Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/317 Thanks!
Hello, Congress, nice to see you
again, and
as usual, we only four months of
the stage left him and I know there are
a lot of guys who hope to
make this talk.
So if it's
OK, please give handouts
to all the strange golf team.
Traditionally, we start our talk
from the bottom up when we show
how many ICSE connected
to the Internet, but this time
we will skip this because
of John John, who builds
a showdown this year,
publish it excellent resource, iciest
map dot showdown dot I or
and you can download
and check a lot of different.
I see a system connected
to the Internet and because John
say to us we say
to John because he is excellent
and thank you John again.
But last year
after our talk, we receive a lot
of question about this
picture, about a different type
of connected system.
And people said, OK, this is
not iciest.
This is some kind of honeypots
maybe or it's not
serious. It's very small devices
and it's not serious
at all.
So we decide to go deeper
and check first one
ipca cheap ipca
chip is a
system on the cheap.
Which around the real operating system
of TCP, IP, Web server
and security security protocols
will allow it.
So we start to Google
starts from just the system name
we found with it have built in
CGI server.
We've
some built in function.
And during this assessment we found
interesting application of
this cheap, its solar
system.
What is Saulo work?
So it's
kind of smart grids, the small
greed, the small scale that we can
install in your house to
manage to plant,
which you can install on the roof
of your house.
But it generates
about
seven gigawatts of
output and at the moment
about one million inverters
connected to this system.
Interesting, because this system
connects to some kind of the cloud.
You can use it to find
installations.
Novia showdown on via a boring
network. Scannon just visiting
portal and check it.
So this is your money
and this is different location
of installed systems.
And also it's have some kind
of, I don't know,
social networking
features. So you can take a picture
of your house, of your preplanned
save your friend.
They say, oh, I am saving the
energy generated from my
house, personal power
plant.
But this all about, you know, funny
stuff. Let's go more
deeper into technical side of this
system.
OK, it doesn't work.
It's OK to get things well,
first.
Interesting thing, it's firmware.
It's kind of software that gives you
a lot of information.
How device works,
obviously.
I think, you know what it what it is.
And most interesting things
in firmware.
It's configuration scripts,
file system structure and so on
and fiercly to find
out through, for example, Google
Docs.
In simple case, you can use
just Unix strings
and grep, for example, in
this case to grab a title.
And as a result, through
Google, you can find a
lot of sollar log
devices connected to the Internet.
It's about
sixty five thousand.
Of course, all of them are connected to
Internet and accessed by Google.
Well, and let's take
a look on the authentication
page of the Solar Lock
Observer.
Simply, it's pure authentication
scheme, just only using
password, old page
using password authentication.
But if you know,
appropriate full Eurail to
download the system back up,
it's not required
password simply download.
Well, just simply download system,
pick up file and what's
most interesting thinking backup, it's,
of course, username and password.
Well, uh, on
this picture, you can see
simple encryption and all things
that you need to decrypt.
Another one, a typical process for Fenrir
and devices. It's a firmware update.
Well, uh, following Solaire log
update, Protus, you can see that
it's highlighted part on the screenshot.
You can give
the full path to see
if you know what file
system structure. Simply it's
those operations system like.
Yes, sure.
And you can override system files,
configuration files and so on.
So we fix it,
it was fixative collaboration
with
computer emergency response team
of German government
and the Farncombe.
But, you know, because
this is just a platform,
I guess what were
a lot of different producer
manufacturers, vendors who use this
platform to build our devices.
So I'm not sure what all this simple
box was to fix it.
It was funny story, but, you know,
we forgot about it.
Already forgot. But one day I saw
this Twitter
and I understood that
maybe solar panels are
not so readily available
and maybe we should
use our power, our knowledge
to save some.
So we decide to understand
a bit more about all these green energy.
And if you want to get
new knowledge, what you should do, you
should go to Germany, to Gomberg,
to Congress Center, but
not to Congress, but to
win Tanager.
No SÃ¶lvi Vitale
visit to visit this
exhibition and got a lot
of information on different wind and
solar equipment and
start from the simple stuff.
Show that again, we found
a very common system.
Sonnyboy box, as you can see,
simple shodan search.
Give us about 80000
of devices connected
to the Internet.
Alex.
Well, first notice about
Sonny Warbucks default password
was three years ago, in full disclosure
the least, it was default
Esmay uppercase password, its first
type of password.
OK, so we decided to
read the first manual,
of course, and we noticed that
the user name
installer has different,
as previously mentioned,
password. It's Esmay, uh,
lowercase.
OK, so we decided to go deeper
to read the first manual and
we find out that it has
more user and installer
groups of names and to different
passwords. It's only contains
numbers.
OK, so what the real
was a true password to the final, the
final and to
real researchers, real hackers trying
to give it to your Biogen's.
And we discovered
interesting things in firmware that
it contains not only user
and installer passwords, it has also
a service center, developer
system account.
And also it has is an interesting
string's interesting password
mode, like hardcoded passwords.
So we can see what Botsford
is, because it's hard,
very hard,
but what we can say
with a quick Google
search for these devices are
all by analyzing all four responses,
because on the response, you can find
amount of energy generated
by this device.
I want you to find about
100 of megawatts
of energy.
If we compare to different
generators, like
hydroelectric station is like
small LP in
hydroelectric station
in Austria.
So this amount
of energy generated by Solar Rock
can be found it via Google.
But if we show them and different
types of Fontanez Canyon,
you can find 20
times more energy
if you need the power.
But it's all about some.
Let's talk about wind because you
know all this big
stuff, I think it's killing the
wind.
So
simple stuff against very simple stuff.
I found very old
storage short on search,
which helps me to find about
300 of systems,
namely the system is Nordic
Nordiques InSitu.
Just such a quick search
of vulnerabilities as we system
on this system demonstrate with
this system, we have a long story of
their abilities starting from
2010
and the finish in 2013.
What's interesting, I think
those vulnerability, not budget.
Why?
Because
if we check the response of the
service, we can find with this
server works on
the
system which
are already duplicated.
So it's a version number three
of observer of Web server
objective observer current
version and number nine.
It also it works on the very, very old
version of Skardu.
Simple CBS details
search demonstrated with since
2002.
People publish information
about vulnerabilities in these Web
service, so I
don't want to talk about
vulnerabilities in my
reel to reel recorder.
It's it's even not
script kiddy stuff.
But if you want to understand
how it's OK in real lives,
I took two pictures
from Google, one pictures,
Nordiques, Winter
and Cerca needs management interface
only for Google. It's not real.
So how much energy
we can get in this case?
About one gigawatt.
So if we compare with different
generation, it's absolutely the
same like.
Help me.
It's a Stuxnet
was in Iran
on Bushehr
nuclear plant.
The same, so
anybody who knows how to
read, I want
to read at Wednesday's Kenwright
on Stuxnet now.
So just to finish
this part of our talk
by simple, very simple
vulnerabilities, we found about
eight gigawatts of instant
power energy, if we compare
it with the
most famous, most powerful
hydro electric station.
It's number five on the list.
It took two days
after the work,
so let's continue our saga
story
and talk a little bit about
our famous founder,
what the seemingly
similarities between Large
Hadron Collider and
of, for instance, gas
pipe.
It's a sematic venky
open architecture.
It's very popular
and quite new
system, but it's also
have new Web server.
I think if you was on our
previous talk last year, you can
remind me picture.
This is history of banks
in Apache Web server.
Why are we talking about it?
Because if you go going to write
your own Web server, please carefully
review all vulnerabilities
discovered
during when our
guys own Web servers.
Just to remind the history of different
Fyne vulnerabilities.
This was discovered several
years ago. If you
sent incorrectly Chichibu request to a
Web server without HTP body,
it can crash
about it.
This was discovered in 2000,
in the year 2000 in Internet Information
Server and you can use
five traversal to read write
different folders.
I think you can remind responsibilities
was related to one
worm and the.
Another one related to incorrect
content leam, so you can put
the amount of data but say what is
very short so you can overwrite
memory of I am talking about
this old stuff now
because I want to show you a small.
Movie just second.
Here it is.
So let's go
around Shervin Ciresi and
the debugger
to see all the protests
and to submit a very complex
request for
thousands of a
lot of a
what do you get?
We will get a break
with typical 31, 41,
41, 41, I think is
also
but if you will send us
OK, if you send more complex
request, what we get
calculator, I think Scotter.
Scudder must have ability to calculate
something.
Are for sure it was fix it
now.
We don't disclose zairo days,
but I like this
comment. So if
so, an update to version three point
twelve of Sematic CCI.
We can stop terrorists
who clearly evil genius
Xitian that Large Hadron Collider
and create a black hole
that will show up the world.
So we save the universe.
Let's take a
time machine and come to
the past, to the Miami
Atmosphere Conference, it's a
conference dedicated to
the safety and security
and what we show
on this conference, this slide,
I think you also can reminded,
demonstrate overreach.
Each of the libraries included
in Venky HMG, so
you can see what most of the
time I was compiling before the Stuxnet
and the on this conference, we
demonstrate how to find zero
day using find.
So
you just give us a list of the
files in software
and try to find the most old one.
And we we found open
this cell compiled into two
thousand seven and we
say the Siemens guys, let's update
your software.
ATV's was a mistake.
Why?
Because old version
of open SSL
does not
have Heartbleed vulnerability.
And after update
we get Heartbleed vulnerability
and the Large Hadron
Collider get Heartbleed.
Just for to demonstrate housework,
nothing special, but I'm
sorry.
The.
So we're running standard
Heartbleed and little,
which require memory from the
SSL server and trying to
authenticate with
username and password.
And get username and password
from the server because of Heartbleed
vulnerability.
It's base64
encoded, so we need to decode it.
And let's try again
with stolen username and
password.
It should work.
Here it is, so
simple vulnerability, everybody knows
about it, not so simple, but white now.
Yes. And
what they want, why a show
with them want to highlight
one important thing.
People can ask me, OK,
first you say, please don't
write your own Web server, but
after you said please don't
use third party components, what
to do?
I do not have answer.
But anyway, if you decide
to write on a server
or to use felt party companions,
please care about security if
you include, I don't know, open SSL
or bust shell
in your software, please updated
to check it. Please care about
it.
Well, so
another one vulnerability
to its long story
about the scale injection that was first
published one and a half years ago.
It was simply a serial injection,
uh, via Ruggeri
scale comments and specific
letters, secret injection,
specific vectors.
Well, what does it mean?
I don't know.
Okay, well, and
Cisco give us excellent decision
how to avoid this vulnerability.
Simply deny connections
to Web server bots
while it works.
Sometimes it works, but scatter company
and industrial control system
components. It's it
has a lot of protocols, communication
processes, depends of functionality.
And in this case, you see,
Sarah has not only
seen client, it also has
a sick plant.
Well, it works, uh,
on, uh, PC protocol
and, well, firstly,
when we try to authenticate, we
noticed a
clear text messages.
Uh, as you can see, it's user
year and next passwords
here. Well, it's
clear text, but,
uh.
We spent a few minutes
and after we noticed
that our data
goes to see Sarah
on the different board and
it's not clear text, well,
where is password's?
It's now clear
text. So maybe it looks
like some encryption.
Yeah, it's kind of a creation,
and I think everybody who
saw our previous stock already
know encryption key.
You're right, this is my encryption key,
but this was fix it.
And it was fix
it with new encryption key.
And first of
you, who gets you
a little encryption key, give
lead price or free beer from
stranger after you.
I think now
it's lead.
Good guess, but not right
now.
Excellent answer, but it's where
he leads
and.
OK, first off, you
say it's 32
Newquay and something that's
come on after
the talk on the stage, I heard a lot of
Southerner's, but
this is Leeth encryption
key.
But it was fix it again
without a check yet.
And another one interesting story,
it's about cookies.
And once upon a time we
try and to discover interesting things,
some ducation on the sematic
Seamon Sematic Builtin controller.
And we discovered it interesting
seeing that cookies
contains constant part and
to change a double
big part of the cookie.
OK, so we decided to go
deeper and to understand what's going on
with cookies.
And, uh, well, it's
the first big, biggest party of
the cookies. It's empty.
Five of some.
Well you.
Well, so what about its value
after spending some time to
reverse engineering A,
B or C control or from where
we found out that five
it's uh, from the cookie.
Twenty six bytes of all the cookie and
sixteen bytes of the cigaret
and plus two bits of no.
Well what's about secret.
Uh, usually secret generates
its typical practical practical approach.
Secret your after uh p.l.c.
start and it uses uh
sparingly virion.
She was uh little bit harder
than, uh standard uh c
beer and regenerator.
And uh, so it was, uh,
two bytes. William Well,
it's time to brute force, uh, as you can
see. But it's too much, uh,
Williams uh, to brute force because
you'll see so tender.
And what about see it, see it
very often, it's also the typical
approach, it's very often depends on time
value. And by our practical,
uh, research, it was, uh,
Bill seastar time plus some constant
value. You well, uh, constant
will using, uh, current time.
Well, next step was how to obtain
p.l.c., uh, start time.
It's obvious that we can use
values from observer page its
current value and uptime,
uptime, we can get through
a simple request.
It's time for DEMA and
as a result.
Once again,
just a second.
OK, it started, but I'm not
a master of moviemaker,
I should improve my skills.
Well, let's imagine that you're connected
to entire network.
Let's ensure that you're on
the network.
Uh, one, for
example. And first of all, we
trying to find out devices that
support protocol.
We find, uh, controller
and you can see that it
has a different than attacker side
IP address.
OK, let's ensure that it's not
accessible.
Next step.
It's using Python script to
change, uh, network
settings on Bilski controller
using profanity, uh,
special, specially crafted network w
well we provide to Python script,
uh, destination McAdoo's our source
McElroy's.
Well it's a simple way
to get your McAdoo's of your network
interface and
uh.
Provide network settings
for new network, on
network settings, on p.l.c.
controller, simply its IP address,
network mask and
target we.
Don't bite the first, too.
Yeah, well, we got
we received Eynesbury, it's cool.
Well, let's ensure again that
network settings changed on
Bilski controller.
Well, we bring
it means that we bring up
your controller to our local
subnet, it's accessible.
Great. So the next step,
let's imagine it's one of the dependancy
of vulnerability.
That let's imagine that, uh, real,
uh, user, uh, for example,
uh, Scott engineer,
uh, going through browser
to the controller and,
uh, simply indicated using,
uh, login and username.
Real again and username.
OK, who gets what the buzz word,
stars, stars, stars?
Well, you can see that controller
or controller on the
operating mode run.
Next.
So we see that cookies start
on browser.
Well, it's the next very
important step from a
Tiger site. It get
very important values from controller.
It's strange.
And the final step is
to run the Python script
to brute force cookie.
And we provide to the script as it,
uh, to.
Uh, depends
on the how many times s indicated
user on the controller it
can took from a few seconds
to some minutes.
Well, let's prepare let's clear
our caucus.
Every scenario on this video.
Well, we clear cookies and prepare
to give
to put a new cookie values, it's still
brute force and.
It's only one cookie
with the name Siemens, the decision and
big value that.
We will give a little bit later,
OK?
It's a typical scenario.
No industrial process at this
moment because people see
brute force and brute force force.
Yep, yep.
We found we found two.
Real cookie values, and I like Sigue
to send Protus
and the final it's copy paste
cookie value to a broader.
And reload the page
and to ensure that we are a
syndicated user administrator
and stop Velzy, stop Sombrotto.
Well, as you can see,
we don't need any username,
password and so on,
only connected to our subnetwork
controller.
What I want to highlight in this
vulnerability for sure,
it was fix it,
but here, two points.
First point, we found it because
of Congress, because all
on a twenty nine
free we participate
workshop. And
one guy who was on this workshop say,
OK, did you check the cookies?
I said, no, I don't believe
it. On small size, small device
authentication process, I realized
correctly. So after this idea of a start
working and finding this vulnerabilities
already fix, it was OK.
And second, think I want to highlight
its communication about
S&P communication started
from
January.
We have a long story
of communication. We have segments about
S&P hardcoded community
and we say, OK, this is not
an issue.
But in the end we say, OK, this is
an issue because we have this
vulnerability. You can give us a cookie.
So what I want to highlight,
if you make something, please
care about Bisek.
Think everybody vote on S&P
V three and don't don't use
hardcoded password.
Why to do it on the new system
like p.l.c.
one hundred five hundred thousand
five hundred.
But please don't
think that we
hate simians or something.
We speak in a world of
about humans because now
we in Germany, if we will be in
French, we will speak about four of
Schneider Electric.
If we will be in the US, we will speak
about Honeywell and, you know,
really happy day
in my life. When we get answers,
what vulnerabilities?
Vorst fixes its emails
from Siemens products.
And I can I
want to
thanks Siemens, all
the Siemens team and especially
Siemens product short for
hard job.
And please give them
your hands.
And guys, if you hear
and I know you hear, please catch me
after the talk, I have some news for you.
So this is our
traditional slightly off number of
Wallner abilities.
It in different platform
for us to year.
Simeus was the first.
But now you can say what Schnieder
Electrics because of it, mostly
because of acquiring of Invensys
heavy first place on the discovery
and not budget vulnerabilities.
And many people asking
us how you
what is your approach to discover so
many vulnerabilities?
I have to answer because we are too lazy.
This year we decided to
not discover vulnerabilities by ourself.
We built big test bed
Real Scholder Posse's
Irkay use system connected to
to a railroad and say to everybody,
guys, you can connect here
and hack it.
If you can make disaster,
you will get price.
If you will find zero day, it's
your zero day, but please
follow responsible disclosure.
So for two days
of positive, how these foreign
guys and the
girls found
more than 10 zero days
in India solved
in sematic
in ABC or
ABC, doesn't use Taiwan
until like a Noname.
So now Responsable just called human
progress waiting for the fixes.
So we're talking about
vulnerabilities.
And I want to talk about myself
sometimes, sometimes not so hard
science.
So in this case, we
submitted about
10 vulnerabilities and vulnerabilities to
vendor
and get response that Overlander
ability is fix it.
But in advisory, we found only
two, I
don't know, show we trust
this vendor. Maybe not.
But what I want to highlight
sometimes is very bad idea to
create a false
feeling of safety, because
if somebody read this advisory,
he can say, OK, ECV, six
point two is not very important.
I will not update this system,
but.
In reality, several
remote code execution
without an education is
here, so it's better
to speak the truth.
PostScript on where
one postscript.
Anybody here
know the difference between picture
one and picture two?
OK, different question, what
is. One or two
green light or yellow, white?
Somebody.
Green, OK, first Kosei
Green have special
price, I will say why.
Let's talk about functional
safety because you know, now we're
speaking about vulnerability, OK, if you
root who but when you
are talking with industrial people,
wassa and so on,
so, so forth, OK, you root
by. I have a special
system. I myself have special
protection system which does not allow
all disaster.
I want to demonstrate how very simple
vulnerabilities can lead
to very serious problems.
First, superheavy trains.
I think I know what a superpower trains
its very big trains with
several locomotives which
sometimes synchronize engines
by the radio channel.
One on the beginning, one in
the middle hours, and
and they synchronized engines
are in brakes,
we are radio channel why
we do it because we
need run
synchronously.
So let's imagine
what somebody around
ran a small radio jammer.
And it's where you want device
with several locomotives
and way
around us that starts run asynchronously
and train just.
Goals in different dimensions,
so
also it's a very interesting
answer, I typically you can get it
if you speak with industrial people
about Sue for
anybody here, know what is.
Safety. Integrity requires things.
A lot of people. Yeah.
So when you say, OK,
you have a problem, we have so far
we don't care what to sue for
its safety, integrity, whether
it's demonstrate a probability
of failure
for different process, it can
be the probability of error on demand.
When you ask in system,
if it's continuous process is
probability of failure per hour,
you can see what this is a very big
number. So, so, so the probability
of a very small number.
So if this system
really have sue for it
should not break error.
But if you get
a root on this system in 15
minutes, does it still
have Sue for
my answer?
No.
And I have a very interesting discussion
with a developer of
one system.
After a demonstration like
I can,
our team can change the road
and the switch
on CCU for certified
system.
He said, you know, this
is not my system.
I solve.
You applaud
the wrong frame where you are
routed and I both wrong from where
I am now. This is no system.
Before you wrote it, it was my system.
You know, it's like with people
sometimes in a small car,
in, you know,
special kind
of mindset, you can do
very bad things.
But this is not you and this
is not my system anymore.
So I think now we know
the difference.
A green light is bad.
Why? Because of green
light rain if you go on
high speed to
the Kouf.
And sometimes
it can be very bad.
On yellow, white.
It will drop speed and
move more slowly
and reopen
Cryptome.
I think a lot of people here know
what is network for convergence.
So especially in telecom
environment, when different
type of communication protocol goes
to the same basic like
IP, the six or IP before,
and PSTN goes to IP
and mobile goes for 3G
and so on, so on. So all different
systems connected together using the same
same basic.
But what we see at moment, it's
abberation technology convergence
we see with more than a smart grid
use.
Protocols and technologies
from ICS
sometimes make mobile
connections, sometimes billing and
payment to understand
how many power you generate
and so on, so on cloud technology.
So we see like different technologies
come together
to maybe make our
world better.
And for last year we heard a lot
of talk on different conferences.
For instance, on Birckhead, we spoke
about how to hack ATMs
in Park City in Tokyo.
We spoke about how to get through
to this mess.
And also we
spoke about the Great Train
Cyber Robbery on Facebook.
But you know all this
about.
About the same things
we cannot say at the moment.
Why? Because we don't know yet,
but what we know
our world now, it's very
complex and very gentle
things.
So let's
invest. Let's use our power
to keep it safe,
maybe not safe because it's too hard,
but at least peaceful.
Thank you.
Thank you. Thank you very much.
And Alexander, now for the questions,
could you please line up at the
microphones here in the middle
of the room?
And as
I can see, we have no questions from
the Internet, nothing from ILEC.
Thank you. Try, Loida, for monitoring the
Internet. Our signal angel.
How about questions from the
room?
Yes, microphone number one,
please.
Hello, my name is because I'm working
as a software developer
in Raviv Technologies.
And I would just like to add concerning
the level for safety
level.
Yes. Which is against
failure.
Yes.
Everything which is currently
in railway technology implemented
is against failer,
not against sabotage.
If if it would, maybe
we can talk later about.
I understand.
Yeah, you're absolutely right there.
Safety. You don't
think about the people.
If if if you know how
ravier technology works, you can support
everything from exer Countach to point
machines. You can crash any train.
Yes. Because at least to go into
the hardware and disconnect the wires
here. So it's about detecting
fateless, not about being
able to prevent sabotage, not get
there working on it. But that's another.
Yeah, yeah, yeah.
I understood you.
Absolutely. Because, you know, which
is why I when I talk to you, for
people who work in the industrial
system with industrial system, I prefer
the use, not the safety or
security or in the information
security. I prefer to use term
cybersecurity.
It's like a combination of
safety, industry, security
and information security.
And you can demonstrate how information
security can broad
security features, safety features.
Put it on the.
So just
let's let's let's talk afterwards, OK?
Thank you. Yeah,
OK, thank you.
Any more questions from the room?
Nobody lined up at the microphone.
Well, this is the time to say
thank you very much again.
Thank you to Alex Undersaturated.