3064480	3086880	Thank you so much for supporting us and for the great presentation. You're getting a lot of kudos in Discord. So talking about Discord, if you're joining us, you can see the link in the bottom of the screen. There's a link to a website where it has a lot of other information about speakers along with all the activities that are happening, of course, in DEF CON.
3086880	3099000	So with that said, we're going to go on a break for a few minutes and then the next presentation will be up in probably about 15 to 20 minutes. So thank you again, Chris. Great presentation. Have a nice one.
3099000	3100040	All right. Cheers.