Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/477 Thanks!
OK, it's my very great
pleasure to introduce to you our next
talk.
I think industrial
security has been a lot of
it has been in the news a lot in the
last year.
And I'm very curious what our next
speakers are going to have to say about
that and especially in the context of
railways.
So please welcome
Sergei Ilex and Kleppe with the
next talk, the Great Train Robbery.
Hello, Congress.
It's a great pleasure to
see you again.
As usual, the only frontman's
for Scudder's strange
golf team, who
for the last five years
trying to save humanity from industrial
disaster and to keep a purity
of essence.
So please keep your big
hands for all people who
support us.
Just not for journalists,
this is a strange
life team talk and
mistake by joke, all our
responsibilities is not related
to our employers.
So railways,
railways is one of the biggest
artificial system built
by humanity.
It takes
thousands and thousands of kilometers
all around the globe on different
continents.
And my personal trip,
rail road trip
when I was a student, take
more than 9000 of kilometers
and six days,
maybe because I was young and
have a lot of time.
But still, even now,
I prefer to travel by
train because on airplanes
you see the
earth from the skies.
When you train, you can observe,
connect, connect with people
with this
land.
But in Hucker vision,
most important question is how it's
work, because it's always interesting
to understand how
work in this case railways.
What are two important work in
a railway universe?
It's the signals and switches.
Signals are to
train operator
to train driver to understand correct
speed.
Should he speed up
or stop or slow down
and switches.
Obviously a lot to
change direction and
move train from one track
to another.
Many years ago,
switches and signals separated
by human manually.
So if you want to move train in different
direction, you can you must
change switch by your hands.
But about
maybe 150 years
ago, modem system,
call it interlocking was invented.
Interleukin is a system which
calculate dependencies between
train location signals
and
switches. Position to
understand can train
go in this direction or is
prohibited. So if it's
the conflict alters, when are all routes?
When a train can
collide, it's prohibited
this situation by
it. First, physically
physical locks, which is vice
interlocking.
It's almost like steampunk
picture, but still
physical interlocking works.
For instance, in New York City
Transit, you can find
out what
some of the stations still operated.
But manual interlock,
very important point related
to railway is a
way to understand the
position of the train where
a lot of different way to do it.
Now, in the modern world,
in all this, before this high speed
train, where are GPS
tracking going astray?
Can but train
so-called still
wait very widely
adopted. What is track
circuit
in this idea?
We use rails
as a wires and transfer
power into rails.
Sometimes it's easy, sometimes it's
AC modulation,
by the way, signal reweigh,
accept the signal and
if it's OK, it's
open to
clear, right to green.
If we have a train
on the rails when
it's kind of a little
short circuit and
the energize it and the
train switches to stop
signal.
So now we speak in about three ways
after the physical and
most of railway automation system
was built on the railways,
on special little railways,
which are built
with a lot of gold.
Which can operate in a wide range
of temperatures and
what's most important, we told you we
are gravity operated devices,
but nobody knows what is gravity,
which is why I think nobody know how
vital relate are working.
And it's working by magic and which is
why we should trust it.
By the way,
for me, relay room on
the railway station is a place
where nobody can get
the separation of a soundtrack
because you can sit here for
hours and listen to his music.
OK, this is old school, but today
things change it.
And we have a world of automation system,
computer based system on the locomotive,
on the way station
or on a station
on West Side.
It's a direction motor control,
computer based, interlocking,
computerized ticketing system, etc,
etc, etc..
Let's discuss in details
how it works.
I want to give you an example about
Eurostar train service,
which they meet one of the most
smart trains involved
because it's have one,
two, three five seven
automated system of support
for France, for Great Britain, for
Belgium and genic
European train control system.
But let's stop stop
for a second and check this
highlighted reactor protection
system on the board of the Eurostar
train. I hope this is a typo
because I'm not ready to
speak about nuclear train at moment.
They make yep, hello.
So the locomotives they
built from several vital systems,
like the one that allow them to move,
to stop, to
say the driver of that, say,
the driver, about the situation on the
roads and most importantly,
the train protection system that
can somehow react and
prevent several accidents.
All this subsystems are
interconnected.
So, for example, direction system
won't mess with braking
or in case of
some accident, the train protection
can stop the train.
The bomber is you can find
anything to conduct security research
on the Internet publicly available.
And this is true for
all railroad software.
But if you
try hard enough so let's
speak, for example, about one
system that's actually train protection
system called Seabass.
The 10 year old version
of its seabass 52 is
very, very widespread.
And then you're one is Sebastian
is a very new and is still a catch,
and some of us will catch it more than
others.
So let's look at
how this system was updated.
And just by looking at it, we can see
a lot of things like they
stopped using some proprietary operating
system. And it's
a good news because most of the
time, homebrewing operating systems tend
to be disastrous deep
in this system.
They do not have hardware controllers.
They have stimulation called
Winnik Archduke's.
They have new modern
well, not new, not modern, but unified
transparence like Fenet.
And nowadays they use
very widespread CPU architectures
like Eighty-six
and PowerPC.
And it's a way to ease the
job done by reverse engineers.
So when you
read a lot of minerals and documents
on the Internet and you know
from which subsystems, some automotive
components are built, you can actually
probably find something on
the Internet we are speaking about.
We need we need to be
based controllers, but
it's not the time to talk about it.
But still, we can talk about
the internals of the system.
And this is actually what
tell us a lot of things, not
vulnerabilities, but weaknesses.
Like if you want
to control the the
controller to stop it, to shut down,
to run or anything else, you don't
need authentication and
you don't see
any kind of industrial protocols
is just over HTP.
And it's easy to repeat and
use it to build your own tools to control
them. And
if you look deeper, all these things
are self written like
HP server and XML parsers.
And I believe you can guess
what this means.
The next logical step would be
to talk about how can we reach those
systems in the real world,
but we don't know and
we don't want anybody to know about this.
So let's continue
our saga and switch to computer
based interlocking.
The goal of computer based interleukins
is to help to
manage fruit from the station,
and if they
try to analyze it from
a computer system,
they can find for an
important part of computer based
Interlochen is a yardmaster
workstation.
It's like a human machine interface
in iciest environment.
Just a PC with special
software on the top.
And the second important part,
this is integration gateways,
which helps to
connect sometimes wirelessly
to different station or to
centralized traffic control system.
Most important part of
computer based intervention is central
processing unit, which.
Process all dependencies like
we saw on the previous pictures, we have
logs now, it's processed by computers
and the object controllers
like you sees
in our the environment,
which transfer
management command directly
to wayside devices to
switch the switch or to
change the light of the whole
sorry, of the white
requirements for computer
based interlocker.
The interaction is very formal
and in different countries.
So you can find the visa requirements as
a state role or the
role of different
companies, by the way, because
it's vital component
of the for safety, for
traffic safety.
This requirement is fix it and
all.
Interlocking system must
be.
It must feel such a concern
to us, so
when we speak about security,
it's very important to be correct
for that model because, you know, when
we discuss computer security,
people mostly discuss integrity,
availability, confidentiality on
information. But this is does not work
in the industrial world.
It does not work for computer
based. Again, from our
point of view, there are three levels
of threats.
First level related to safety
or cyber physical threats
are close to attacker
to create a disaster.
Second level, its economic
economical threats, which allow two
attackers to
impact freight efficiency
to, you
know, to impact your revenue as a
railroad company.
And the local
level is reliability
when you can impact the system.
But we just
add additional work for engineers
who support this system.
Sometimes colleagues asking
me what is cyber physical threats
for me?
I don't have a clear definition, but
for me, the threats which
can be done
in cyber world, but in
something in a real environment
like this.
Always funny on the pictures in the
theater, but let me explain
by example what is
conflict route's or what is
a less restrictive signal
light versus example
of conflict route?
This is a less restrictive signal,
right, but this is
a toys.
Let's check it how households in
real life, it's not such funny.
So switching is incorrect position,
and even if Driver
understands the situation in trying to
stop, it's impossible because train
very heavy.
So let's
discuss attack vectors,
gain computer based intervention
to make appropriate model
first level its
attacks again,
WALKSTATION, which can be easily
accomplished by security,
physical security bypass or by social
engineering, because it's not
very hard to for somebody
to plug USB drive into work
station.
Second level of attack, its
attacks against integration gateways
against wireless and wired
network devices, which connects computer
based interaction to rest of the world,
and other attacks
that are also related to communication
to communication between
yardmaster station and CPU,
communication between CPU
and or object controllers,
and sometimes even related
to communication between object
controller and Vici devices.
Because this is situation
when object controllers communicate
with the wayside devices over
wires or wireless link.
So if you can intercept it or
make amends immediately, you can control
switches by yourself.
So I will give
you several examples.
All examples are from Google.
It's not related for
any particular
assessment we did in the past.
First, physical security.
It's sexual pictures, I guess,
and it's looks like actual
pictures, because during our assessment,
physical security is terrible.
In most cases you can say, OK,
guys, I need to check your system,
maybe see X, Y, Z, pass to the station
and get access to
workstation or a service
password protection.
Second picture
from a movie
documentary movie about
Great Britain railway automation
system.
The main challenge here to get
workstation name, which is also
watching this, is she always
seeks something, but I think that
people's responses can help here.
All software is everywhere.
It's again, from Google.
It's actual news,
new equipment and system
approval certificate,
which allows
to use CCU, which runs
on the Windows 94
service park, Sikh's and
Volf.
And we managed to
track guards and this is
flexible safety processor.
But about safety, most
of the
railway system, beautiful
redundancy in mind,
it's used several CPU's,
sometimes three, sometimes four,
sometimes even eight, which
runs different same,
but the different programs, sometimes
viewed by different team of engineers
and some kind of majority
system which compare results
and trying to understand
is where any problem with computation.
But in practice, it's
mean if you have a router, access
to a computer, basically what religion
you need to patch several vacation
and memory, not only one.
Hello, so
as Serguei said previously, nowadays
we have this steampunk like interlocking,
but and most
of the complexity of building them was in
crafting a building.
And nowadays it's about
how to create a
safe system.
So by
saying we want to have a
safe interlocking with
women through things like drains, should
not collide, should not derail
or trains should not hit people.
And they are doing this
by use of different formal methods.
So to mathematically prove
that this safety
critical systems are really safe,
I want to tell you about
formal methods. This is a topic
for a separate talk.
But in short, we
are talking about creating
a set of specifications with
requirements and a
model of our projects.
And the point is to prove that
our model satisfies this
requirements.
We have a lot of
the world have a lot of different
instruments like B.M.
that can be proven
and so on. And all those systems,
all of those systems are used by
industrial companies to
make safety critical systems.
And we will talk about methods
that is very widespread, not
only for an unknown space
rockets, airplanes and trains, but also
for vending machines and traffic
lights.
There is a development environment called
Utterly Erby that allows
us to create those specifications
and models and later on
to prove that we are
safe.
This development environment also
have translators from the models
that you have created to different
languages like C, C++ and others,
so you can later integrate them
into your solution.
We are not trying to say here that
the math is wrong.
We have A, B or
B method itself, but we
are trying to show how
a human developer can
create wrong
specifications and
this could create different
vulnerabilities like memory management.
And this is a part of slides
from one of the developer of Atelier
Beat where they say
that they can cope with
all of those problems.
So we took
your B and created a very small project.
It's called Bad Index.
It have an array and one operation
that tries to access an
item in the array.
And as you can see, there is
no boundaries taken in the code
and all of the
green circles to the left.
They say that all type checking
was done correctly, that we generated
proof obligations.
We proved everything.
So kind of we are safe.
So if we generate
a program and see afterwards, we can
see a situation
where a member of corruption or
segmentation fault can occur.
And again, this is not the
fault of the IMF, its fault
that we haven't done the
boundary. And
the point we want to prove is that
there are still humans, the people
who write the specification requirements.
And as with any other
programing language, they can introduce
vulnerabilities.
Actually, good news
in the world, none of the people I heard
that read these things to
see code or C++ code, they
use order, which is
with its strong chapping
chicken, is a more secure language
in comparison to see, for example.
But there are some pitfalls,
too, like
typical of other implementations have
a mechanism called trump
lines. And that means
it will execute code on stack, which
is not very good for C
programs. And for example, if
you want to link
other code with C libraries,
one of the security mechanisms won't
work up.
So let's get
back to the railroads, to the
interlocking.
These systems are not actually
that easy. And most of the times people
who create those formal methods, they
try to mathematically prove
that only the logic part
is safe. Like Serguei said,
we must not
allow the trains to
to collide or something like this.
All other systems like
the operating system where we will
place our code, the different
communication services, the user
interaction part, the part with with the
signaling when we want to know where is
the train, what is the position of the
switch and so on, it's almost always
redundancy. And this provides
us a lot of capabilities
to exploit this and somehow to
influence influence.
This proved
for safety, logic and
to create it to work otherwise.
So this is
a slide where we show the
vulnerabilities for this formal
methods and other vulnerabilities of this
interlocking systems.
Thank you.
But
if you're trying to discuss
those vulnerabilities with
railway people, we have engineers,
we have
people who support interleukins system,
their typical answer.
OK, you can create
conflict rules, but in
the lab, because all
in real life is arrogated.
OK, let's talk a bit about air gaps.
Fortunately, if you.
If you type Roey
in Shodan, you will get
very few results and most
of those result
is false positive, I hope.
But sometimes you
can get something interesting.
For instance, Delhi
railway station subway in India,
which are accessible
via Beatport.
But I guess this is not something
industrial grade is just Internet access
for station.
What's interesting here, interesting what
this device is located
in the company,
Ray Ray Hotel Corporation
of India.
So I guess.
But there are special
telecom operators for
railways.
For instance, in Germany,
where a special network operation
operator who support bomb
network and they also provide
SIM cards
interested in why a railway
operator needs SIM cards to allow
train drivers to applaud the high
resolution video to YouTube or something
more.
Fauji Samar Samar
is a railway version of
GSM which use it
to connect
trains to Aweisat
devices to calculate optimal,
optimal speed, to understand
trade, location, training, location, to
manage all
conflict situation and
just Samarra's good
from encryption point of view.
It was very good to talk
from Stephan on Twitter AC3
and you can find a lot of information
about dusa marketing change
encryption where and we decide
to don't go this way
to don't
crack encryption.
We decided to check our
cytology sarma for instance.
Jiemin so
if it is in specification,
what if digital modem
digital modem on the train
should always connect
disconnected to control center.
So if the way the
modem connection is lost,
the train will automatically stop.
So if you have a good GSM
journal, but on different frequencies,
you can stop a train if
you need it or you can go
in jail.
So if you needed.
There are
different interested in the issues,
for instance, in Somalia and
said
there is one more of
what is a very useful feature to
manage this handset via
SMS, the
password, one, two, three, four.
I'm not sure, but there are a lot of
engineers who change this password.
I guess there are not so many engineers
who even know what this
handset can.
They manage it via SMS
to continue SMS, no
discussion.
Where are we?
The interesting feature,
Jassam, our interests are SIM card,
which call it over their management
and which absolutely is the
same like is in our standard
SIM cards.
I know that you know what
SIM cards can be Hockett over there.
It was discussed several times by
Kartzinel, by Alexander.
It's a fantastic sale or Saipov.
And
if a developer
of SIM card applied to
have some issues with
programing, he
can allow you to get
an encrypted response to brute force,
a signal to Ricky and after
to receive information about
encryption key and
sometimes even applaud
malware on the SIM card
after constant talk.
Many of the telecom operators
decide to review SIM
cards or filter a binary
or their SMS messages,
but I'm not sure that something similar
go in just a Mahuad more
some josimar equipment
support over their
firmware update.
Not only SIM cards update, which
allows you to do Kenway
updates over their
modern modems for GSM
are supports interfaces
like USB or PCI,
which reminds me
of our
old research which name
Buckett over SimÃ©us when
it was demonstrated like
how attacker who
can hack the modem
over there, for instance, before
the way update
can use it to have
the host which uses
modem for network communication
and gain control over this
cost.
This is old video.
It's online for a year,
which demonstrate how Hockett
modem
which connected to now.
Laptop.
I first started to work
as a
modem network devices and
Whisstock,
but after a
short time out.
It starts to operate as
a keyboard.
And obviously, keyboard can type.
So as a real hackers are
our modem start calculator.
And after we get specification
of the input output system to bypass
sailboat.
So if you have it and reboot
the computer.
During reboot,
our modem become
a CD-ROM drive.
And install buckets.
You can ask me if I wear any
keyboard's in railway equipment,
my answer sometimes we
have, it sometimes doesn't have, but
in most cases we have
drivers for keyboard's
drivers for additional
assistance, for printers sometimes.
And if you can become a
printer or
camera, you can exploit
vulnerabilities in drivers
or direct memory access,
as was demonstrated by Travis Good
Speed and Sevgi Brothas for
local vulnerabilities.
And as was demonstrated by tomorrow,
you know, Suffern crew Nesterov for
remote vulnerabilities because
nobody cares about buffer
overflow in keyboard
or my driver.
Why? Because it cannot be exploited
remotely. But if your remote device
can be compromised and that's poetries
vulnerability, you can exploit
such vulnerability remotely.
So let's back to the railway
system. And
if somebody can attack the modem,
the modem can attack automatic train
control system and you can control
the train.
Well, little well, everything is
interconnected because everything is
entertainment.
Well, let's take a look from,
uh, let's take a look on the
locomotive railway systems
and you can find out a lot of
devices, a lot of systems.
From one point of view, it's
especially for passengers, users
like information entertainment systems.
Another one is devices
like intercommunication between
engineers, cameras,
wireless access points, gateways and so
on.
But the main idea that all of them
operates through the one,
uh, communication channel,
one of them communicates especially
for railways, another one for
some kind of information systems.
Well, and it's another one
proofs of of it,
because now
it's from for example, from
big vendor, uh, Moha,
and it shows how their
approach, how to, uh, get
connected to
different devices and to how
they connected with a locomotive,
especially for SoloPower lands
and IP cameras, too.
And they tend
to fly in the clouds.
And nowadays modern
way, they tend to be like
an Internet of Things devices.
But in this case, and especially
in the context of our topic, it's, uh,
realized it's created without,
uh, very strong, very secure approach.
Well, and we will show you
why it exist.
And we analyzed,
uh, several
vendors like Benetech D.G
that module and so on.
We analyzed different devices,
type of devices, which is
special, like, uh, railway equipment,
gateways, uh,
uh, modem modems and
so on. And, uh, we
found out that big, uh,
private gazoo from our
previous experience, it exists
and it exists and differ on different
industries.
But in this case, uh,
it little bit shocked us because
it's railways.
I mean, and there are a lot
of private case and each vendors tend
to be tend to hardcourt the private
keys.
Well, and, uh.
Well, it's it was not only for,
uh, SSL certificates,
private case, which correlated
with, uh, certificates,
but also for remote management
administration like, uh,
Secure Sickle-Cell, there was exist
from one vendor private case for
Sickle-Cell.
OK, and
you can ask us and to you could
write, uh, so what the impact
of it.
First of all, I can say hello
to Nebulas if
it's private and
it's private, became publicly available.
It's not a private.
It's easy. Yes. And obvious.
And another one
that's if you create something
private, especially for private case.
It's created for private communication,
for private, uh, for safe communications
in this case, uh, I hope,
you know, it's like
man in the middle attacks and,
uh, after eight
communications between railway's
systems, they are not secure.
Also, as I said before,
it's give us give attackers
possibility to remote gain shells.
And we will show you a little bit later.
And, uh,
another one, uh, it's fingerprint
devices, for example.
You can extract public keys
from private, uh, create
some kind of fingerprint, uh, using
them device and, uh, each
one and to using search engines
like shodan our sensors.
You can find out a lot of devices
which is connected to Internet and,
you know, private case, you know what to
do the next.
And this picture shows you,
uh, original, uh,
traditional way how to hold to
Biver. And in this case, it means
how to keep your secrets
next one.
It's, uh. Well, well, well, it's again,
again, a lot of default credentials.
But in case of real waste management
systems, it's not only for
Web communications, but also for
secure shelter on that.
And, uh, they
try to change to as they
try to secure communications and
change, uh, telnet port
well.
And another one example.
It was, uh, uh,
really important notice to
your customers, so in
this letter, you can see that you should
use only two possible default credentials
for administrator, for the administrator
password.
Well well, it's, uh,
dear customer, it was warm.
Well, uh, take a look on this piece
of code.
Uh, how do you think is it secure
or is it hello from early
twenties.
Well, uh, it's obviously not
secure and it's created
nowadays, uh, at, uh,
twenty fifteen.
And give us the ability to
inject a system called.
Well, next was
quite interesting possibility.
Everybody remember about you guys
be out around Molvar
and so on, uh, but
in case of railway devices, special
equipment, there is a USB port.
And, uh, if you want
to easy to
use a life of system engineers who
don't want to go with devices
that a lot of you can put your USB stick
and, uh, device
out to start up the run.
Uh, for example, system update,
software update, firmware update,
system configuration update,
uh, how it works.
Uh, it works very easy.
And, uh, and again,
it easy life or system engineers,
if you don't remember your password, you
can create password, please.
Uh, well, in this case, you can create
password hashes and
as big as you can and try to
brute force and run your, uh,
after update.
Well, you can ask how it's, uh.
Well, Railway's Systems
looks like, uh, isolated from the
internal world.
But, uh,
this picture can see approach of
attacker who can, uh, interconnect
to railway station through the management
system and, uh, once
say it when you connect to Internet,
connects to you and from
the internal side of railway
communication, you can see that
there is three steps, uh,
when you trace road some some
inside train, the next one is outside.
Well, it's way inside the next one,
which we mentioned before, it's telecom.
Well, locomotive,
uh, has a lot
of equipment and, uh,
some of them works, uh,
for user interface.
Some of them works well, especially
for that module when the road works
on through VPN.
But in this case, they, uh,
all of them works through the same
public mobile network.
Well, and, uh, there
is approved by SHODAN that
module, uh, especially,
uh, special devices and, uh,
VPN gateways, uh, connected to
the Internet. The next
one is, uh,
net module vulnerability, which was fixed
to new from where it was
simple, uh uh,
request which change administrator
password just simply
agreed with you the rules.
Well, could us go to our colleagues,
Simon Norskov and, uh,
from our experience, we should
give many thanks to,
uh, search from different countries.
Big.
Was Cryptome.
Last year, we spoke about
wind and solar energy,
and we get a lot of feedback
on our talk and decide
to launch
that S.O.S. project, which
focuses on the
discovery and hunting of open,
smart green devices on the Internet.
And we get a lot of interesting
results in a different
part of the world.
And we get a lot of feedback
from the vendors and service.
By the way,
this approach, this project
hoping to move more than
60000
Internet connected smart grid devices
like Powerplant from the Internet
and.
Several vulnerabilities was reported to
vendors to sort several
already fix it, and
I want to thanks Mr
Mr. Maxim group for who contribute
to this project very much.
Thank you, Max.
We decide to continue open approaches,
so we start in
the Path project
and we go in right after
the talk, we're going to release
the list of default
and hardcoded accounts and different
policies that each may
to force vendors to
don't use hardcoded
and default password in their system.
So kudos to Oksana
Andreeva, who helped us to prepare
this list and please contribute.
After the previous talk, we
get the comment about
European power system,
if somebody can take
three gigawatts of the net
for a couple of seconds of light
to go out for
quite a the time, but we know what
there are special devices
like category protection due to the
digital substrate substation, which
built to prevent such
a bad situation.
And we again decide to
research.
Uh, well, we, uh, did
some kind of research in, uh, digital
substation's protocols and, uh,
in previous conferences we released,
uh, special toolkits, uh, for
digital substation protocols.
And, uh, and
this year we created with help
figuring out, um, challenge
called digital substation takeover.
Uh, it, uh,
was implemented with Siemens,
uh, cyberattacks, ICAM Protective
Relays, which is industrial switches
and so on.
And, uh, but guys, this
challenge give us the result.
Global disaster, well,
and in real digital substation's,
we have very good,
very, uh, well known protection
called, uh, protection release
to avoid these kind of, uh,
a couple of melting, but
release also vulnerable, uh,
vulnerable.
And, uh, on
during this challenge, uh, guys find
out their ability.
And Simmons Kiprotich, uh,
it's, uh, with specially
crafted packets you can create, Danial,
observers of relays and
this case you can melt.
But also during the parties, uh,
challenge, uh,
we find out, uh, some kind of
confirmation code and human supertech.
But, uh, Seamans, uh,
doesn't publish this, uh,
confirmation code on official
documentation, but also,
uh, Seamon says
that it's not a vulnerability, not
Hopgood.
Well, with this code,
we can read system log.
Also, we can use these
for device memory introspection.
Very interesting.
And the last question from
the previous talk was about
that marketing directive,
which force wind and solar
plants
to be connected to central management
point not only to create
current status, but also
to actually shut down or
the USPS because it's
required by electricity market.
It's now works in Germany.
Many vendors have special
models for direct marketing
marketing to in order
to support these features.
But we ran out
of time and hope to discuss these
issues next year on our
upcoming talk.
Scotter Fantana.
Thank you.
OK, perfect, so
quick reminder, if you really do
need to leave, please do so as quietly
as possible and if you can
stick around for the next couple of
minutes until we're completely finished.
If you have questions for the three
speakers, please go to one of the six
microphones in this room
so we can all hear you.
Oh, yes, I hear we also even
give out prizes for the best,
um, questions, so additional,
you know, motivation to ask a great
question.
Um, all right.
Uh, are you lining up at Mike
for. No.
OK, all right, then we'll start with a
question from the Internet.
All right, things have you studied
anything related to the American
positive train control system?
Now, we don't know yet.
Oh, OK.
I don't know, um, do
you have another one?
OK, all right then, um, Mike,
four, please.
You said you looked
trains on Shodan and in census,
what protocols did you find them
on and how did the results compare
between the two services?
In general, you sometimes
you can find generic remote
management protocol like HTP,
like sausage from
Inside Network has bleb
showed profit that is heavily
use it. But elsewhere,
a lot of proprietary
protocols which
are not so public.
OK, I don't see any further questions
right now, so, um,
please give a warm round of applause for
our speakers.
Thank you.