SCADA & PLCs in Correctional Facilities: The Nightmare Before Christmas
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Strauchs, John
Rad, Tiffany
Newman, Teague
On Christmas Eve, a call was made from a prison warden: all of the cells on death row popped open. Many prisons and jails use SCADA systems with PLCs to open and close doors. Not sure why or if it would happen, the warden called physical security design engineer, John Strauchs, to investigate. As a result of their Stuxnet research, Rad and Newman have discovered significant vulnerabilities in PLCs used in correctional facilities by being able to remotely flip the switches to "open" or "locked closed" on cell doors and gates. Using original and publicly available exploits along with evaluating vulnerabilities in electronic and physical security designs, this talk will evaluate and demo SCADA systems and PLC vulnerabilities in correctional and government secured facilities while recommending solutions. John J. Strauchs, M.A., C.P.P., conducted the security engineering or consulting for more than 114 justice design (police, courts, and corrections) projects in his career, which included 14 federal prisons, 23 state prisons, and 27 city or county jails. He owned and operated a professional engineering firm, Systech Group, Inc., for 23 years and is President of Strauchs, LLC. He was an equity principal in charge of security engineering for Gage-Babcock & Associates and an operations officer with the U.S. Central Intelligence Agency (CIA). His company and work was an inspiration for the 1993 movie, "Sneakers" for which he was the Technical Advisor. He was a presenter at Hackers On Planet Earth (HOPE) in 2008 and DojoCon in 2010 and is a consultant for Recursion Ventures. Tiffany Strauchs Rad, BS, MBA, JD, is the President of ELCnetworks, LLC., a technology development, law and business consulting firm with offices in Portland, Maine and Washington, D.C. Her consulting projects have included business and technology development for start-ups and security consulting for U.S. government agencies. She is also a part-time Adjunct Professor in the computer science department at the University of Southern Maine teaching computer law, ethics and information security. Her academic background includes studies at Carnegie Mellon University, Oxford University, and Tsinghua University (Beijing, China). She has presented at Black Hat USA, Black Hat Abu Dhabi, Defcon 17 & 18, SecTor, Hackers on Planet Earth, Chaos Communication Congress and regional information security conferences. Tiffany also researches car computers and is fond of virus research (both biological and digital). Teague Newman is an independent information security consultant based in the Washington, D.C. area with extensive penetration testing experience. In 2009, he competed in the Netwars segment of the US Cyber Challenge and ranked within the Top 10 in the US in all rounds in which he participated. He is also an instructor for Core Security Technologies and has instructed professionals on the topics of information security and penetration testing at places like NASA, DHS, US Army, US Marine Corps (Red Team), DOE, various nuclear facilities as well as for large corporate enterprises. His projects include GPU-based password auditing and liquid nitrogen overclocking. Dora The SCADA Explorer: Exploit writer.
 Hi everyone, thank you very much for coming to our presentation. We're going to be talking about some research we did with PLCs and prisons correctional facilities. And I'll give you an introduction of my co-presenters. Sorry, I hope that's not too loud. The objectives we're going to talk about today are we're going to analyze the Skate Assistance and PLC vulnerabilities. We're going to discuss modern prison design. We have a specialist here who has designed over hundreds of prisons and correctional facilities in his career. And we're going to theorize some possible attack vectors and routines of malicious code introduction. I'm going to talk to you about ladder logic. And while it's very easy to learn and to program in this, it's part of the devil and the details of why some of the PLCs are vulnerable to some of the attacks that we've created. We're also going to recommend some solutions. Some are technical and as with a lot with security, they're also managerial. This is me. I do a lot of stuff, actually. Right now with this project, I've been doing a lot more technical work. But I'm an attorney as well. I work in Washington, D.C. most of the time, but I'm also in Portland, Maine. I'm a part-time adjunct computer science professor at the University of Southern Maine. And I'm so glad I have every year a bunch of students from that university come to DEF CON. I have a bunch of academic backgrounds. I've studied in China. It was interesting and did a lot of work overseas. I presented other black hats, DEF CON, so you may have seen me presenting it about more like freedom of speech first amendment issues, but this is the other type of research that I do. And let me turn this over to my father, John Straux, and I'll introduce himself. Well, nothing to introduce. You all can read. The only point I want to make is my specialty really is physical security. Now, that's what you all call me. Even though 99% of what I do is electronic systems. And so I did the engineering or the specs and the drawings, and I've done a lot of what's called just design, which is mostly corrections also, courthouses. All right. I am Teague Newman. I'm an independent security researcher and penetration tester. I'm based out of Northern Nevada up here and also Washington, DC. In 2009, I competed in the Net Wars challenge. It was part of the US Cyber Challenge in all the rounds that I competed in. I've played in the top 10 in the nation. I also do training and penetration testing for core security. I've taught people all over in all different facets from enterprise to government, as you can see, for places like NASA, with US Marine Corps Red Team. So I'm all over the place. Some of the stuff that I do on my own time is GPU-based password auditing. Somebody up here. And liquid nitrogen overclocking. So that's me. We also have a special member of our team, Dora the Skater Explorer, is here in the audience. But Dora did not want to appear on stage. He's an exploit writer. He has great backpack, all kinds of tricks inside with great exploits. He's good at coding. He lives in the tropical area of Columbia, Maryland. And Dora has done a lot of great work for our group, so we're very glad that Dora is here with us today in the audience. All right. One thing that we're going to describe here is we're not talking about any vendors per se. While we did do our research, as you can see, our PLC that we purchased on eBay and everything, it's up here on the table. We'll have close-ups of the picture if you can't see it. It's a big room. The Red Team always wins. So what we're here to discuss is really about, we did a lot of research and some of our attack vectors and exploits were on the control computers. This is not a talk about semen per se, but as the picture suggests, this jail facility is Alcatraz. It was designed to be no one could break out of prison there, right? Well, we did our research, you know, suggest otherwise you know this case to be true as well, but the Red Team always wins. So we're not here to discuss particular vulnerabilities because what's clear and what we're releasing in this presentation today is that with PLCs, it doesn't matter what vendor it is. So while semen is our research module there, it's not just about semen, it's about any PLC because we'll discuss and we'll show you a demo of what we've done with the control computer. All right. So why present about prison vulnerabilities? One of the big things that we're talking about here is not our exploits per se. We're not releasing our exploits. We've used it for proof of demonstration to all of you about the work that we've done, but it's really to kind of hit home the idea if you work in a facility in which PLCs exist, these are the types of things that you should know. Now all of us, most of us in this room will know what we know what PLCs are. A lot of us have learned at Stuxnet, but if you work in a correctional facility or you work in other types of facilities that have PLCs, even water treatment plants, those employees may not know what that is. This is part of the problem that we've seen in the correctional facilities is wardens, guards, or officers that work there. Their responsibility is actually, it's pretty high. Some of the vulnerabilities we saw, semen's or GE, whatever, the essence of they can't fix them. What needs to be done is these people working in these facilities need to know that there are devices that can be vulnerable to attacks. So the US puts a lot of money and funding into securing some of our, you know, what we call, you know, the US's assets of high-secure facilities, bank vaults, things like that where you may see PLCs. But when it comes to our countries, shall we say, worst liabilities, in a sense, we are encouraging some heightened security because of the discoveries that we've made. So we're trying to talk to the people who do work in correctional facilities, and that's why we went public with our research. And we'll tell you about a little bit how we did that, but a lot of law enforcement agents, too, we talked about who work in these prison facilities, didn't really know much about this, so we're bringing awareness to that issue. So when we did the research, because this has to do with the US correctional facilities that we were looking at, we briefed some federal agencies. You can see from this slide, they're friends, they're friendly, but what's great is that when we said, hey, we found this vulnerability, we want to talk to you about it, it took about two months to really get together everyone from these agencies. But when we did, it was a positive experience in the sense that they were willing to listen and talk to us about what we did. And they were allowing us to present here, and that's why we're really grateful for this, because it's not, we didn't talk to Siemens or GE because it's really about the correctional facilities in this presentation we're doing. So we were glad and we are grateful to those agencies who allowed us to do this presentation. All right, so the story of Christmas Eve, as you may see in the bio, or in the bio, the abstract of our presentation, all the doors on death row popped open a little while ago. And I'm going to have John Straux here, my dad tell you about the story of Christmas Eve because he was called in to figure out why death row, all the doors popped open. And it's also kind of the basis of this whole entire presentation. And that is quite some time ago I had designed an electronic security system that is all the electronics for a state penitentiary that included a death row as a maximum security facility. We were done, it was occupied, inmates were brought in, the thing was running, everything seemed to be going fine. And then Christmas Eve, I'm at home and I get a call from the warden. All the doors and death row had popped open spontaneously. That concerned him, now it turned out nothing really bad happened, they've got everybody in. But it concerned me a little bit in terms of what could have happened and liability and things like that. So we'd immediately went out there and try to track down what caused it. What it turned out to be was the contractor had not used the manufacturers and model numbers of the equipment we had exactly specified. They had made some substitutions. Now in hindsight, in all likelihood I would have proved the substitutions, but the problem was the two components, that is a PLC and a relay, had never been used at a correctional facility before. And some kind of voltage surge occurred and there was a printed circuit board that had a one-way diode on it as we found out and it was leaking voltage. And it was leaking just enough, not very much, just enough to trip the relays which then opened up all the doors. Easily fixed. Now go forward in time and I'm sitting there watching news about Stuxnet in Iran and how they attacked the PLCs and got the centrifuges moving fast and I had a eureka moment. I said, wait a minute. We had that happen at a high security prison accidentally. What could you do if you did something deliberately? And the other thing that occurred to me was, wait a minute, nobody knows that PLCs are used in prisons. They really don't. Most large security systems don't use PLCs. We'll get into this again later why you use PLCs in prisons, but if most people don't know that PLCs are used in prisons then all the skater talk about skater attacks is focused on power grids and nuclear facilities and all kinds of other things, but not prisons. And it's a vulnerability that if you know about it, you can protect yourself because 98, 99% of the solution to the problem is procedural, not technical. So this research idea started a lot with looking at the Stuxnet and those of us that were interested in following that the code is very well designed, well engineered. I mean it took a lot of professionals, but Haraps and Aitian State, I'm sure you've all heard those theories, but I got this idea to start looking at where else PLCs that are vulnerable might exist and I got to give credit to Tom Parker and FX. They're not a part of this research project per se, but they have really fantastic analyses they've done of Stuxnet. I mean going through line by line with the code and then Black Hat Abu Dhabi last year, we all got to sit down and really talk about some of the essence of what makes Stuxnet unique. And so after these presentations, I came back to the US and I sat down with my father who has a lot of design experience and then with Teg who's a fantastic penetration tester. And that's when we said, wow, this could be interesting. So what if someone wrote a worm or a virus that could affect correctional facilities? That was our big question. All right, so I'm going to turn it over. My dad's going to do a big section now on the design of prisons and the reason this is important, if you understand the structure and why things are designed in prisons, you'll understand why some of the PLCs and where they're vulnerable is a problem. Culinary Institute of America. And also work, we actually had a really neat wave file we're going to play but apparently we can't do that right now. So that has nothing to do with anything. Started with Stuxnet. TAC was, and this is what I read, not personal knowledge, again, step seven of the Siemens software and apparently there's some Microsoft patches you can do that minimize this vulnerability. But it goes back to the fact that it's all about the programmable logic controller, the PLC. It's not just the SCADA systems for like power lines, pipelines, water systems. Prisons use PLCs. Now let's go back to nomenclature just for a minute. What is a prison or a penitentiary? A prison or a penitentiary is something that's probably run by the federal government or the state government. It's confinement for a year to life. I mean it's serious confinement. When people talk about a jail, and a lot of times they use the terms improperly, a jail is usually a county, city, or town facility and confinement is usually less than a year. The only thing about a jail that makes them a little bit interesting is some jails could be really huge. As pointed out, Orange County Jail in California has 2,500 inmates. And the other thing about a jail that makes them important to look at is a jail is often used for pretrial confinement. That is, while you're waiting trial, they put you in jail. So you could be a pickpocket, you could be a terrorist, you could be a serial killer. So anybody could be in a jail even though the confinement is very low. In the United States, there are about, I think exactly right now, 117 federal correction facilities, 1,700 prisons that is state penitentiaries, 3,000 jails throughout the United States. And of these correction facilities, about 160 are operated privately. And most, possibly all, I haven't surveyed them also, I can't speak definitively, use PLC's and their electronics. That's me in jail. Now we're going to this because if you, to understand what the vulnerability really is, you've got to understand how a prison operates or a jail, large jail operates and what the electronics are and how it works. This is the contemporary design of a jail. It involves a central control and housing pods for housing controls. And the whole idea is ergonomics. And that is, it's no longer the way Hollywood portrayed large prisons where there are long cell blocks with bars, in fact most new modern facilities don't even have bars. They have solid doors with vision panels. But these long cell blocks don't exist. The idea is ergonomics is central control can see down those alleys into every housing pod. The control in every housing pod ideally can see every single cell. So there's visual contact with everybody you're managing. And that minimizes the number of people that you need to operate the facility. Coming back to a point I made earlier is, I have heard two misconceptions. One is that some people think that PLCs are used in all security systems. And as I said, they're not. Most large security systems, for example, use some kind of operating system that's specifically written and designed for security systems. The two probably most common ones people know are Lanell International's On Guard or Software House Secure 9000. And there are a bunch of others. But those are two really big ones that have a big share of the market. They don't use PLCs. Now are there similarities between what they use in the PLC? Of course there are. The only thing is their controllers or their data gathering panels, whatever you want to call them, are smarter, more multifunctional, multitasking, much more state of the art. Now no one's ever tested those systems so I can't really speak to it. But you wouldn't put a PLC. Now why do you use a PLC in a prison? The reason is it's very simple. It's very basic. It's easy to program. And more importantly, it's easy to track. Because nine times out of ten after you do your programming, say you're doing two, three hundred cells, or five, six hundred cells, that could equate to twenty, thirty thousand points in a system. If you did conventional programming, that's one heck of a lot of tracking you have to do. Some's not working. You know, this button is supposed to do this. When you use ladder logic, it simplifies it. Because when you print it out, particularly in a long sheet of paper, it looks like a ladder. And you could follow the lines, trace them with your fingers, and it'll go from this point down to this point down to this point, and it ends up where you want to go. It's that simplicity and vulnerability that make it vulnerable. I also want to make one correction, is that we've been doing some news interviews. One of the news interviews seemed implied that I said that corrections officers weren't smart or should have known this stuff. How many people here drive a car? How many of you know what a PCV valve is? Or if you do, most don't. Just because you drive a car doesn't mean you're required to know what a positive crankcase ventilation valve is. It's a very important valve, particularly in older cars. And that's the point, is why should a corrections officer, or a warden, or an administrator know what a PLC is or how it's programmed? Their specialty, their skills are to operate the facility as efficiently and probably with not enough people and not enough money, and try to make it work well. That's their job. So I don't mean anything that I've said or whatever counts me being oppressed, and I'm not criticizing the corrections industry or corrections officers. This is the same kind of design. It doesn't look like a spoke of a wheel, but it's the same concept. It's ergonomics that is vision lines for control. You can see, in other words, our rule of thumb was when we designed was if you could directly see the door, then you didn't need a video camera there or anything else. You couldn't see the door, you put a camera there. And not only that, you put a camera on both sides of the door, not just one side, so that you can see if somebody, for example, is under duress or being compelled to do something. Many have hundreds of cells, but all but the smallest jails or prisons have some kind of central control. So what does it look like? Starts out with the central control. This is the hub of the wheel. This is the brain of the entire facility, and it runs everything, virtually everything. Even things like showers and lights, depending on what state and jurisdiction you're in, they have different rules. But the whole purpose of the entire facility is obviously about door control, to keep people in and monitor locks, cell noix and motors, and to monitor sensors where it limits switches. We also monitor many other kinds of systems, like closed circuit video surveillance, duress alarms, that is, someone is being held at knife point or shank point, I guess, vernacular, intercoms. And some facilities, not all of them, have some kind of perimeter. And a lot of times there's a perimeter patrol, that is, there's a fence intrusion detection system, concertina wire, barbed wire, and so forth. Those things tend to nuisance a false alarm at higher rates. And they sometimes have patrol vehicles out there that have a graphic interface, sometimes that graphic interface between a patrol vehicle and central control is radio frequency, which you got to remember, the big boom in prison and jail construction was about 15, 20 years ago, and back then nobody talked about cybersecurity or viruses or any of that stuff. It just wasn't important back then. And these facilities are still operating and they haven't changed hardly at all. They all go back, all these activities go back to a program or a logic controller, usually it's a self-standing rack someplace in an equipment room, not in a control room. In some places there will be a big relay bank because the PLCs themselves don't have the ability or the power to do things. Again, it's basically a very dumb form of multiplexing basically. And they control many functions. Now this is a very simple up-fied block diagram of what works. And T.A. and Tiffany will be going back to this shortly. You basically have inputs and the inputs are panel switches, lock sensors, door sensors. You want to know that the door is closed and you want to know that the door is locked. In the early days, for example, when electronics were first introduced, inmates found that they could put pencils in the track on a sliding door. Wires sliding doors preferred over swing doors. The biggest reason is safety of the corrections officer. Swing doors often end up putting corrections officers in the hospital because some of these inmates have nothing to lose either that or they have no sense of consequences. And they'll slam that iron door shut. So sliders are preferred even though it was slightly more expensive. They'll put pencils in there and sometimes they'll jam up the door right up to the point where before the limit switch trips. So you think the door is locked but it really isn't because the limit switch hasn't tripped yet. There are by most accounts 40 to 50 manufacturers of PLCs throughout the world. These are the most common ones used in correctional facilities. And of these I'd say the top ones are Alan Bradley, GE and Square D. Now here's some very basic PLC facts. Two points here in terms of protocols. Lawn works is real popular. I don't know. Again, this is a different industry for me also. You may not be familiar with lawn works. But the objective of lawn works is primarily one thing. It's to minimize by as much as 40% the amount of wiring conduit you use. And wire conduit and correct facility could end up being tens of thousands of dollars in cost savings or much more. Another thing is programming language. The most common programming language for PLCs was then, is still true today. Maybe after our presentation it might change, is ladder logic. Simply because it's easy to follow, easy to track, easy to review. It doesn't mean you couldn't use any of the other languages to program your PLC. It's just simply that they don't. And again, back 15, 20 years ago at the boom of correction facility design and construction, it was the most common sense thing to do, make it as simple as possible. In large facilities, PLCs monitor thousands of points. Contact closures that then control hundreds of devices, mostly motors and solenoids. Here's one schematic design, but a better one to look at would be this one. And the point I want to make here is that now, you probably are not going to monitor 34 points, but if you want it to be a purist about it and know the exact status of this one door, you could monitor 34 points just on this one schematic. And that's another reason why the PLC is ideal, so easy to review. And Tegh might bring this up a little bit later, but a little note down there under the note. Speed control. We were playing around with, well, if you did it maliciously, what could you do? Well, I remember a demonstration using pneumatic sliding doors that basically are air-driven pistons. And I saw that when we turned off the speed control switch, we could actually crack a two-by-four and a half using the door. So if you wanted to, for example, hurt somebody, that'd be one way of doing it. And then all the way out, not just inside of SILDI, even the fence sallyport gates ultimately are controlled, back at the central control. Now during the day, for example, there'll be direct control right at the sallyport gate. But say two o'clock in the morning, again, they're short staffed, don't have enough people. A lot of times they'll switch control back to central control. At that point, you would have a vulnerability going from inside a correct facility all the way out to the gate. During the day, you probably would not, because they'll have what's called direct control, and the only way central control would take it over is through an override, which you would rarely do. And we're going to harp on this a number of times, and I'll repeat it again one more time right now, because it's so important. 38, 99% of the solution to fix to this vulnerability is procedural, not technical. And in fact, there's probably no technical way to giving a 100% fix for the PLC vulnerability. But if you air gap it, make everybody follow strict procedures, have no unauthorized connections, you probably don't have a problem. At this point, I will turn it over to Teague and Tiffany, and they're going to look at specific vulnerabilities and infection vectors. When we did a evaluation of the facility, it was here in the U.S., and we were able to go in and take a look at both the Internet Access, some of the security there, and really talk to some of the people who work there, the guards, to get an idea of how much knowledge they had about IT, information security, and what they had in the facility. So one of the things that the vulnerabilities we found were open doors and gates. There are times when we were talking to the officers, prison guards there, where they have shorter staff, and in the morning hours when controls are shifted to central control because of staffing shortages, if you were a malicious attacker, these are some of the things that you would look at. And if you're inside a prison, you would theoretically be able to see the movement of some of the guards, so this is something that we thought would be one of the vulnerabilities. As my father said, cause phase locks, lighters to go out of phase, preventing doors from opening and closing. This was interesting too because my father's done some research and some work in fire protection, fire evaluation. And do you want to mention something about the slam doors? The mic should be working. Yeah. Oh. There's a, not on all doors, there's one feature called, you have to specify when you request a lock manufacturer, it's called a remote latch hold back. They usually use the initials for that. And the purpose of that is that if there's an evacuation, most of these, a lot of these doors are called slam locks. As soon as you slam the door shut, it's locked, the stay is locked. And the only way you can open it is with a mechanical key. Someone has to be there. And then depending on the state, some states for example, won't allow any corrections off state to open more than a certain number of doors because this assumption is it might be a smoke filled corridor. And you have to be able to identify the keys by feel. So it's a complicated process. Now if you wanted to, for example, if you were the bloods in the crypts and you wanted to get somebody on the other side, what you would do is start a mattress fire someplace, which happens every year and in fact every couple years inmates have died in now, particularly from smoking inhalation, would be to get an evacuation started. And if you knew, if you could suppress the remote latch hold back in the PLC software and you didn't like the guy behind you, all you had to do is slam the door. And that door will be locked and whoever is on the other side of the door is not going to get out. Emergency release of entire cell blocks or the entire facility. We are going to be discussing, and Tee's going to mention it to you, a cascading release where you, if you release all of the doors at once, it actually can break the locks and cause pretty severe damage. So we discussed, I think Tee's going to mention a little bit more of that in his part that he's doing. And perimeter fence intrusion detection systems have high rates of false alarms. So that's another vulnerability we looked at. And one of the things that a lot of people have asked us about this presentation is, well, this is not possible because the prison system is not on the Internet. You know, it's supposed to be, you know, it's a high secure facility, including maximum security, they should be off the Internet. Well, when we did some research and we actually looked at a facility, it's not as, the IT and the way that they set up the networks in some cases was an afterthought. They designed the prison and the security in it, and then the networks and all that came in later after it had been designed. And some of the IT contractors maybe didn't have backgrounds in security. So what we found is that the systems are not as air gapped as you may think. There's not as much network segmentation as you may think. And we were able to see some problems with that. One of the problems we found is that the PLCs and the control computers, those things need some patching and updates, things like that. So inside the central control center that you remember from the picture we had up there, there's an electronic, not electronic, but there's like a computer room, equipment room. That's where a lot of the computers are. And when Tee and I did our evaluation, we were able to go and take a look at this stuff. And some of the stuff we found was surprising. Also, if there's a commissary or sometimes some of the lower security prisons, stuff like that, they have like vendors, fast food vendors and stuff that sell food in the facility. Those have a lot of internet connections to order food, order supplies, things like that. We were able in one circumstance to trace that network back to the control room. So if that is an attack back vector that we looked at, that you shouldn't be able to get from the commissary to the control room, but we did see that that was something that we did see. So we are dismissing the myth that the PLCs are, they're invulnerable because they're not connected to the internet. This is another thing that we saw that if people are in the control room, just like the Stuxnet attack, if you have a USB drive, something like that, that's how you can create or the infection can take place. So when we were at this facility on site, we saw IT was there doing some fixes on something. They were in the equipment room unsupervised. And maybe at this particular facility, the guards knew who these guys were. But what we found is when we follow them down in there, you know, it's, we didn't see anything back going on with them, but we, it's the type of attack factor when we're thinking about it. That's the way that you could get that in there. So another thing we found is that there was an interesting story, and it's in our white paper about when patrol vehicles, when they get close to, for instance, like police stations, small jails, things connected to courthouses when they're bringing in inmates or people that are standing trial, if they had a video camera, the video is actually transferred like via Wi-Fi to the control computer inside of the prison. And Tia, can you mention more about that? Yeah, so is this working? All right, so what occurs is some of these DVRs now, when they get within range, they're actually just start uploading video files to essentially the jail land to a storage machine on there. Well, it's been proven at this point that the, some of the DVRs in the police cars had public IP addresses, and they actually have been hacked remotely, compromised, and they were able to upload whatever type of file they wanted instead of a video file to whatever the storage unit, you know, the SAN or NAS or whatever would be at that particular facility. Number of other things were also able to be done, such as watch the video live, but the most interesting thing is that the DVR, in fact, was on a public IP address. It was compromised, and they were able to upload a file to within the jail that was not a video. And from a story we read that some of those, some people have figured out that if they live near a jail, they can pick this up. It was not an encrypted signal, and the videos went up on YouTube, so that was unfortunate. So they definitely need some guidance or assistance from the InfoSec community, so we're here doing this part of that reason. So something we saw that was most alarming though that really got us to say, we want to talk to the government soon because we'd really like some prison warden's guards and the federal bureau of prison to start training people working in these facilities why you need to not access Gmail, not access Twitter from the control computer. We did see that. So we're in the control room, and Tic was down in the equipment room looking at the PLCs, things like that, and I'm up there, and we're watching someone on the control computer pulling up Gmail. And that was a, that's one of the concerns we found is it's, if they knew why this is very risky, both for their lives and those of the public at large, I'm sure they wouldn't do that, but sometimes, and we've, my father and I have talked to a lot of law enforcement officers, you know, it gets really late at night, people get bored, they're going to start checking Facebook, things like that. They need to know why they should not do that inside the control room particularly, and this is why we're glad to be talking about this, because we did see that. So you can cause widespread panic, pandemonium, either by locking all the cell doors down, opening them up, so the cascade program we talked about, you can destroy all the locks all in one go. So there are a lot of reasons why, if you work in these facilities, no, that Stuxnet is not just something in a round, it's not just something that affects nuclear power plants. It can affect your facilities here, the prison in which you work. So Tic and I are going to discuss some infection vectors we talked about. So I'm going to talk about some of the infection vectors from without. So we talked about the software updates, straight forward malicious attacks from outside the facility. There have been other research that have shown that some PLCs are connected to the Internet and it's something that, if you know the model number and all that, that make the attack vector a lot easier. Malicious attacks from outside the sanitize point, connections to the outside, we saw that, I mean we've seen connections to the commissary, connections to the outside on the control computer via checking Gmail. So there are a lot of ways that if we want to do a malicious attack, we could do it. So also from without, clearly at this point we have seen that someone was checking their Gmail from the control computer. So a client side attack vector is completely within scope at that point in time because we know that it has, you know, they are checking email. Of course from out, again, there is potential via these DVRs. They are uploading wirelessly from the police cars and now this would be within a jail, not a prison. But you also have to look, well, if they are uploading wirelessly, there is wireless there as well. Now how does the network segmentation look in that situation? Clearly, it will probably be different everywhere but it's probably not always going to be done correctly. It's just rare to see it done perfect all the time. Within, obviously, we have the typical social engineering attack vectors. We have seen people, technicians working alone in the equipment room who says they are really technicians, right? Stucks pretty well prove that even if stuff is air gapped, it doesn't particularly matter. You can still compromise it. So obviously the other thing to think about as well is people say that Stucks was via a USB drive. Now think about all the stuff we have now with the teensies and everything else. It doesn't just have to be a USB drive. It can be any particular HID interface. So obviously there is clearly all the social engineering vectors and there are a number of external vectors as well. All right. So we talked about we don't believe that in all facilities internet access is isolated. There is some maximum security facilities we saw that the person has had some access to a computer that they, we read this at an article and the next article said, well, the prisoners are finding all these flaws in it so they are essentially red teaming it in a way and then the prison is fixing all the holes they found including buffer overflows that they saw the prisoners were doing. So this is the internet access isolated. We don't know from that system but it's a type of thing that they need to be very cautious about this. So what kind of badness is possible? This is where we are going to talk about, I'm just going to briefly say this is how we set up our basement lab. We're going to, T is going to give you some pictures of that and we're going to have a demo of our PLC what we're working but okay. So the worst day scenario one of them is open all the doors. Mayhem, open some of the doors. Release from prison. Is this unlikely but maybe you still have to get past the guys with the guns so that's a little difficult as well. But in the past 30 years helicopters have been used for prison escapes eight times. Six of which were initially successful. They were picked up later for other things but which event is more unlikely. So when we hear that this is really unlikely this might happen. There have been some very unlikely things with helicopters but we think that because of the stocks net and the copycats, things like that, it actually may become a lot more likely. We can close all the doors during a fire. Let's say you don't want to witness to testify against you in trial, lock all the doors and if there's a fire everyone perishes in that side. So prisoners are locked in, locked down a housing unit. So how much did this research cost us? And when some people say that to do this type of PLC research it's going to cost, you know, it's going to take a big lab and a research facility and a lot of money to do it, it did not for us at all. It cost us $2,500. Most of those were in legit licenses. We made it clear that we saw the licenses elsewhere but because we're doing this well, and also we wanted to get the legit license so we could do a lot of research on it as well. But we bought this from the vendor and the Siemens model that you see here is the S7300, the same one exploited by Stuxnet, it's the same one that we do see in some prisons. And there are a lot of exploits that are available that we found, exploitdatabase.com or exploitdb.com. There are a lot that are free, they're out there. So our exploits, by the way, they're unique to some others that have been done out there but they're pretty simple to write. I've seen some buffer overflows on the stack, 30 lines of code. I mean, that's not difficult at all to do. So we had a lot of fun doing this type of research and Tee's going to now talk to you about our basement lab, what we had set up. So for the lab, it's a computer with that plugged into it. It could literally be this right here. There's nothing spectacular about it. All you need is a machine that will run the software and a way to connect the PLC to that machine. It's nothing fancy. We set it up in about 10 minutes. So definitely not advanced persistent threat. So anyhow, that's what the lab looks like. That is the machine with the PLC on the table. That's all. That's what we use to research this. And this is the programming language. This is just an example of it. It's as easy as if you have taken some basic computer science engineering classes, really understanding just a lot of logical gates. For instance, this is an and, this is an or. And what you see below is what it's going to look like in the program. So it is pretty simple to get this work if you understand the logical diagrams there. So for these attack vectors, as we said, we do have exploits of our own. But there are publicly available exploits. I mean, there's a handful out there. You can find them at exploit DB. There is some going in Metasploit right now. Luigi released like 34 exploits for SCADA systems in one day. These are not particularly difficult to obtain. All right. So now we talk about our attack vector. Our attack vector that we're demonstrating here is actually similar to what Stuxnet did. What we're doing is we are directly calling the PLC's application functions. So once you are on that machine that monitors controls or programs the PLC's, it's open season. So basically, however you get on that machine, we discuss the attack vectors. Now you're on it. What do you do? Migrate into the process, access the libraries, and call the application functions. So it's using the libraries how they're designed to be used. That's why we're saying this is not particular. We're talking to Siemens. Yes, we have that. But if the software exists and it has libraries, it's going to work across any vendor. Okay. Now we're going to do our demo. We took demo of our exploit writer. So you're going to get to hear Dora the SCADA Explorer's voice. Hopefully the audio will work on this. We've been having some trouble with audio. Okay. Before I get into the demo, I kind of want to explain some things here. So what we have is this PLC. There's a number of lights on the bottom and a number of lights on the top. And I just kind of want to make it clear what's going on. You have to use your imagination because these are just lights. But what occurs is when you flip a switch on the bottom, a light comes up on the bottom and on the top. The bottom picture it as what you would see at the monitoring computer. It says, all right, switch is flipped. So in our case, it would say the status of that door is locked. When you see the light occurring at the top, that is what the current status of the actual door in this case would be. So if the light's on up top, the door is locked. If the light's off up top, the door is unlocked. So you'll also notice in the demo, there's typically the Cascadian release programs that we talked about. That would be doors opening or closing sequentially. It wouldn't be all at once. The possibility was there that if everything occurred at once, you could have voltage in rush and you could start frying some electronics. You'll notice it's pretty easy for us to not cascade things. So anyway, just remember the bottom is what you would see in a monitoring area. And the top is what's actually occurring on the other end with the hardware. All right. So what we see in the middle here, this is our PLC. The switches on the bottom represent the actual lock control themselves. So either a physical mechanism or the software changing the state. The LEDs on the right side of this, which is represent their state. So that would be if the switch is actually physically on or off. The LEDs you see at the top represent the actual lock state, which should be like a secondary sensor that's telling you is this lock actually locked or what state it currently is in. As you see, switching back and forth, the LEDs update to show that status. Now in the software, you basically have all of the internal states, again, of the same things. You can see the lock controls and the lock states themselves. And in the software, the LEDs or the column with the true and false is basically are the state of the switches and the lock states at where they currently are. All right. So once we actually start running the exploit or not exploit the interpreter scripts, we're going to basically migrate into the controls or the communications part of the software that handles communications with the... Actually, if you want to look at the PLC real quick, it's about to trigger. And there they go. And as you can see in the software itself, the state of the switches are still currently turned on. So basically, yeah, showing that false information, really. So what we've done, if you want to show the interpreter script real quick, kind of what we've done is migrated into the communications process. Sent using the Siemens actual DLL is sent using Railgun. The communications commands to send basically any of the information to update the variables on the device itself. And basically all we did. All right. So you'll notice there with this last shot of the software too, that is basically what you would see in the control center. You'll see that in fact, all the doors are still locked and clearly on the PLC, they were not. In fact, let me embroider on that just for a second. That is, my original expectation was that we would somehow be able to control the PLC to unlock a door. Turns out we were able to do much more than that. We can now unlock the door, but tell central control it's still locked when it really isn't. Yeah, we are in fact, not only are we manipulating the physical state of the door, we are also suppressing alarms and notifications as well. Okay, can we go back to the other screen please? This is what it looks like. For those of you who can't see it up here, that was the same one in the video. So there's a close up picture of it. And this is when we toured a correctional facility, we took some pictures of the relays and PLCs and some of the wires and networks there. And we're showing you a few of those in here. These are also, by the way, our white paper was published by wire, but also it's on Core Securities' website under one of their blogs about DevCon. So you can pull up our white paper and more information on this and see more pictures. All right, so this is really the summary. We're going to be talking about the remadiation here now, which is pretty clear for what we're going to do. Use a device for its intended purposes. Those of us in this room, we get that, all right? But for those of you watching elsewhere online, Prison Wardens Guards, this is very important for you because there's some things that can't be fixed with PLCs. It's up to you, really, to those acceptable use policies have a reason why they're there. Proper network segmentation, restrict physical media, the same stuff that would prevent Stuxnet. This is the stuff that we're discussing here. So many modern jails and prisons were designed 10 years ago before these attacks were known. So what we're suggesting is evaluate some of the designs and security that you have. Take a look at the IT network very carefully because if an attack did occur on a correctional facility, it's a pretty big deal. Forcing and updating procedures and policies, really, having the guards understand why this is a big deal is the most important thing. This is the biggest risk mitigating thing that you can do is educate your employees. If you have PLCs that run safety critical operations or correctional facilities, know that these attacks can't exist. One point I'd like to make is clearly the way we're doing it, you can't really patch that. So the education is huge. How would you do it otherwise? That's why you need to, everybody always says it, but the layered defenses, you got to really have it all in place, especially for things like this that can be deemed critical infrastructure for a particular facility where it may involve lives of people. So you got to determine what's important and then implement it hard. All right. We also want to give a big shout out to Dora the Skate Explorer for being awesome. And for any of you out there or watching online, if you think that we or Dora hold the keys to the castle here, we do not. These exploits are going to be public and it's nothing that was terribly, terribly difficult to do. So we've gotten some interesting requests, I'll tell you, since some articles have been written about us and no, we won't help you. And it's the type of thing that that's one of the reasons that Dora has been very quiet here. Are we going to be taking questions in this room too? Oh, we are. Okay, great. Thanks for the feds. I'll invite them for a briefing. And special thanks to Core Security.
 Hi everyone, thank you very much for coming to our presentation.  We're going to be talking about some research we did with PLCs and prisons correctional  facilities.  And I'll give you an introduction of my co-presenters.  Sorry, I hope that's not too loud.  The objectives we're going to talk about today are we're going to analyze the Skate  Assistance and PLC vulnerabilities.  We're going to discuss modern prison design.  We have a specialist here who has designed over hundreds of prisons and correctional  facilities in his career.  And we're going to theorize some possible attack vectors and routines of malicious code  introduction.  I'm going to talk to you about ladder logic.  And while it's very easy to learn and to program in this, it's part of the devil and  the details of why some of the PLCs are vulnerable to some of the attacks that we've created.  We're also going to recommend some solutions.  Some are technical and as with a lot with security, they're also managerial.  This is me.  I do a lot of stuff, actually.  Right now with this project, I've been doing a lot more technical work.  But I'm an attorney as well.  I work in Washington, D.C. most of the time, but I'm also in Portland, Maine.  I'm a part-time adjunct computer science professor at the University of Southern Maine.  And I'm so glad I have every year a bunch of students from that university come to DEF  CON.  I have a bunch of academic backgrounds.  I've studied in China.  It was interesting and did a lot of work overseas.  I presented other black hats, DEF CON, so you may have seen me presenting it about more  like freedom of speech first amendment issues, but this is the other type of research that  I do.  And let me turn this over to my father, John Straux, and I'll introduce himself.  Well, nothing to introduce.  You all can read.  The only point I want to make is my specialty really is physical security.  Now, that's what you all call me.  Even though 99% of what I do is electronic systems.  And so I did the engineering or the specs and the drawings, and I've done a lot of what's  called just design, which is mostly corrections also, courthouses.  All right.  I am Teague Newman.  I'm an independent security researcher and penetration tester.  I'm based out of Northern Nevada up here and also Washington, DC.  In 2009, I competed in the Net Wars challenge.  It was part of the US Cyber Challenge in all the rounds that I competed in.  I've played in the top 10 in the nation.  I also do training and penetration testing for core security.  I've taught people all over in all different facets from enterprise to government, as you  can see, for places like NASA, with US Marine Corps Red Team.  So I'm all over the place.  Some of the stuff that I do on my own time is GPU-based password auditing.  Somebody up here.  And liquid nitrogen overclocking.  So that's me.  We also have a special member of our team, Dora the Skater Explorer, is here in the audience.  But Dora did not want to appear on stage.  He's an exploit writer.  He has great backpack, all kinds of tricks inside with great exploits.  He's good at coding.  He lives in the tropical area of Columbia, Maryland.  And Dora has done a lot of great work for our group, so we're very glad that Dora is  here with us today in the audience.  All right.  One thing that we're going to describe here is we're not talking about any vendors per  se.  While we did do our research, as you can see, our PLC that we purchased on eBay and everything,  it's up here on the table.  We'll have close-ups of the picture if you can't see it.  It's a big room.  The Red Team always wins.  So what we're here to discuss is really about, we did a lot of research and some of our attack  vectors and exploits were on the control computers.  This is not a talk about semen per se, but as the picture suggests, this jail facility  is Alcatraz.  It was designed to be no one could break out of prison there, right?  Well, we did our research, you know, suggest otherwise you know this case to be true as  well, but the Red Team always wins.  So we're not here to discuss particular vulnerabilities because what's clear and what we're releasing  in this presentation today is that with PLCs, it doesn't matter what vendor it is.  So while semen is our research module there, it's not just about semen, it's about any  PLC because we'll discuss and we'll show you a demo of what we've done with the control  computer.  All right.  So why present about prison vulnerabilities?  One of the big things that we're talking about here is not our exploits per se.  We're not releasing our exploits.  We've used it for proof of demonstration to all of you about the work that we've done,  but it's really to kind of hit home the idea if you work in a facility in which PLCs exist,  these are the types of things that you should know.  Now all of us, most of us in this room will know what we know what PLCs are.  A lot of us have learned at Stuxnet, but if you work in a correctional facility or you  work in other types of facilities that have PLCs, even water treatment plants, those employees  may not know what that is.  This is part of the problem that we've seen in the correctional facilities is wardens,  guards, or officers that work there.  Their responsibility is actually, it's pretty high.  Some of the vulnerabilities we saw, semen's or GE, whatever, the essence of they can't  fix them.  What needs to be done is these people working in these facilities need to know that there  are devices that can be vulnerable to attacks.  So the US puts a lot of money and funding into securing some of our, you know, what  we call, you know, the US's assets of high-secure facilities, bank vaults, things like that  where you may see PLCs.  But when it comes to our countries, shall we say, worst liabilities, in a sense, we  are encouraging some heightened security because of the discoveries that we've made.  So we're trying to talk to the people who do work in correctional facilities, and that's  why we went public with our research.  And we'll tell you about a little bit how we did that, but a lot of law enforcement  agents, too, we talked about who work in these prison facilities, didn't really know much  about this, so we're bringing awareness to that issue.  So when we did the research, because this has to do with the US correctional facilities  that we were looking at, we briefed some federal agencies.  You can see from this slide, they're friends, they're friendly, but what's great is that  when we said, hey, we found this vulnerability, we want to talk to you about it, it took about  two months to really get together everyone from these agencies.  But when we did, it was a positive experience in the sense that they were willing to listen  and talk to us about what we did.  And they were allowing us to present here, and that's why we're really grateful for this,  because it's not, we didn't talk to Siemens or GE because it's really about the correctional  facilities in this presentation we're doing.  So we were glad and we are grateful to those agencies who allowed us to do this presentation.  All right, so the story of Christmas Eve, as you may see in the bio, or in the bio,  the abstract of our presentation, all the doors on death row popped open a little while  ago.  And I'm going to have John Straux here, my dad tell you about the story of Christmas  Eve because he was called in to figure out why death row, all the doors popped open.  And it's also kind of the basis of this whole entire presentation.  And that is quite some time ago I had designed an electronic security system that is all  the electronics for a state penitentiary that included a death row as a maximum security  facility.  We were done, it was occupied, inmates were brought in, the thing was running, everything  seemed to be going fine.  And then Christmas Eve, I'm at home and I get a call from the warden.  All the doors and death row had popped open spontaneously.  That concerned him, now it turned out nothing really bad happened, they've got everybody  in.  But it concerned me a little bit in terms of what could have happened and liability and  things like that.  So we'd immediately went out there and try to track down what caused it.  What it turned out to be was the contractor had not used the manufacturers and model numbers  of the equipment we had exactly specified.  They had made some substitutions.  Now in hindsight, in all likelihood I would have proved the substitutions, but the problem  was the two components, that is a PLC and a relay, had never been used at a correctional  facility before.  And some kind of voltage surge occurred and there was a printed circuit board that had  a one-way diode on it as we found out and it was leaking voltage.  And it was leaking just enough, not very much, just enough to trip the relays which then  opened up all the doors.  Easily fixed.  Now go forward in time and I'm sitting there watching news about Stuxnet in Iran and how  they attacked the PLCs and got the centrifuges moving fast and I had a eureka moment.  I said, wait a minute.  We had that happen at a high security prison accidentally.  What could you do if you did something deliberately?  And the other thing that occurred to me was, wait a minute, nobody knows that PLCs are  used in prisons.  They really don't.  Most large security systems don't use PLCs.  We'll get into this again later why you use PLCs in prisons, but if most people don't  know that PLCs are used in prisons then all the skater talk about skater attacks is focused  on power grids and nuclear facilities and all kinds of other things, but not prisons.  And it's a vulnerability that if you know about it, you can protect yourself because  98, 99% of the solution to the problem is procedural, not technical.  So this research idea started a lot with looking at the Stuxnet and those of us that were interested  in following that the code is very well designed, well engineered.  I mean it took a lot of professionals, but Haraps and Aitian State, I'm sure you've all  heard those theories, but I got this idea to start looking at where else PLCs that are  vulnerable might exist and I got to give credit to Tom Parker and FX.  They're not a part of this research project per se, but they have really fantastic analyses  they've done of Stuxnet.  I mean going through line by line with the code and then Black Hat Abu Dhabi last year,  we all got to sit down and really talk about some of the essence of what makes Stuxnet  unique.  And so after these presentations, I came back to the US and I sat down with my father who  has a lot of design experience and then with Teg who's a fantastic penetration tester.  And that's when we said, wow, this could be interesting.  So what if someone wrote a worm or a virus that could affect correctional facilities?  That was our big question.  All right, so I'm going to turn it over.  My dad's going to do a big section now on the design of prisons and the reason this  is important, if you understand the structure and why things are designed in prisons, you'll  understand why some of the PLCs and where they're vulnerable is a problem.  Culinary Institute of America.  And also work, we actually had a really neat wave file we're going to play but apparently  we can't do that right now.  So that has nothing to do with anything.  Started with Stuxnet.  TAC was, and this is what I read, not personal knowledge, again, step seven of the Siemens  software and apparently there's some Microsoft patches you can do that minimize this vulnerability.  But it goes back to the fact that it's all about the programmable logic controller, the  PLC.  It's not just the SCADA systems for like power lines, pipelines, water systems.  Prisons use PLCs.  Now let's go back to nomenclature just for a minute.  What is a prison or a penitentiary?  A prison or a penitentiary is something that's probably run by the federal government or  the state government.  It's confinement for a year to life.  I mean it's serious confinement.  When people talk about a jail, and a lot of times they use the terms improperly, a jail  is usually a county, city, or town facility and confinement is usually less than a year.  The only thing about a jail that makes them a little bit interesting is some jails could  be really huge.  As pointed out, Orange County Jail in California has 2,500 inmates.  And the other thing about a jail that makes them important to look at is a jail is often  used for pretrial confinement.  That is, while you're waiting trial, they put you in jail.  So you could be a pickpocket, you could be a terrorist, you could be a serial killer.  So anybody could be in a jail even though the confinement is very low.  In the United States, there are about, I think exactly right now, 117 federal correction  facilities, 1,700 prisons that is state penitentiaries, 3,000 jails throughout the United States.  And of these correction facilities, about 160 are operated privately.  And most, possibly all, I haven't surveyed them also, I can't speak definitively, use  PLC's and their electronics.  That's me in jail.  Now we're going to this because if you, to understand what the vulnerability really is,  you've got to understand how a prison operates or a jail, large jail operates and what the  electronics are and how it works.  This is the contemporary design of a jail.  It involves a central control and housing pods for housing controls.  And the whole idea is ergonomics.  And that is, it's no longer the way Hollywood portrayed large prisons where there are long  cell blocks with bars, in fact most new modern facilities don't even have bars.  They have solid doors with vision panels.  But these long cell blocks don't exist.  The idea is ergonomics is central control can see down those alleys into every housing  pod.  The control in every housing pod ideally can see every single cell.  So there's visual contact with everybody you're managing.  And that minimizes the number of people that you need to operate the facility.  Coming back to a point I made earlier is, I have heard two misconceptions.  One is that some people think that PLCs are used in all security systems.  And as I said, they're not.  Most large security systems, for example, use some kind of operating system that's specifically  written and designed for security systems.  The two probably most common ones people know are Lanell International's On Guard or  Software House Secure 9000.  And there are a bunch of others.  But those are two really big ones that have a big share of the market.  They don't use PLCs.  Now are there similarities between what they use in the PLC?  Of course there are.  The only thing is their controllers or their data gathering panels, whatever you want to  call them, are smarter, more multifunctional, multitasking, much more state of the art.  Now no one's ever tested those systems so I can't really speak to it.  But you wouldn't put a PLC.  Now why do you use a PLC in a prison?  The reason is it's very simple.  It's very basic.  It's easy to program.  And more importantly, it's easy to track.  Because nine times out of ten after you do your programming, say you're doing two, three  hundred cells, or five, six hundred cells, that could equate to twenty, thirty thousand  points in a system.  If you did conventional programming, that's one heck of a lot of tracking you have to do.  Some's not working.  You know, this button is supposed to do this.  When you use ladder logic, it simplifies it.  Because when you print it out, particularly in a long sheet of paper, it looks like a  ladder.  And you could follow the lines, trace them with your fingers, and it'll go from this  point down to this point down to this point, and it ends up where you want to go.  It's that simplicity and vulnerability that make it vulnerable.  I also want to make one correction, is that we've been doing some news interviews.  One of the news interviews seemed implied that I said that corrections officers weren't  smart or should have known this stuff.  How many people here drive a car?  How many of you know what a PCV valve is?  Or if you do, most don't.  Just because you drive a car doesn't mean you're required to know what a positive crankcase  ventilation valve is.  It's a very important valve, particularly in older cars.  And that's the point, is why should a corrections officer, or a warden, or an administrator  know what a PLC is or how it's programmed?  Their specialty, their skills are to operate the facility as efficiently and probably with  not enough people and not enough money, and try to make it work well.  That's their job.  So I don't mean anything that I've said or whatever counts me being oppressed, and I'm  not criticizing the corrections industry or corrections officers.  This is the same kind of design.  It doesn't look like a spoke of a wheel, but it's the same concept.  It's ergonomics that is vision lines for control.  You can see, in other words, our rule of thumb was when we designed was if you could directly  see the door, then you didn't need a video camera there or anything else.  You couldn't see the door, you put a camera there.  And not only that, you put a camera on both sides of the door, not just one side, so that  you can see if somebody, for example, is under duress or being compelled to do something.  Many have hundreds of cells, but all but the smallest jails or prisons have some kind of  central control.  So what does it look like?  Starts out with the central control.  This is the hub of the wheel.  This is the brain of the entire facility, and it runs everything, virtually everything.  Even things like showers and lights, depending on what state and jurisdiction you're in,  they have different rules.  But the whole purpose of the entire facility is obviously about door control, to keep people  in and monitor locks, cell noix and motors, and to monitor sensors where it limits switches.  We also monitor many other kinds of systems, like closed circuit video surveillance, duress  alarms, that is, someone is being held at knife point or shank point, I guess, vernacular,  intercoms.  And some facilities, not all of them, have some kind of perimeter.  And a lot of times there's a perimeter patrol, that is, there's a fence intrusion detection  system, concertina wire, barbed wire, and so forth.  Those things tend to nuisance a false alarm at higher rates.  And they sometimes have patrol vehicles out there that have a graphic interface, sometimes  that graphic interface between a patrol vehicle and central control is radio frequency, which  you got to remember, the big boom in prison and jail construction was about 15, 20 years  ago, and back then nobody talked about cybersecurity or viruses or any of that stuff.  It just wasn't important back then.  And these facilities are still operating and they haven't changed hardly at all.  They all go back, all these activities go back to a program or a logic controller, usually  it's a self-standing rack someplace in an equipment room, not in a control room.  In some places there will be a big relay bank because the PLCs themselves don't have the  ability or the power to do things.  Again, it's basically a very dumb form of multiplexing basically.  And they control many functions.  Now this is a very simple up-fied block diagram of what works.  And T.A.  and Tiffany will be going back to this shortly.  You basically have inputs and the inputs are panel switches, lock sensors, door sensors.  You want to know that the door is closed and you want to know that the door is locked.  In the early days, for example, when electronics were first introduced, inmates found that they  could put pencils in the track on a sliding door.  Wires sliding doors preferred over swing doors.  The biggest reason is safety of the corrections officer.  Swing doors often end up putting corrections officers in the hospital because some of these  inmates have nothing to lose either that or they have no sense of consequences.  And they'll slam that iron door shut.  So sliders are preferred even though it was slightly more expensive.  They'll put pencils in there and sometimes they'll jam up the door right up to the point  where before the limit switch trips.  So you think the door is locked but it really isn't because the limit switch hasn't tripped  yet.  There are by most accounts 40 to 50 manufacturers of PLCs throughout the world.  These are the most common ones used in correctional facilities.  And of these I'd say the top ones are Alan Bradley, GE and Square D.  Now here's some very basic PLC facts.  Two points here in terms of protocols.  Lawn works is real popular.  I don't know.  Again, this is a different industry for me also.  You may not be familiar with lawn works.  But the objective of lawn works is primarily one thing.  It's to minimize by as much as 40% the amount of wiring conduit you use.  And wire conduit and correct facility could end up being tens of thousands of dollars in  cost savings or much more.  Another thing is programming language.  The most common programming language for PLCs was then, is still true today.  Maybe after our presentation it might change, is ladder logic.  Simply because it's easy to follow, easy to track, easy to review.  It doesn't mean you couldn't use any of the other languages to program your PLC.  It's just simply that they don't.  And again, back 15, 20 years ago at the boom of correction facility design and construction,  it was the most common sense thing to do, make it as simple as possible.  In large facilities, PLCs monitor thousands of points.  Contact closures that then control hundreds of devices, mostly motors and solenoids.  Here's one schematic design, but a better one to look at would be this one.  And the point I want to make here is that now, you probably are not going to monitor 34 points,  but if you want it to be a purist about it and know the exact status of this one door,  you could monitor 34 points just on this one schematic.  And that's another reason why the PLC is ideal, so easy to review.  And Tegh might bring this up a little bit later, but a little note down there under  the note.  Speed control.  We were playing around with, well, if you did it maliciously, what could you do?  Well, I remember a demonstration using pneumatic sliding doors that basically are air-driven  pistons.  And I saw that when we turned off the speed control switch, we could actually crack a  two-by-four and a half using the door.  So if you wanted to, for example, hurt somebody, that'd be one way of doing it.  And then all the way out, not just inside of SILDI, even the fence sallyport gates ultimately  are controlled, back at the central control.  Now during the day, for example, there'll be direct control right at the sallyport gate.  But say two o'clock in the morning, again, they're short staffed, don't have enough people.  A lot of times they'll switch control back to central control.  At that point, you would have a vulnerability going from inside a correct facility all the  way out to the gate.  During the day, you probably would not, because they'll have what's called direct control,  and the only way central control would take it over is through an override, which you  would rarely do.  And we're going to harp on this a number of times, and I'll repeat it again one more  time right now, because it's so important.  38, 99% of the solution to fix to this vulnerability is procedural, not technical.  And in fact, there's probably no technical way to giving a 100% fix for the PLC vulnerability.  But if you air gap it, make everybody follow strict procedures, have no unauthorized connections,  you probably don't have a problem.  At this point, I will turn it over to Teague and Tiffany, and they're going to look at  specific vulnerabilities and infection vectors.  When we did a evaluation of the facility, it was here in the U.S., and we were able to  go in and take a look at both the Internet Access, some of the security there, and really  talk to some of the people who work there, the guards, to get an idea of how much knowledge  they had about IT, information security, and what they had in the facility.  So one of the things that the vulnerabilities we found were open doors and gates.  There are times when we were talking to the officers, prison guards there, where they  have shorter staff, and in the morning hours when controls are shifted to central control  because of staffing shortages, if you were a malicious attacker, these are some of the  things that you would look at.  And if you're inside a prison, you would theoretically be able to see the movement of some of the  guards, so this is something that we thought would be one of the vulnerabilities.  As my father said, cause phase locks, lighters to go out of phase, preventing doors from  opening and closing.  This was interesting too because my father's done some research and some work in fire protection,  fire evaluation.  And do you want to mention something about the slam doors?  The mic should be working.  Yeah.  Oh.  There's a, not on all doors, there's one feature called, you have to specify when you  request a lock manufacturer, it's called a remote latch hold back.  They usually use the initials for that.  And the purpose of that is that if there's an evacuation, most of these, a lot of these  doors are called slam locks.  As soon as you slam the door shut, it's locked, the stay is locked.  And the only way you can open it is with a mechanical key.  Someone has to be there.  And then depending on the state, some states for example, won't allow any corrections off  state to open more than a certain number of doors because this assumption is it might  be a smoke filled corridor.  And you have to be able to identify the keys by feel.  So it's a complicated process.  Now if you wanted to, for example, if you were the bloods in the crypts and you wanted  to get somebody on the other side, what you would do is start a mattress fire someplace,  which happens every year and in fact every couple years inmates have died in now, particularly  from smoking inhalation, would be to get an evacuation started.  And if you knew, if you could suppress the remote latch hold back in the PLC software  and you didn't like the guy behind you, all you had to do is slam the door.  And that door will be locked and whoever is on the other side of the door is not going  to get out.  Emergency release of entire cell blocks or the entire facility.  We are going to be discussing, and Tee's going to mention it to you, a cascading release  where you, if you release all of the doors at once, it actually can break the locks and  cause pretty severe damage.  So we discussed, I think Tee's going to mention a little bit more of that in his part that  he's doing.  And perimeter fence intrusion detection systems have high rates of false alarms.  So that's another vulnerability we looked at.  And one of the things that a lot of people have asked us about this presentation is,  well, this is not possible because the prison system is not on the Internet.  You know, it's supposed to be, you know, it's a high secure facility, including maximum  security, they should be off the Internet.  Well, when we did some research and we actually looked at a facility, it's not as, the IT  and the way that they set up the networks in some cases was an afterthought.  They designed the prison and the security in it, and then the networks and all that came  in later after it had been designed.  And some of the IT contractors maybe didn't have backgrounds in security.  So what we found is that the systems are not as air gapped as you may think.  There's not as much network segmentation as you may think.  And we were able to see some problems with that.  One of the problems we found is that the PLCs and the control computers, those things need  some patching and updates, things like that.  So inside the central control center that you remember from the picture we had up there,  there's an electronic, not electronic, but there's like a computer room, equipment room.  That's where a lot of the computers are.  And when Tee and I did our evaluation, we were able to go and take a look at this stuff.  And some of the stuff we found was surprising.  Also, if there's a commissary or sometimes some of the lower security prisons, stuff like  that, they have like vendors, fast food vendors and stuff that sell food in the facility.  Those have a lot of internet connections to order food, order supplies, things like that.  We were able in one circumstance to trace that network back to the control room.  So if that is an attack back vector that we looked at, that you shouldn't be able to get  from the commissary to the control room, but we did see that that was something that we  did see.  So we are dismissing the myth that the PLCs are, they're invulnerable because they're  not connected to the internet.  This is another thing that we saw that if people are in the control room, just like  the Stuxnet attack, if you have a USB drive, something like that, that's how you can create  or the infection can take place.  So when we were at this facility on site, we saw IT was there doing some fixes on something.  They were in the equipment room unsupervised.  And maybe at this particular facility, the guards knew who these guys were.  But what we found is when we follow them down in there, you know, it's, we didn't see anything  back going on with them, but we, it's the type of attack factor when we're thinking about  it.  That's the way that you could get that in there.  So another thing we found is that there was an interesting story, and it's in our white  paper about when patrol vehicles, when they get close to, for instance, like police stations,  small jails, things connected to courthouses when they're bringing in inmates or people  that are standing trial, if they had a video camera, the video is actually transferred  like via Wi-Fi to the control computer inside of the prison.  And Tia, can you mention more about that?  Yeah, so is this working?  All right, so what occurs is some of these DVRs now, when they get within range, they're  actually just start uploading video files to essentially the jail land to a storage machine  on there.  Well, it's been proven at this point that the, some of the DVRs in the police cars had  public IP addresses, and they actually have been hacked remotely, compromised, and they  were able to upload whatever type of file they wanted instead of a video file to whatever  the storage unit, you know, the SAN or NAS or whatever would be at that particular facility.  Number of other things were also able to be done, such as watch the video live, but the  most interesting thing is that the DVR, in fact, was on a public IP address.  It was compromised, and they were able to upload a file to within the jail that was  not a video.  And from a story we read that some of those, some people have figured out that if they  live near a jail, they can pick this up.  It was not an encrypted signal, and the videos went up on YouTube, so that was unfortunate.  So they definitely need some guidance or assistance from the InfoSec community, so we're here doing  this part of that reason.  So something we saw that was most alarming though that really got us to say, we want  to talk to the government soon because we'd really like some prison warden's guards and  the federal bureau of prison to start training people working in these facilities why you  need to not access Gmail, not access Twitter from the control computer.  We did see that.  So we're in the control room, and Tic was down in the equipment room looking at the PLCs,  things like that, and I'm up there, and we're watching someone on the control computer pulling  up Gmail.  And that was a, that's one of the concerns we found is it's, if they knew why this is  very risky, both for their lives and those of the public at large, I'm sure they wouldn't  do that, but sometimes, and we've, my father and I have talked to a lot of law enforcement  officers, you know, it gets really late at night, people get bored, they're going to  start checking Facebook, things like that.  They need to know why they should not do that inside the control room particularly, and  this is why we're glad to be talking about this, because we did see that.  So you can cause widespread panic, pandemonium, either by locking all the cell doors down,  opening them up, so the cascade program we talked about, you can destroy all the locks  all in one go.  So there are a lot of reasons why, if you work in these facilities, no, that Stuxnet  is not just something in a round, it's not just something that affects nuclear power  plants.  It can affect your facilities here, the prison in which you work.  So Tic and I are going to discuss some infection vectors we talked about.  So I'm going to talk about some of the infection vectors from without.  So we talked about the software updates, straight forward malicious attacks from outside the  facility.  There have been other research that have shown that some PLCs are connected to the Internet  and it's something that, if you know the model number and all that, that make the attack  vector a lot easier.  Malicious attacks from outside the sanitize point, connections to the outside, we saw  that, I mean we've seen connections to the commissary, connections to the outside on  the control computer via checking Gmail.  So there are a lot of ways that if we want to do a malicious attack, we could do it.  So also from without, clearly at this point we have seen that someone was checking their  Gmail from the control computer.  So a client side attack vector is completely within scope at that point in time because  we know that it has, you know, they are checking email.  Of course from out, again, there is potential via these DVRs.  They are uploading wirelessly from the police cars and now this would be within a jail, not  a prison.  But you also have to look, well, if they are uploading wirelessly, there is wireless there  as well.  Now how does the network segmentation look in that situation?  Clearly, it will probably be different everywhere but it's probably not always going to be done  correctly.  It's just rare to see it done perfect all the time.  Within, obviously, we have the typical social engineering attack vectors.  We have seen people, technicians working alone in the equipment room who says they are really  technicians, right?  Stucks pretty well prove that even if stuff is air gapped, it doesn't particularly matter.  You can still compromise it.  So obviously the other thing to think about as well is people say that Stucks was via  a USB drive.  Now think about all the stuff we have now with the teensies and everything else.  It doesn't just have to be a USB drive.  It can be any particular HID interface.  So obviously there is clearly all the social engineering vectors and there are a number  of external vectors as well.  All right.  So we talked about we don't believe that in all facilities internet access is isolated.  There is some maximum security facilities we saw that the person has had some access  to a computer that they, we read this at an article and the next article said, well,  the prisoners are finding all these flaws in it so they are essentially red teaming  it in a way and then the prison is fixing all the holes they found including buffer  overflows that they saw the prisoners were doing.  So this is the internet access isolated.  We don't know from that system but it's a type of thing that they need to be very cautious  about this.  So what kind of badness is possible?  This is where we are going to talk about, I'm just going to briefly say this is how  we set up our basement lab.  We're going to, T is going to give you some pictures of that and we're going to have a  demo of our PLC what we're working but okay.  So the worst day scenario one of them is open all the doors.  Mayhem, open some of the doors.  Release from prison.  Is this unlikely but maybe you still have to get past the guys with the guns so that's  a little difficult as well.  But in the past 30 years helicopters have been used for prison escapes eight times.  Six of which were initially successful.  They were picked up later for other things but which event is more unlikely.  So when we hear that this is really unlikely this might happen.  There have been some very unlikely things with helicopters but we think that because  of the stocks net and the copycats, things like that, it actually may become a lot more  likely.  We can close all the doors during a fire.  Let's say you don't want to witness to testify against you in trial, lock all the doors and  if there's a fire everyone perishes in that side.  So prisoners are locked in, locked down a housing unit.  So how much did this research cost us?  And when some people say that to do this type of PLC research it's going to cost, you know,  it's going to take a big lab and a research facility and a lot of money to do it, it did  not for us at all.  It cost us $2,500.  Most of those were in legit licenses.  We made it clear that we saw the licenses elsewhere but because we're doing this well,  and also we wanted to get the legit license so we could do a lot of research on it as  well.  But we bought this from the vendor and the Siemens model that you see here is the S7300,  the same one exploited by Stuxnet, it's the same one that we do see in some prisons.  And there are a lot of exploits that are available that we found, exploitdatabase.com or exploitdb.com.  There are a lot that are free, they're out there.  So our exploits, by the way, they're unique to some others that have been done out there  but they're pretty simple to write.  I've seen some buffer overflows on the stack, 30 lines of code.  I mean, that's not difficult at all to do.  So we had a lot of fun doing this type of research and Tee's going to now talk to you  about our basement lab, what we had set up.  So for the lab, it's a computer with that plugged into it.  It could literally be this right here.  There's nothing spectacular about it.  All you need is a machine that will run the software and a way to connect the PLC to that  machine.  It's nothing fancy.  We set it up in about 10 minutes.  So definitely not advanced persistent threat.  So anyhow, that's what the lab looks like.  That is the machine with the PLC on the table.  That's all.  That's what we use to research this.  And this is the programming language.  This is just an example of it.  It's as easy as if you have taken some basic computer science engineering classes, really  understanding just a lot of logical gates.  For instance, this is an and, this is an or.  And what you see below is what it's going to look like in the program.  So it is pretty simple to get this work if you understand the logical diagrams there.  So for these attack vectors, as we said, we do have exploits of our own.  But there are publicly available exploits.  I mean, there's a handful out there.  You can find them at exploit DB.  There is some going in Metasploit right now.  Luigi released like 34 exploits for SCADA systems in one day.  These are not particularly difficult to obtain.  All right.  So now we talk about our attack vector.  Our attack vector that we're demonstrating here is actually similar to what Stuxnet did.  What we're doing is we are directly calling the PLC's application functions.  So once you are on that machine that monitors controls or programs the PLC's, it's open  season.  So basically, however you get on that machine, we discuss the attack vectors.  Now you're on it.  What do you do?  Migrate into the process, access the libraries, and call the application functions.  So it's using the libraries how they're designed to be used.  That's why we're saying this is not particular.  We're talking to Siemens.  Yes, we have that.  But if the software exists and it has libraries, it's going to work across any vendor.  Okay.  Now we're going to do our demo.  We took demo of our exploit writer.  So you're going to get to hear Dora the SCADA Explorer's voice.  Hopefully the audio will work on this.  We've been having some trouble with audio.  Okay.  Before I get into the demo, I kind of want to explain some things here.  So what we have is this PLC.  There's a number of lights on the bottom and a number of lights on the top.  And I just kind of want to make it clear what's going on.  You have to use your imagination because these are just lights.  But what occurs is when you flip a switch on the bottom, a light comes up on the bottom  and on the top.  The bottom picture it as what you would see at the monitoring computer.  It says, all right, switch is flipped.  So in our case, it would say the status of that door is locked.  When you see the light occurring at the top, that is what the current status of the actual  door in this case would be.  So if the light's on up top, the door is locked.  If the light's off up top, the door is unlocked.  So you'll also notice in the demo, there's typically the Cascadian release programs that  we talked about.  That would be doors opening or closing sequentially.  It wouldn't be all at once.  The possibility was there that if everything occurred at once, you could have voltage in  rush and you could start frying some electronics.  You'll notice it's pretty easy for us to not cascade things.  So anyway, just remember the bottom is what you would see in a monitoring area.  And the top is what's actually occurring on the other end with the hardware.  All right.  So what we see in the middle here, this is our PLC.  The switches on the bottom represent the actual lock control themselves.  So either a physical mechanism or the software changing the state.  The LEDs on the right side of this, which is represent their state.  So that would be if the switch is actually physically on or off.  The LEDs you see at the top represent the actual lock state, which should be like a secondary  sensor that's telling you is this lock actually locked or what state it currently is in.  As you see, switching back and forth, the LEDs update to show that status.  Now in the software, you basically have all of the internal states, again, of the same  things.  You can see the lock controls and the lock states themselves.  And in the software, the LEDs or the column with the true and false is basically are the  state of the switches and the lock states at where they currently are.  All right.  So once we actually start running the exploit or not exploit the interpreter scripts, we're  going to basically migrate into the controls or the communications part of the software  that handles communications with the...  Actually, if you want to look at the PLC real quick, it's about to trigger.  And there they go.  And as you can see in the software itself, the state of the switches are still currently  turned on.  So basically, yeah, showing that false information, really.  So what we've done, if you want to show the interpreter script real quick, kind of what  we've done is migrated into the communications process.  Sent using the Siemens actual DLL is sent using Railgun.  The communications commands to send basically any of the information to update the variables  on the device itself.  And basically all we did.  All right.  So you'll notice there with this last shot of the software too, that is basically what  you would see in the control center.  You'll see that in fact, all the doors are still locked and clearly on the PLC, they  were not.  In fact, let me embroider on that just for a second.  That is, my original expectation was that we would somehow be able to control the PLC  to unlock a door.  Turns out we were able to do much more than that.  We can now unlock the door, but tell central control it's still locked when it really isn't.  Yeah, we are in fact, not only are we manipulating the physical state of the door, we are also  suppressing alarms and notifications as well.  Okay, can we go back to the other screen please?  This is what it looks like.  For those of you who can't see it up here, that was the same one in the video.  So there's a close up picture of it.  And this is when we toured a correctional facility, we took some pictures of the relays  and PLCs and some of the wires and networks there.  And we're showing you a few of those in here.  These are also, by the way, our white paper was published by wire, but also it's on Core  Securities' website under one of their blogs about DevCon.  So you can pull up our white paper and more information on this and see more pictures.  All right, so this is really the summary.  We're going to be talking about the remadiation here now, which is pretty clear for what we're  going to do.  Use a device for its intended purposes.  Those of us in this room, we get that, all right?  But for those of you watching elsewhere online, Prison Wardens Guards, this is very important  for you because there's some things that can't be fixed with PLCs.  It's up to you, really, to those acceptable use policies have a reason why they're there.  Proper network segmentation, restrict physical media, the same stuff that would prevent  Stuxnet.  This is the stuff that we're discussing here.  So many modern jails and prisons were designed 10 years ago before these attacks were known.  So what we're suggesting is evaluate some of the designs and security that you have.  Take a look at the IT network very carefully because if an attack did occur on a correctional  facility, it's a pretty big deal.  Forcing and updating procedures and policies, really, having the guards understand why this  is a big deal is the most important thing.  This is the biggest risk mitigating thing that you can do is educate your employees.  If you have PLCs that run safety critical operations or correctional facilities, know  that these attacks can't exist.  One point I'd like to make is clearly the way we're doing it, you can't really patch  that.  So the education is huge.  How would you do it otherwise?  That's why you need to, everybody always says it, but the layered defenses, you got to really  have it all in place, especially for things like this that can be deemed critical infrastructure  for a particular facility where it may involve lives of people.  So you got to determine what's important and then implement it hard.  All right.  We also want to give a big shout out to Dora the Skate Explorer for being awesome.  And for any of you out there or watching online, if you think that we or Dora hold the keys  to the castle here, we do not.  These exploits are going to be public and it's nothing that was terribly, terribly difficult  to do.  So we've gotten some interesting requests, I'll tell you, since some articles have been  written about us and no, we won't help you.  And it's the type of thing that that's one of the reasons that Dora has been very quiet  here.  Are we going to be taking questions in this room too?  Oh, we are.  Okay, great.  Thanks for the feds.  I'll invite them for a briefing.  And special thanks to Core Security.
DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_0_407.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_408_1367.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_1368_2495.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_2496_3095.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_3096_3323.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_3324_5675.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_5676_5975.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_5976_6227.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_6228_6311.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_6312_7271.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_7272_11447.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_11448_15695.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_15696_17555.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_17556_17651.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_17652_17795.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_17796_21155.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_21156_21287.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_21288_27707.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_27708_28751.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_28752_28907.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_28908_29555.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_29556_30083.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_30084_31751.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_31752_40703.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_40704_44711.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_44712_51347.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_51348_51419.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_51420_53147.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_53148_54899.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_54900_57227.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_57228_57575.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_57576_61187.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_61188_61451.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_61452_61667.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_61668_62135.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_62136_62759.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_62760_64727.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_64728_67031.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_67032_67187.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_67188_67991.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_67992_68579.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_68580_68867.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_68868_68915.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_68916_69119.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_69120_69419.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_69420_69923.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_69924_70955.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_70956_71267.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_71268_72047.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_72048_74711.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_74712_74783.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_74784_75623.png DEF_CON_19_-_Panel_-_SCADA___PLCs_in_Correctional_Facilities__The_Nightmare_Before_Christmas_1_75624_75710.png