Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/426 Thanks!
Thank you and welcome to
the master class on Hacken Chemical
Processes.
So I started doing security
before Stuxnet and before it became.
So I'm a true fan and not a follower.
So it did not take me a long time
to realize that actually
control system consists of two parts of
the control system itself and
of the physical process.
And if you attended a talk of a
scale strange or a red leveret,
you already know how to find and exploit
vulnerabilities in this control system
and supporting that infrastructure.
But because of the physical component,
this industrial control systems are also
called cyber physical system.
And in contrast to the traditional I.T.
security, the goal of the attacker is
nothing like data or information.
But to get the physical system
in a state designed by the attacker like
suboptimal operations or
to make the system perform in action
desired by the attacker, like spin the
centrifuge until it breaks.
So while the attacker clearly needs
to hack his way in to obtain controls,
I was wondering whether the processes
themselves have vulnerabilities which
attacker can leverage to achieve his
goals.
So like studying the security
of the of the physical processes
became a research topic.
While one of the challenges
of explaining the need of cyber physical
security is the absence of
public disclosures about bad things
happening to the physical systems
and
what actually goes into the dark
eventually comes into the light.
So the DEC was full of
like big disclosures about
the accidents leading to the physical
damage.
So well done.
Sound Santa, thank you very much.
So the second biggest challenge
of conducting cyber physical security
is that you need to actually test bed
of the of the process under
investigation. And it is not
only extremely expensive to build such a
process, it also requires a lot of
specialized knowledge and the presence
of the specialist and also a lot of
regulatory permissions for conducting
unsafe experiments.
And on top of that, you need even more
money to rebuild your test bed if
you destroy it in the result of
successful attack.
So
so therefore, typically such research
should be conducted on the simulation
models.
So
at the beginning I try to
build the model myself.
But quickly I have realized that it takes
a lot of lines of code, a lot of
specialized knowledge, and I am too lazy
to do that.
So I decided to look around.
Is Annison and actually Zevo?
There were a few models, not many, but
few.
So for my research,
yeah. And the problem also that
building simulation model is extremely
expensive as well as as expenses
building physical systems.
So most of the simulation models are
proprietary and not for public use.
So the two models
which are selected for my research for
models of chemical plants.
So why did they decided to study chemical
processes or chemical plants?
Chemical processes are large.
They have a lot of complex interactions
and interdependencies.
And it also
they usually model a lot of disturbances
so which represent a wide variety
of different dynamic behaviors.
So it's interesting to study them and it
poses a lot of challenges while studying
it. Also, such
models are accompanied with objective
functions like optimal operations,
safety limits, minimizing
operating costs.
So having such functions also allow to
numerically evaluate the success of your
attack.
So
what is them vulnerable chemical
process itself?
It is a research initiative to
enable community to study
cyber physical experimentation.
It consists of the models of two chemical
plants. The one is Denis's process.
This is a realistic chemical process of
the Eastman Chemical Company.
And it was a process was released
to researchers in the form of
Fortran code, but the exact
chemicals and the equipment was not
defined. So this model is best
suitable for black box.
And so far most of my research
to date is done based on this model,
as the second model is vinyl acetate
model, a process.
It's a realistic chemical process to
produce vinyl acetate.
All the chemicals different, all the
equipment is defined.
It's extremely large process
and much more complex at Tennessee,
Eastman and probably understanding.
It will take you initially a couple of
beers with your chemical engineer friend,
so I will not go into further details
about the process because I want to spare
time to explain how we
have the processes. But I'll tell you how
these frameworks look like.
So they all have a similar
model, which is like it's a typical way
how you model chemical processes and
they can be understood with an average
like moderate effort and the advantage
of the simple model that they very
interactive. And it allows you to quickly
change things and observe what is
happening.
So it and and it is very well
suitable for for the what if
nature of the type of physical
experimentation.
So we created
also Igwe, which allows you to set up
attacks on the individual components
of the chemical plants with few mouse
clicks.
The results of the simulations are stored
as data, which you have to analyze, and
also the visualization form of
actuators, sensor signals.
So
the process, the code of the process
itself is written in the code and open,
so basically you can modify it to fit
your needs, you can add maybe some
dynamic behavior and so on.
But the execution is happening in Matlab.
Yes, I know Matlab is licensed, but this
is so far the Claus's what we get
to the public availability
because most of the
practice models are implemented in a
proprietary commercial simulation
software, which is not available really
to anybody, to everybody.
And in contrast, matlab,
you can always find it in the old
academic institutions.
Most research institutions has licenses
and also in the industry.
So there are also some other sources to
get a copy of Matlab.
So
so today's official release
of the invulnerable chemical process,
which was a very long project
and work. So this is
where you can find it for now.
So this is it's still
a better version because it did not
finish implementing the disturbances in
vanilla state protest and we need to
write a very good read me, but otherwise
it works and it can be used.
And maybe like after that talk
me, I can show you how it works.
So obviously, it was
a very complex project and
not a single team member
in the team.
So who else who else
is standing behind the curtains?
So thank you very much to aid in
for persistent foster, in my belief in my
own hacking skills.
I also the thanks goes to Montelongo,
who motivated me to apply was a stock,
obviously the project would not
be possible without generous
and constant support of my professor,
Peter Goldman, who did not only provide
all the money I needed, but he also gave
me freedom to do what I want.
And if you think.
Thanks.
And if you think that he reminds you
somebody, yes, he does look like
Einstein,
and he is also often
also thankful to Professor Alvaro
Cardenas from University of Texas in
Dallas, who taught me how to sell
stuff at academic conferences.
So I'm thankful to my friend Olla, who
designed and who draws a logo for
the vulnerable chemical process.
And of course, the invulnerable chemical
process would not be awesome without the
programmer.
So Alexander is resource is the
one who was working mostly on this and
Willink model was and so on.
And we spent a lot of productive
nights in the lab.
A big applause.
Two chemical engineer Pavel Grekov for
believing in hackers.
So he is responsible for
like monitoring the chemical
correctness of the experiment,
and Lassard must lead
the collaborators Jason Larson.
He's an awesome hacker who believes in
chemical engineers.
He has a 15 years of experience.
He Coskata system and breaking the
equipment. So here's my Wikipedia for
most questions.
And also we publish a lot together.
By the way, he promised to
look as he is now in the state.
He could not make it to the conference,
but he is watching us online.
So, so far, I'm done with the
introduction and we can really start to
talk about serious stuff.
So how do we exploit chemical
processes?
So and to start with.
I would like to debunk a couple of myths
about Skidder Hicken.
So a typical believe about the hacking
is that you gain access,
then some magic happens
and lets it success.
Everything explodes.
So let me tell you.
Disclosure number one, obtaining
the control is not the same as
obtaining access is not the same as
obtaining control if you exploit
vulnerability on a single IP enabled
device. In this case, the system that
does not automatically give you control
of all IP stupid
controllers and sensors on the network
and also does not allow you to overcome
all the 70 checks.
Also breaking into the system is not
the same break in the system in order to
damage the system.
You need to know how it works and how it
fails.
So do you know what slipways.
But no, it is not exotic
dancer, it's a stripping column
and you need to know and you need to be
able to recognize equipment when you see
it.
So skater hacker is not
somebody who hacked into them, God knows
what.
Did something achieved something.
Skidder Hacker is has a defined
attack objective.
He's a human with limited limited
to the real time constraints, like bad
management, time pressure, limited
budget, own experience and
so on. So Skidder Hacker is a
rational human and not a reporter.
Um, OK.
So in order
like when you write your show code, you
usually put the set of commands
to instruct computer software to do what
you want. So it's similar
design in the cyber physical payload.
You need to pack inside the series
of commands to instruct the process to do
what you want.
And the set of instructions
will depend on your
what avil thinks you want to do to the
process.
So actually what is possible to do to the
process. So let's start thinking
Zinkernagel.
So in a nutshell,
all bad things which you can do to the
process can be attributed to one of the
three big groups.
So you can, for example, want to damage
the equipment
like is breaking it completely
or just damaging.
So that can be achieved in two ways.
You can either, like, overstress the
equipment over the prolonged time.
For example, this type of attack was
realized in the Stuxnet.
Or you can also violate safety limits.
Obviously, in some smart ways.
This type of attack was realized in the
Idaho National Labs when they remotely
destroy the power generation.
So instead of breaking
the equipment, the attacker can also try
to damage the production itself.
This type of attacks can be roughly
divided into three like
attack goals.
First, the attacker can go after the
product itself.
So it is a product that can
easily tamper with the quality
or the production rate.
So every product has a specification
and the market price for the
quality.
So the attacker is a can spoil,
make the product completely usable or
reduces the
oil like purity.
On here.
OK, sorry.
So look at the prices of the products
atomos.
As you can see, not achieving
the desired purity can
be extremely expensive.
So also, instead
of like targeting exactly spoiling the
product, the attacker can
try to increase
the production costs, increase
production cost, will make product
uncompetitive, probably Christmas wish
of every competitor.
So how can it be done?
So every factory has a cost
objective function, which consist
of certain components which mostly
influence the production of the cost.
That could be, for example, the loss of
the raw materials and the purge,
premature deactivation of the Catalyst's
increase usage of the energy so
the attacker can go
after any of this like cost
function parameters
on.
The tactical also impacts the production
by increasing the maintenance workload.
What does it mean?
Maintenance refers to solving
the process disturbances and
to revisit the equipment
malfunction.
And so, for example,
if the operator if the attacker will
rapidly operate the valve, it will cause
very damaging cavitation process in
the pipe. Cavitation process is a
creation of some
of the vapor cavities in the liquid
and cavitation process,
extremely complicated process control and
also cause cavities, for example, in
the valve. So after some time,
it will cavitation possible
to create cavities in the valve.
It will start leaking, it will need to be
replaced.
So obviously
certain attacks and others will
eventually also converge
into the same attack instances.
For example, the in order to damage the
production of a hacker can also
break equipment.
But knowing exactly your goal will,
first of all, help you to design
attack with the maximum impact and
secondly, to minimize your effort in
designing attack, basically not to
overengineer it.
And so far
what I have been talking those type of
attacks will not likely to make
the front pages of the newspapers.
Why? Because the operators do not like
to disclose such accidents is damaging
for the reputation.
But if the attacker really would like
to spoil the reputation, he would
go to another type of attack.
So chemical industry is extremely
and heavily regulated.
Also, like all of those regulations,
safety limits and requirements are all
public so that the requirements are
readily available to the attacker
so that instead of damaging
the production, the attacker can make a
company just simply non-compliant.
So what does it mean?
And like noncompliance must be reported
and it is public.
It's like an aviation industry.
So the most damaging scenario would
be targeted at the occupational
and environmental safety
because this type of attacks will result
in little accidents like
human deaths and also severe damage
to the environment.
And less damaging attack
would be on the regulatory pollution.
This refers to the concentration
and volume of the emissions.
So the company, for example, may operate
perfectly fine. They are the optimal
economic operating conditions, but
because of the increased concentration
of heavy metals in the emissions,
they are non-compliant.
And especially we know
Greenpeace and community responsibility
that caused a lot of bad publicity.
In certain cases, the community may even
demand company to
close down and move the production
somewhere far away, which costs money.
This also pollution costs.
Like just to give us examples, this is
a soil and water contamination,
like a less known example is, is
contractual agreements, which results in
contractual sanctions.
It's, for example,
certain chemicals, certain substances
takes time to produce.
For example, the vaccinations usually
need six times. So if
health organization is planning a mission
to the Africans, they say, OK, we are
doing it in six months, you have to
deliver the vaccination.
So if the company does
not deliver, it is a very bad publicity
and cost a lot of money.
So it's
so OK now I hope that you
are motivated enough.
So let's start exploiting
SO and to start exploit, we need to find
exploitable vulnerabilities.
How do vulnerabilities in chemical
processes look like?
Let's take a look.
So this is a Tennessee assessment process
finds a vulnerability
difficult to know,
to know that to find the vulnerability,
the attacker first need to figure out
how the process is controlled.
So this is the chemical reaction
and it is controlled with the purge
valve, which is
kind of small in comparison to the
size of the leg, to
the volume of the inflow of the
reactants.
And this wall has a large
time constant sixty minutes.
So it takes
60 minutes
to to observe to achieve the desired
change in the reactor pressure
after the after
use change after you
adjust the valve.
So this combination of a small valve
was a large time constant.
It's a severe vulnerability of the
design of this plant and it's actually
its bottleneck and.
Typically, there are many control
strategies exist for the assessment
process, and none of them is used
in this scenario because it's this valve
is not able to cope when the pressure
will be right and they reacted too fast.
So the goal
then, like after the attack, is
venerability. Then he has to start
thinking, OK, I have to raise the
pressure very fast and director, how can
I do it? And the fastest
way to do that is to switch
off the cooling system because vapors
expand rapidly in the hot
sun.
So if you want to break something,
a combination of a valve
and a pump is a
good candidate for what?
To attack a signature attack of Jason
Larson. So, Sinclair, what
is what the harm, I think, of the tsunami
in the pipe. It's like rapid
rise of the pressure in the pipe, which
leads to pipe failure.
And you can then decide where
to break it. So if you would like just to
break the pipe and stop the production,
you would go somewhere in the A loop.
But if you want to cause something like
safety related accidents, for example,
can break the pipe, which carries a
asselin because it's toxic
to the humans. And
so full production damage you
can find probably also to exploit
the vulnerabilities or let's say features
of the chemical process itself.
So the reactor chemicals
from the reactor go through the heat
exchanger to cool down, otherwise they
will keep reacting.
So even if you switch off that
like a switch of the cooling system
there, the vinyl
acetate will keep reacting
after going out of the reactor and it
will turn from the liquid into particles.
It will turn into its solid-state,
into the vinyl polymer,
and that will clog the
pipes and the valves and the production
will have to be stopped for
valve replacement and probably pipe
replacement as well.
So if you want to vent something
out, so if you can see there is
a bypass valve in the recycling
loop.
So it seems like
if you're completely open it, that
I a lot of other chemicals will go back
and God knows what we will emit.
So this is how the vulnerabilities
look like.
So now we know,
like what can we do to the process, we
know how the vulnerabilities look like,
let's start planning something out
so we will start planning the
attack stages.
So obviously, skater hacking is extremely
complex, but you would typically
have to go through the specific steps
of it.
So you obviously start with the
traditional how can you get an access?
The next step is to figure out
where I am and what it is doing.
So what does it mean?
So this is a of discovery.
So what does it exactly mean?
Is this going to mean? First, you have to
figure out like what does this
process doing and what it is
producing? Even if the attacker isn't
know that he's in some vinyl acetate
production plant, every chemistry
in each individual plant is still unique
and very proprietary.
This is a competitive advantage of each
company. So the attacker has to figure
it out.
Then the attacker needs to know
how the plant is controlled, so basically
the location of the control
valves, the control strategies
used and the configuration of the
controls.
And also after that attack, also
need to know how the plant is building,
how it is fired, because he needs to get
access to the specific components
of this attack.
This stage of attack requires
a lot of information to collect.
Therefore, it's typically start a couple
of like sometimes in advance
before you plan your damage.
And it start with the old fashioned
espionage in the last three years have
been a lot of espionage, attacks on the
energy sector, chemical sector and so
on. And there's just like.
This is the citation
from the report of the Symantec of the
Netra Espionage Attack.
So the next step is control.
So even if you discover that there
are like certain violations, there are
certain measurements.
First of all, you need to figure out
how you exactly can change
something on the fact in the factory.
So what does it mean that even
if you there are some controls that not
there, is it maybe not
those control which will bring you the
desired outcome?
So you maybe have to think of something
like how do you use it in a different
way? Secondly, it's not also necessarily
that you will be able to get control over
the controls of your interest.
So, again, you will probably have to
think way around.
So basically you will have to see like
what exactly you can manipulate and how.
And also in this stage, you start
thinking, how can you can hide
your activities and also the state of the
person from the operator to prevent
operator response
at the damaged state, you actually start
implementing your attack.
It's, um.
Yeah, so this is the damage that this is
exactly where I was just wanted
to see if I wanted to say something else.
Now, this is where you start compiling.
You actually find the payload.
And the last step
is a clean up step, although here it is
like I look at I put it at the last
stage, but this is the stuff which you
plan throughout all
the steps of your attack.
So clean up is a constructing
the forensic footprint, basically.
What do you want investigators to
think about what has happened?
So it it goes
through there like all the stages you
start to think in and advise, like to
adjust and control logs and so on.
So.
This is part of the which have
partially covered today
on this once and in
reality, of course, there are
many more things to do while going
through the steps.
But if I would like to save some
time to tell you really some details,
I will not go into the details.
Maybe you can see it on the video or
by name into the conference, and I
can explain it to you.
So. OK, so now we know
what we can do through the process.
We know about the vulnerabilities and we
know how to plan like the stages, how
to execute such attacks.
So let's start really doing something.
So and first, we need to fix
a scenario like what do we want to do?
And the scenario would be the catalyst
activation.
So let's say
you want to cause maximum
economic damage to the plant.
So hopefully this is already, hopefully
by now recognizable by your vinyl
acetate process.
And if that was just
to cause maximum damage, he
can just destroyed the pipe, which
carries out the final product.
And you're done.
You spend all the money, you get nothing
out of it.
But that attack is kind of too obvious.
And what if you want to be
a little bit more subtle than that?
So we should do something in the factory
so the entire factory can be roughly
divided into two big groups
like parts. It's the action section
and refinement.
So let's look into refinement.
Refinement will consist of a lot of
different operating units, is a big part
of the plant.
And so the attacker has a lot of
things which he can do in the refinement
sections. But also the operator has a lot
of opportunities to
notice that something is happening and to
take compensating actions.
So here we need we need on
this part of the plant can be difficult
or challenging.
So in contrast, if you just go into the
election site and just completely destroy
the reaction in the reactor, then you
basically have nothing to refine because
you did not get your product.
So that really sounds like a good
scenario for the maximum economic damage.
So but how exactly do we spoil
the product in the reactor?
So for that, we need to look inside of
the reactor. What is happening inside?
So
typically, like a bunch of chemicals is
thrown into the reactor and heated up.
So the reaction is happening and you get
your product, however,
if you will, not without the catalyst.
Let's put it another way.
So if you will not control
the reaction in the reactor, it
will react in kind of a lot
of different strange ways and you will
not get your product.
That will be a lot of different chemical
reactions happening.
So the control over the reaction is
usually done by adding the catalyst
into the reactor.
That is a special chemical substance
which will guide the reaction and it will
direct it in the desired direction.
And it will also make sure that
you get the right product out of it.
So in the vinyl acetate, you can see
it's
catalyst in the vinyl.
Today, the chemicals get in there
absorbed into the catalyst and
the vinyl acetate is dissolve out of the
catalyst. So it provides a service
surface for the reaction.
And eventually
the catalyst is the kind of life,
substance, substance.
It is very sensitive to different
disturbances and imperfections
in the in the operating and the reaction
conditions. It also has
a lifetime.
And if it's not treated properly, is it
not the right conditions created in the
reactor, it will die.
Killing the Catalist interact
is extremely expensive to
any chemical production, and especially
when you look at it and I can tell you
why.
So as you can see,
so the main components for
producing the vinyl acetate is SLN,
but only eight to 10 percent of
the SLN
reactors are constructed in such a way
that only eight to 10 percent of
the cylinder will come in contact
with a catalyst.
It's done on purpose because this
reaction extremely exothermic and
requires the oxygen asulin and
oxygen together and high temperatures
create explosive
danger.
So, as you can see, the
process is not very efficient in the way
of using raw materials for a
purpose. So you have to recycle it many
times.
Also, only 95 percent
of all the SLN which comes in contact
with the Catalist will become the vinyl
acetate. If you think this, it is a big
number, but it's not a bad number,
but it is subjected to constant
improvement because
even increase in selectivity, even by one
percent, resulted in enormous
cost savings.
So if you will manage to get it to
kill the Catalyst's, we will produce
a lot, much less product
purpose.
And it will also substantially increase
the production of the cost because you
the underreacted chemicals will need to
be recycled back.
Also, it will increase emissions.
And if we will manage to build the
Catalyst's only if
we manage to kill 20 percent of the
catalysts that will already for the
company to shut down the production and
remove the Catalist and replace the
freshmen.
So this is a good attack to target.
So how can we kill the Catalyst's
roughly?
There are two reasons which
are two, let's say dangers to the
Catalist.
It's a danger of the
high temperature and the high
temperatures, the Catalyst's activation
in first decreasing and then it dies
completely. So it's irreversibly.
And also you can change the inflow
of the reactions of the reactants
because it changes the inflow
of the reactants will change the reaction
in the chemical process, and it will
cause to for example, the assailant
will combust so less
molecules will come into contact with
and also it will produce some
side products, many of them
which are poisonous to the catalyst.
So now we know we need
easy to change the temperature or change
the inflow of the reactants.
So we need to find
our controls now.
So we discovered the process.
We now need to find the controls.
So
when I was the discovery stage,
so how can
we change the behavior of
the process so the process
can be changed, the behavior of the
process can be changed in two ways.
You can directly adjust the actuators
or you can deceive the controller about
current state of the process by
presenting the controller with
a false state of the process.
So what exactly does it mean?
Now let's spend five minutes as a
controlling genius,
so the modern like the
entire concept of process control is
based on the concept of control loop.
So and the design of the
process starts with the deciding on the
set point, which is not on this picture.
I'm sorry.
And then I will do it like this.
So you decide the
design of the process starts with the
design.
Deciding on the value of the Setpoint
Setpoint is the desired value of the
physical parameter, for example,
temperature in the reactor.
Then the sensor measures the current
state of the process and
send the measurement to the controller.
The controller has a control algorithm
which decide how to
instruct the actuator, how to adjust
the actuator to bring the process to the
desired state to the set point.
So if the attacker will manage to lie
to control about current state of the
process, the controller will take
a wrong and probably hand
full control decision.
So this is what we want to achieve.
This is one of the ways to achieve that
one. So
typically in the production environments,
control loops are nested.
They're very complex, they're
interactive, and it's a very complex
dynamic.
And somewhere there is also the operator
sitting and monitoring the process.
So if the controller if the process
runs out of the
expected production envelope, then the
operator intervene and takes control to
himself. It's called manual control.
So the next slide
is extremely important because this is a
main key conceptual
difference between traditional
hacking and hacking in the chemical
in the of the physical processes.
So attacks in the traditional
I.T. system typically does not deal
with time. You flip a bit in your
software already doing what you want
unless except a few scenarios
like
a single flip, a
bit flip can change, like can
engage the burner under the tank of
chemical, but the reaction will still
take time to complete.
So change in the output
of the controller does not immediately
bring the processing to the desired
state. And in fact,
there will be times when the system will
not respond at all.
This time is called that time
and the time that she takes
off system to achieve 63
percent of the desired
like parameter like target
parameter is called time constant.
The attacker needs to know these
parameters to be able to construct attack
on the on the physical process.
This numbers are extremely individual
to each control loop, to each facility,
and typically they depend on the
type of the physical process and also
configuration of control loop.
And the challenge is also
that this is not the number which
the attacker can easily espionage.
So typically these numbers consist only
in the head of the most experienced and
the oldest person operating the plant.
So you either have to kidnap the right to
the right operator
or you have to figure
out the numbers yourself through
reconnaissance activities.
So basically you will have to start
turning things on and off, sending
impulses to the system and
observe the timing reactions
and try to estimate them.
So let's stay
for a couple more minutes in the role of
the protest operator,
but this requires reconnaissance
activities.
So this is a high tech
infrastructure for controlling the
centrifuge, the Stuxnet.
So the very responsible network
administrator is very concerned
about how exactly
the loss of data integrity
has happened in the network, which
blinded the operator about state of the
process.
But the operator, sorry for my French,
does not give a shit how it happened.
All he cares about that.
This is a loss of a
loss of situational awareness, which
leads to a complete
loss of control.
So
and you know why the operator was
deprived from controls.
Because the heck I need them.
So during the, uh,
during the attack, the Hecke himself
is a process engineer, is a control
engineer and the process operator.
So, no, he is controlling operating the
process.
So and in order to be able to
control the process, the attacker has
first to observe the process.
So the process must be observable to the
attacker.
So he has to be able to estimate it
state. And in order to be able
to control the process, the process
must be controllable.
So the attacker has to enable all
necessary controls.
So controllability and observability
are key pillars,
pillar, pillars of
the modern process.
Control cerium
and.
During the attack, the operator
and the hacker, they have conflicting
goals, they both want to have controls
like control the process so that
the objectives, the target, the goal
of the attackers is to take
control from the operator and enable
controls for himself.
So and talking about this controllability
observability, take this very close to
the security properties of physical
systems.
So, you know,
in a security community now, there
is a very serious civil
war going about what should be
there. How should we describe
the security requirements of the
industrial control systems so united
when it is CIA model?
So it was suggested that we would be
good enough if you just reverse
it.
So, OK, fantastic.
Now tell the operator that he now
has a loss of a loss
of confidentiality situation.
He will stare at you with blank eyes.
It tells him nothing.
So we don't need to reverse anything.
We just need to use the right terms.
It's Controllability Observability,
which is accompanied by the search
property, which is operability.
It's the ability of the system to achieve
acceptable operations.
So for the Prizzi's controls, the
security properties
are C or or CO2.
So remember,
CIA is for information security,
CO2 for Prothese control security.
OK, so let's
go back to our process,
so we need to find the controls.
So this is a
bottle of you let's state process, but
now it also has a control
structure which the attacker has to
figure out, not only finding the
location, but how the process exactly is
controlled. So what will be the sensor
and what which will dictate?
He needs to find those couples.
So
here we found some controls, which
hopefully could be useful.
And if there is
that Tiger does not have the exact
mock up of the process, which
he wants to exploit.
He probably will need also to be able
to observe the process to it, to be
able to estimate the effect of
his attack.
So he needs to find the measurements.
So we want to kill the catalyst.
So they
are how do
we know how successful we are?
We need to measure the amount of
molecules of vinyl acetate in
the reactor exit.
So the chemical concentration
is usually defines
it with the help of analyzers.
So there are a lot of analyzes in the
vinyl acetate process, but none of
them interactor exit.
So what do we do if it's a
bad situation for that to occur?
So the only measurements that we have
is only in the reactor exit floreat
and reactor temperature.
So
process observation challenges.
So if the required measurements are not
in place, so what are your choices?
So you can easily build a simple
model of the process and
derive measurements from there.
So you basically will be estimating
you can also try to deduce the state
from the related measurements.
For example, if the reactor
is a reactor exit, temperature will
decrease probably unless the action is
happening in the reactor.
So your catalysis deactivating
and you also can, for example, convert
a sensor in place to measure what you
need.
This is a work in progress
of Jason Lawson.
You can also try to enable the
sensor like with certain capabilities,
for example, to measure the shock
shockwave in the
during the water hammer attack.
You can
use the sensors are not cannot
do not sample the
measured signal very fast.
So if you saw the chocolate goes
between the adjacent sample so you
can increase the sampling frequency in
order to be able to measure what
you need.
There's a challenge with the attacker
will experience is non-linearity
of the process, so
what is that?
My students usually get mad when they try
to understand that.
So
it means that the
reaction of the process to the input
is not proportional.
Moreover, the behavior of the process
is different
enough and unpredictable when you try
to change it, even for a few degrees,
for example, the way how the process will
behave while you try to hit it 250
degrees is completely different
from what, if you will, try to hit it
further from 150 260,
for example. This is a creation of the
energy balance in the reactor.
So as you can see, it is highly
nonlinear.
And the problem is
also that the behavior
of the process to everybody
on this planet is only known
to the extent of its modeling, we don't
know for physics if you don't
measure it.
So also the control level only
you will be able to control the process
to the extent of the control algorithms.
And also the
the instruments are calibrated to measure
the process within some boundaries.
So and the attacker
will likely to push the process outside
of that boundaries. So this introduces
serious uncertainty for the attacker and
he will need to take
this into account while designing his
attack.
OK, so we found the controls.
We found the measurements.
Well, it's time to start exploiting.
So let's manipulate the process.
And Ralph Lagoona had
said nicely about exploit
like you, about using the features
to compromise like I see
us.
OK, so are you pros?
Yes, the
answer is yes.
So let's use it.
So I'll show you.
So yesterday
it's not your talk.
Sorry. Yeah, OK,
so yesterday in his leveret
has presented how to find
vulnerabilities in the switches.
So let's assume that the only control
which you got in the process
is a code execution on the switch.
Can you do something with it?
So Aidin is also
has many that.
It's like if you have a control
over the switch, you can cause denial of
service attacks. So
what does it mean? So, for
example, so like as
I mentioned, that, for example, one of
the way how we can change
the process, we can deceive the
controller about current state of the
process.
So
that could be, for example, achieved
through man in the middle attack.
But the CPU's on the switches
typically has very little
resources like Verrier.
So the four men in the middle for each
and single packet is not possible in any
means.
So what you can still do if you have a
code execution on the CPU you have,
you can ask switching fabric to forward
you a few packets so that you look into
the payload and you get
to know the state of the process.
And then if you cause denial-of-service
of the at the opportunity time on
this, a communication
between the sensors and the CPU of the
controller, you can actually
manipulate process at will.
So in that domain,
those attacks means like the system
does not do anything here.
You can actually control process as you
want. So and I'll tell you how it
happens.
So
this is the
typical controller like programable Logic
Controllers. They operate on the
scanner cycle architecture.
So at each control cycle,
which is like every millisecond they
ask the sensors about the state of the
protests and the thought, the
measurements and the input buffers,
and based on their stored data, they
calculate their control commands to
the actuators.
So this is happening like this, but if
the measurements vary the measurements
and instruct the actuators,
we did the measurements and here
we.
Uh, KÃ³sa, Denial-of-service, we do not
rule out packets anymore,
so at the each subsequent control
cycle there,
the controller will keep generating
command based on the last received
volume
and.
If this value is below or above
a certain point, that will eventually
bring us into some undesired state.
So.
This work was published already,
this work and presented already to the
wider audience, like just
two weeks ago.
So, if you will, does
the process at some, like random
time, you have no idea?
I don't know.
So if you can see us, this is just like I
selected just a few responses of the
system of such
DOS attack on the reactor
pressure sensor so they can see
the response of the system to such
attacks differ greatly.
So in fact,
so you need to select the right time
when to attack the process.
So as you probably can relate.
So our work was our
work was exactly on finding the right
time when to launch this attack
on the process to achieve effects which
you want.
OK, so this is one
of the ways how to manipulate the
process.
And so far we've been talking about
kind of straightforward manipulation.
We took actuators or we take the
measurements and we try to change,
try to deceive the controller and change
the state.
But there are also more
complex and interesting scenarios are
possible.
So physical environment is a
communication media on its own.
So two components, even if they
are segregated electronically, they
can communicate over the physical media.
So if you get access to one pump
and then set up a standing
wave between to this pump
and the other pump, you can actually
influence the performance of the other
pump.
And this unseen state of that component
will be have a hidden impact.
We call it the hidden impact datum.
Also, for example,
like the reactions are planned to happen
in the specific reaction vessels because
they also have like walls and kitchen
basins if things goes wrong.
So what if you displace
underreacted chemicals from the reactor
and already send it in to the pipe?
Nobody knows which chemistry will happen.
So kind of unexpected
physics.
And if, you know, the researchers say
librettos this is kind of this
concept of an expected physics is similar
to the concept of weird machines.
OK, so I'm good on time
and we can manipulate
the process. We decided we decided
already how we will manipulate the
process.
What else left is we
have to hide.
So we need to conceal our
actions. So
I remove the slide, but I'll tell you
invert. So in the recent
accident disclosure on the
Turkish, German, Turkish,
it's English
for
a pipeline level
that they like.
They, they is like like
they destroyed the pipe.
But the operators which were monitoring
the pipe have to
learn about the accident 40 minutes
after the accident because somebody
reported there is a fire.
So the attackers took
effort to conceal their actions to
prevent operator response.
So basically that will burn a lot.
So what are the possible
scenarios like? Typically, there could be
the first on the possible
scenario is record and playback.
So you record like
a good bet or a good day and playback
during the attacks.
This was used in the Stuxnet.
But the challenge
is it requires a lot of storage.
So if you're somewhere on the small
microcontroller on a sensor, that's
probably best scenario, not
possible scenario for you on the others.
And you can also try to derive a process
model of sufficient
accuracy and
like kind of generate more process
measurements in flight and send them to
the operator.
But this requires knowledge, requires
CPU cycles to run the model
and also requires the storage.
So also difficult
scenario may not be for sensor
microcontroller and the
system that is just like cruft your own
signals, which are
unbelievable, which are very believable.
So you just reconstructs sensor
like data features like because it's just
normal sensor signal.
And so we
did it, we implemented this.
And I will show you in a moment.
And we also this is just
recently accepted work of ours.
We will present it in April.
And we also found a way how to
detect those signals so you cannot detect
them with a normal, like signal
processing
tools. But we detected
such signals through the plausibility
checks, knowing the other
measurements in the system.
So if you know that the measurements and
the process, you can detect that this is
actually this measurement is not
plausible.
So how did we how did we
build our system?
So first of all, you need to
reconstruct the believable noise which
will replicate the spikes
and the gaps in the noise.
So we use
this is a this is an idea of
the Jason Jason.
So we use to use the RAND
test.
So which three sensor is a
pseudo random sequence of extracts
runs which you then build together to
reconstruct the noise and you can see
the. Very accurate.
And the second we need to be able
to reconstruct the dynamic behavior on
the signal, so
we use a line approximation to
extract line dynamics.
And like,
again, let's start with the London phase.
You mean value?
Then you extrapolate signal
dynamics with a trial, with a line
segment here long enough.
And then during the spoofing stage, you
place together the segments around the
mean so that it fluctuates evenly
and you can see it's
quite accurate.
So
and it's very evil,
so
what is the future?
This is how I see the future.
I often hear the argument like,
well, but we are eite like guys.
We are security professionals.
What we have to do is control.
That's not our department.
So my idea is that
security specialists define
security requirements,
for example, sinkholes,
confidentiality.
We, the security specialists say
that we need signatures for
authentication, integrity, protection, or
we need encryption for confidentiality.
We post security challenges.
And then the for example, the guys who
can implement it do their job.
For example, the mathematicians design
for us the good and secure
cryptographic primitives.
So it's no different with secure control,
finds the problem, said said
the challenges to the control engineers
and let them do the job.
So thank you very much for listening.
And I still have five minutes.
We have still five minutes for questions.
Yes, please line up at the microphones
and
maybe we should start with Mark too
high.
Probably the best
talker on Congress.
Thank you.
Just to point first
from risk assessment, I suggest to
use three levels.
First is disaster.
Second is economic and
policy research, reliability, safety like
sea level.
So it's easy to show
money.
Yes, yes, yes, yes.
Yes, exactly.
Second,
what we do in that moment, we put in the
same model not for chemical, but
for transportation and Physick
vulnerabilities.
So you get a graph
and you can calculate from disaster to
technical vulnerability.
And do you take into account the
CIA system in your model
of safety
systems?
Well, there are safety is like a
negative feedback system, which
I can understand,
but no.
So so far, like you only drive,
like, you know, your safety limits and
you try to achieve them and
then the system shut.
Yes. A shutdown, but it's not a disaster.
Well, that's the model.
So basically shutdown it.
Yeah, it's bad enough, but it's
economics.
So if you want to be real,
for example, especially in the vanilla
city, that can be actually added.
So the model is extensible.
So we actually that's why we want to do
it public so that the community can also
contribute to improve the models and
which research questions can be studied.
Mm hmm.
And one more point about
automation. You use historians
to build on your model.
That's right. I don't get it.
So previous state
of the system.
Um, well, it is
it is like in the Motlop,
you don't have the infrastructure.
So the data just logged in the workspace.
OK, one more point.
Maybe not for you, but for your
next degree,
you can do compile Scotter
and p.l.c.
processes. We're processing Varig,
for instance, and automatically loan
boundaries by history and analysis,
actually, for example, like this model.
So so I was invited to Nyst to,
uh, also to consult them how to build
a test.
But and they exactly.
They built the entire infrastructure and
they just use the model to take the
process data and then to pass it into
the infrastructure.
And then they already see what do
you do this process data in the
infrastructure.
Yeah, because this approach can be used
not only for hacking but also for
security. It's like intrusion detection
system for the process and we
need.
Yeah, exactly. And many already do that.
It's just that I think as close as
possible to the physics.
I don't care about the infrastructure,
but yes, the data from the processes can
be used.
For example.
Yamoto to detect.
Yes, exactly.
Excellent. OK, thank you.
OK, maybe a question from the
signal angels.
Uh, there are two questions.
And the first is, have you tried
to run your code on SETI
Lab, which is more
or less, uh, free software,
reverse engineering of Matlab?
If not, there is no octave.
I guess this is like a free version
of, uh, like what is free,
let's say, free matlab.
And the models must be portable, but
we still did not try.
We want to try, but still
not.
And the second question
was, if you would,
uh, toss the switch,
wouldn't it tend to,
uh, prevent the positive
picture, uh,
from the beginning?
If you toss the switch, uh,
well, wait.
But you do not do the speech, you just
drop the packets of interest, like
particular data flow, you just drop
the packets from the data flow, you don't
does the switch.
Maybe you can also do the switch.
But I did not
talk about that.
The question is, uh, does it prevent,
uh, when when
you can't read, uh, sensors anymore.
So you also have a problem,
don't you know?
Not that,
uh.
I'm sorry for the ones still
standing at the mikes, but we don't have
time for any more questions, you can I
think you can meet up with the speaker
now until the next
talk starts for like
five minutes and.
Yes, please.
Yeah, take it.