[00:00.000 --> 00:04.640]  We were walking across the contest area, and we see this massive display.
[00:04.760 --> 00:08.580]  And it is so cool. I wanted to find out, what is this? Where are we right now?
[00:08.580 --> 00:14.220]  All right, great. So what we are doing here is we are running a CTF. This is the Red Alert ICS CTF.
[00:14.320 --> 00:17.720]  And this basically, we have a ton of toys here for people to come in,
[00:17.720 --> 00:23.700]  hack, play, and learn a lot of things. So this is a purely ICS-based CTF.
[00:23.780 --> 00:26.800]  And all the toys that you have here are all hackable.
[00:26.800 --> 00:30.280]  So this is all industrial control systems.
[00:30.280 --> 00:34.280]  So what type of attacks are needed here, like protocol fuzzing and things like that?
[00:34.560 --> 00:36.360]  A little bit of everything, actually.
[00:36.460 --> 00:40.580]  So if you're looking at probably the city right here, you can fuzz a blackout.
[00:40.580 --> 00:44.640]  You can have a man-in-the-middle attack, do an MITM, cause a blackout probably.
[00:44.760 --> 00:48.420]  Play around with the runway, cause some sort of an airport crash.
[00:48.840 --> 00:52.860]  And all of these things are all interactable. You can interact with all of these things.
[00:52.860 --> 00:53.500]  You actually can, yeah.
[00:53.500 --> 00:56.500]  And when you run the attack, lights will turn off or whatnot.
[00:57.000 --> 00:59.420]  What about some of the stuff over here?
[00:59.440 --> 01:02.400]  So what you see here, this one and this particular one,
[01:02.400 --> 01:06.540]  these are two units or simulations of units that you see at nuclear facilities.
[01:06.560 --> 01:09.940]  So this is something that's known as a spent fuel pool cooling system,
[01:09.940 --> 01:12.100]  which is used to cool nuclear fuel.
[01:13.480 --> 01:17.160]  And that one that you see right there is actually a centrifuge.
[01:17.440 --> 01:22.340]  So these are things that you would ideally find at nuclear facilities.
[01:22.340 --> 01:25.380]  Now you have a ton of teams here competing.
[01:25.380 --> 01:27.480]  How many teams do you have?
[01:27.940 --> 01:31.160]  Actually, we've got teams coming in and going, but we've got a good number so far.
[01:31.160 --> 01:32.320]  It's a good turnout.
[01:32.440 --> 01:36.320]  Now, it looks like you have a bunch of different manufacturers here.
[01:36.320 --> 01:42.920]  Are these published vulnerabilities that the teams are going out and finding,
[01:42.920 --> 01:47.480]  or are they actually having to reverse engineer and look at some of the protocols?
[01:47.480 --> 01:52.300]  Can you walk me through a standard attack path one of the teams might have to use?
[01:52.300 --> 01:54.440]  So it depends on the kind of challenge that you're doing.
[01:54.440 --> 01:56.940]  The different manufacturers that you see here,
[01:56.940 --> 02:01.720]  we just want to show that there are attacks possible and we are vendor neutral.
[02:01.720 --> 02:05.980]  So you can attack any of them because there are tons of protocols here as well.
[02:05.980 --> 02:08.660]  We've got the S7 complex that's proprietary to Siemens.
[02:08.660 --> 02:11.260]  We've got Modbus, DNP3, so on and so forth.
[02:11.540 --> 02:15.560]  And for a traditional attack, one of the challenges they would have to come in,
[02:15.560 --> 02:18.680]  we do give them the CVE IDs as well.
[02:18.840 --> 02:22.740]  And they can follow that, do a little bit of research, a little bit of digging in,
[02:22.740 --> 02:23.820]  and they're good to go.
[02:23.820 --> 02:27.840]  So let's go from start to finish because that's what I'm curious about.
[02:27.840 --> 02:30.320]  I want to sit down and actually hack away on this thing.
[02:30.640 --> 02:33.680]  Do I need special hardware or anything like that for this?
[02:33.680 --> 02:36.540]  So all you need to do is just come in with your laptops.
[02:36.700 --> 02:40.940]  If there are challenges that require specialized toolkits, we'll be providing them.
[02:41.040 --> 02:44.500]  We've got a ton of these toolkits, ton of these things here, ton of these toys.
[02:44.760 --> 02:46.480]  So what's in the standard toolkit?
[02:46.480 --> 02:48.460]  So let's take a look, shall we?
[02:48.680 --> 02:49.600]  Yeah, absolutely.
[02:52.320 --> 02:55.380]  So this is one of those toolkits that we give to the players.
[02:55.480 --> 03:00.200]  So we've got a hack RF to play with the radio frequency kind of attacks.
[03:00.200 --> 03:03.980]  The crane that you see there is controlled by radio frequency, actually.
[03:03.980 --> 03:05.440]  Yeah, let's go check out this crane.
[03:05.440 --> 03:09.540]  This is one of my favorite ones I've come across so far.
[03:09.540 --> 03:13.480]  So if you send an attack in here, it will actually flip it around and move.
[03:13.480 --> 03:16.600]  So the players will actually be able to take control of the crane.
[03:16.600 --> 03:18.960]  I'm worried this guy might be a little too close,
[03:18.960 --> 03:21.520]  might take out a laptop in the process.
[03:21.600 --> 03:23.460]  So let's go back over to the kit.
[03:23.460 --> 03:24.840]  So you have a hack RF.
[03:24.900 --> 03:25.520]  Right.
[03:25.900 --> 03:27.780]  What else is in here? What's the red alert?
[03:27.780 --> 03:31.440]  This is actually an RTL-SDR that works similar to a hack RF.
[03:31.440 --> 03:36.080]  We've got a Raspberry Pi here for one of the other attacks that we're required to do.
[03:36.260 --> 03:39.080]  And we've got a tiny little Team Z board here as well.
[03:39.080 --> 03:40.800]  Oh yeah, to simulate a keyboard.
[03:41.000 --> 03:45.940]  Yeah, so a lot of things going on, a ton of challenges. That's what it is.
[03:45.940 --> 03:47.520]  This is so cool.
[03:47.520 --> 03:51.280]  What is the coolest thing you've seen a team do so far here?
[03:52.040 --> 03:55.040]  Yesterday, one of the teams were actually successful in causing a blackout.
[03:55.040 --> 03:58.220]  So they were able to cause a citywide blackout, take down the city.
[03:58.260 --> 04:01.220]  That's so cool. Can you give me an idea of what they did?
[04:01.220 --> 04:06.300]  Like, was it they had to flip a bit? Was it that they just DOSed it?
[04:06.400 --> 04:11.120]  They were actually able to... they had to remotely connect to the HMI there, the controls.
[04:11.280 --> 04:13.760]  So the HMI actually deals with the PLC.
[04:13.840 --> 04:15.260]  HMI, Human Machine Interface.
[04:15.900 --> 04:19.940]  And the PLC is there that actually controls this particular portion of the city.
[04:19.960 --> 04:23.280]  And they were able to just rig their way in and take control of it.
[04:23.280 --> 04:28.020]  And after they get into the PLC, did they have to inject new functionality?
[04:28.020 --> 04:29.900]  Or was this functionality already there?
[04:29.900 --> 04:31.840]  Once they got in, they could just turn it off.
[04:31.900 --> 04:34.240]  For this particular one, this was already there.
[04:34.560 --> 04:37.720]  To get there is probably the challenging part.
[04:37.720 --> 04:40.460]  And we've just got one team so far that has managed to do it.
[04:40.460 --> 04:42.700]  And that's not just guessing a password or something like that.
[04:42.700 --> 04:44.740]  No, it's not. It's a lot more than that.
[04:44.740 --> 04:47.060]  Can you walk me through a little bit of that step?
[04:48.060 --> 04:52.720]  Actually, it goes down to the protocol level of information that you have.
[04:52.860 --> 04:56.740]  So it could be... I wouldn't want to say a lot of things about it.
[04:56.740 --> 04:58.220]  Because there are people still playing.
[04:58.220 --> 04:59.080]  Yeah, absolutely.
[04:59.080 --> 05:00.220]  Give out any of the spoilers.
[05:00.440 --> 05:03.340]  But everything requires a different approach.
[05:03.340 --> 05:05.600]  A lot of digging in that's required.
[05:05.700 --> 05:09.720]  But for each of the challenges, we've given them ample information, ample description.
[05:09.780 --> 05:13.820]  So if they do a little bit of digging in, they'd be able to get their way through it.
[05:13.820 --> 05:16.600]  Is this only for experts?
[05:16.660 --> 05:19.020]  Or can you be a beginner and plug in and start figuring it out?
[05:19.020 --> 05:20.980]  You can be a beginner and just come in as well.
[05:20.980 --> 05:22.840]  So the point here is to have some fun, right?
[05:22.840 --> 05:23.220]  Yep.
[05:23.220 --> 05:27.020]  Go back with probably a lot more than you came with.
[05:27.100 --> 05:28.140]  So learn a little bit.
[05:28.140 --> 05:30.960]  So if you're a beginner, if you're an absolute beginner, you can still come in.
[05:31.320 --> 05:34.320]  Try out a few challenges, probably the easier ones.
[05:34.520 --> 05:35.740]  And then, yeah.
[05:35.780 --> 05:36.400]  Excellent.
[05:36.400 --> 05:37.700]  Hey, thank you so much.
[05:37.720 --> 05:38.320]  Thanks.
[05:38.320 --> 05:42.180]  Is there somewhere online where the team can either interact with us
[05:42.180 --> 05:46.740]  or even after the contest, is there a place where they can learn more about these techniques?
[05:47.080 --> 05:49.640]  We actually do a lot of these things.
[05:50.000 --> 05:55.040]  Last DEF CON as well, when it was completely online, we had the same kind of setup.
[05:55.040 --> 05:57.840]  We had similar setups, similar challenges, all online.
[05:57.840 --> 06:00.780]  And this is what we're showing on the screen here.
[06:00.820 --> 06:06.000]  So DEF CON 29 had the challenges running here, actually.
[06:06.480 --> 06:07.240]  Excellent.
[06:09.300 --> 06:11.100]  Oh, that is so cool.
[06:11.100 --> 06:13.120]  This has to be one of the coolest displays.
[06:13.120 --> 06:13.420]  Thank you.
[06:13.420 --> 06:13.720]  Thank you.
[06:13.720 --> 06:15.620]  Thank you so much for sharing.
[06:15.680 --> 06:17.760]  Thank you for watching.
[06:17.760 --> 06:20.080]  And as always, hack on!