ICS Village - Playing with Electricity
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Temel, Serkan
Demirel, Can
Hacking Into distribution companies.
 Thank you. Hello everyone, this is Jan from Istanbul, Turkey and I am at Sarkand today and we will be talking about playing with electricity and red teaming in power distribution companies or hacking in the power distribution companies. Before getting started, I would like to thank the ICS Village team having us. It's really great opportunity to meet you all. We really like to be part of the community activities all over the world. We also some community activities in Turkey as well. So it's really great to be meeting you all over here. Basically, we have one hour with you and basically we have three parts of presentation. The first part is overview. We will make a brief information, give a brief information about the electricity architecture and power distribution company architecture and give you some scale application architecture on it. And then we will discuss red teaming scenarios and then we will perform some attacks on our simulation lab. Actually, thanks to Sarkand, our simulation lab had some nerve issues. We changed our hardware like four times last three days. But it worked at the end of today and we did videos for this presentation to await any problems. So we will have some videos and we will talk about it. All right, so let's do it. Sarkand, please go ahead and introduce yourself please. Thank you, Jan. First of all, good afternoon for American site spectator and maybe good night or good evening for the European and Asian sites spectator. First of all, I'd like to thank you for giving us opportunity in this beautiful organization and I'd like to express my pleasure being there. Now I will give information about myself. I am Sarkand Tamal. I am an electrical and electronic engineer. I have seven years experience about industrial control systems, systems based on electric distribution, transmission and power generation. For last one year of the my career, I'm focused on the cybersecurity and systems and also focused on the industrial control system, cybersecurity topics. Thank you, Jan. We can go on now presentation. I am also an electronic engineer and I have more than 80 years cybersecurity background and last five years I mostly concentrated on critical infrastructure and I say SCADA cybersecurity. At the moment, we both working for cyber-wise for critical infrastructure cybersecurity at the moment and today, as we mentioned, we will discuss electricity sub-sector and power distribution, red teaming and cybersecurity. All right. We want to start with why electricity matters actually. It's not just for us but for all the rest of the world. It's the backbone of all critical infrastructure. When it fails, it direct effects the data life or modern life fundamentals. For example, it affects health sector, transport sector, transportation and finance sector and so on. Once it fails, it directly affects people and public safety and it's really backbone of the critical infrastructure. We want to take dead parts and we wanted to build a presentation to point. We will be discussing about red teaming in power distribution companies but before it, we need to understand the electricity architecture in process-wise. Basically, it has three parts. We have power generation, we have transmission lines and then we have a power distribution part. Most of the time, power plants and power generation located in the out of the city centers. That means we need to carry electricity long way of kilometers. It means we require the transmission lines and finally, that means we need to power up-down operations. Once we are over from the transmission lines, we came up with the power distribution. Actually, it is the last line of the customer touch. I mean, if something fails in power distribution part, it directly affects customer and our business. To be honest, the distribution companies and electricity distribution process is not too much complicated when we compare the power plants or petrochemical industry. It is easy to attack and also it is the defense. Serkan, would you like to add something? At some point in that presentation, today we tell you the distribution, but I would like to be aware of the point. The transmission layer is a critical part of the electricity architecture because it is a bridge between power generation and power distribution. This is the backbone of the electricity architecture. Today's topics are distribution electricity, but transmission is very critical in the cybersecurity perspective. And actually, it depends over the countries or over the regions. Sometimes it is operated by the government. Sometimes it is operated by private companies. It really depends on the region and countries perspective. But I really agree with you that transmission lines are also the core of the electricity architecture. Thank you. So let's dive into the power or electricity distribution infrastructure. First of all, it's a really great example of the SCADA because you have people, which means the supervisory element of the SCADA, and you have remote locations. As you can see on the screen, there are lots of different substations connected via different types of communication media to your control center or emergency control center. So what we said, it's a great example of the SCADA application because you get data from all over the different remote located substations, and sometimes you control over the remote substations. So on the other hand, you have remote offices like payment offices, headquarters, government agencies to report for, or you have direct integration. For example, in Turkey, Renewables Power Plans has to report the nearest power distribution company for the regulation. Basically, what we can say, there are lots of remote locations we have that we need to control, and that means we need different types of communication media. In distribution companies, we really need to take care of the communication media security as a part of the defense mechanism. On the other hand, sometimes some companies or some governments or some countries has smart meter application, which means smart meters has direct effected electricity. They open and close the electricity via metering control center through the smart meters. Why I'm telling you this? Because it will affect our red team scenarios and understanding the infrastructure. What we need to understand from this slide, we need the loss of high level of connectivity. There are different types of communication media, and we have lots of different type of substitution and equipments. And the rest of it, we have lots of different type of integration. All right, I'm gone. All right, I will give a brief information and pass to Sarcan's stage. We discuss about the electricity architecture, and then we discuss about the power distribution architecture. Now, we will discuss about the SCADA architecture. It's also distributed in the server side. But before jumping into it, we need to understand there's a need of high level of connectivity in such a power distribution company. Sometimes we need to connect the outreach management system, ERP application, call center, and so on. Maybe Sarcan give some example about that. Yes, we mentioned about the previous presentation that we said that distribution, like the distribution, touch the customers. So this means that the distribution company, so many customers works into like customers management, outreach management, VFMs, other stuff, so many stuff for the customers. The reason of that, the distribution SCADA systems must be and have to be integrated IT software applications, like John mentioned, that's OMS. OMS, like VFM, like the other companies, third-party software. Because of that, distribution SCADA systems, LW difference from the transmission and power generation SCADA systems. And also in the distribution network, so many substations. This means that so many data, so many connection stations. So we need the power rule SCADA systems. We have to separate this load to separate servers, like application server, like communication server, like data server, like backup server, and so on, like HMI server. So distribution SCADA systems a little bit distributed and separated structure. It's very similar to IT environment, actually. You have some type of application servers, communication servers. It do some kind of load balancing, and it requires really great integration of IT application or business application. Sometimes it's part of SCADA applications, like the called outreach management system or call centers. They are directly talking or integrating with the RSCADA application. Because once you have a kind of blackout or shutdown electricity, you will get some calls. You need to reach out to customers. You need to get some data from SCADA. So it's really integrated with IT applications, sometimes cloud applications. And on the other hand, you have entrusted parties, like vendors, remote offices, other type of control centers or government agencies. So sometimes it's done via the firewall, sometimes directly connected to your industrial equipments. It really depends on the customer strategy, or sometimes they are not really aware of what kind of communication channels they have. But what we need to remember through here is that RSCADA architecture is distributed as a server roles, and it's like an IT application and it has integration with the business side. And also it talks to the substation through our communication media. So I will leave the comments to Sarkam about substation because he's expertise lots of years. Now we have talked about the substation architecture. The substation architecture is distribution substation process. We have some main devices for the process we use. The first one is RETU. RETU is a telecontroller which connects field devices to SCADA systems. We think as a data concentrator or data transfer devices RETU. Energizer is an energy meter which gets information from the CT and VT transformer from electric sites information and translates in the digital sites and give and directly send this information to SCADA systems. Protection relay, it is a critical equipment in the distribution and also transmission and also generation as you know that. Protection relay is the first IED device, first electronic device connected physical electric system. It is a bridge cyber and physical world. Reason of that protection relay is the most critical parts and most critical device in the distribution systems. As a cybersecurity perspective if you want to shutdown the electricity you have to control the protection relay but maybe you can attack the RETU maybe attack the SCADA systems. It's just blocked our monitoring from the field sites but if we want to control electricity, shutdown electricity or re-energized electricity you have to control protection relay. The fourth device is the smart meter. Smart meter as you know that's for building purposes and maybe low voltage site for customer sites, shutdown electricity or re-energized electricity. The last two devices is physical device. The first one is low-volt circuit breaker. It is controlled electricity line and the last one is the medium voltage criticals means circuit breaker also inside these criticals. It's controlled electricity line, networks. Next slide please. I think yeah yes. Yes we had line IED device protection light device. This is I would like to say it's again because it is very critical. Protection device has two parts one of the heart rate the otherwise the software. The heart rate sites they have unlock inputs, unlock output, digital input, digital output and the other cellular internet interface. Voltage and current information takes with unlock input modules and also control unlock system like set points power like set about the frequency let's set about the voltage you have to send unlock output and digital inputs and digital inputs most critical because digital inputs comes from basically circuit breaker position, isolated position, the other information about the physical systems and digital outputs is control the circuit breakers means that you control the electricity because of that in the scalar systems and most of the communication protocols or animal direction or cyber security perspective we focus on the digital output signal. In the beginning of this device they have serial interface because in that time more Ethernet IP wrote and today most of the device has Ethernet interface and it gains advantage of the Ethernet IP world but it is some cause of the site effect from cyber security this gains of advantages I will tell about later. In the software site communication protocols means that industrial communication protocol like Modbus, like Probus, like IC104, DMP3, the other this helps communicates with R2 or communicate with the SCADA systems to send information to the upper level. Logic functions control the like circuit breaker or other blocking materials functions logic functions and configuration interface this is the critical part of the AID device as I mentioned that they have Ethernet interface and most of AID device nowadays use web service interface for configuration software or configuration interface this is the some vulnerability about systems as a big point of this AID device nowadays. Thank you Sarkam. Actually we always get afraid or get freaked about touch such intelligent electronic devices because as you mentioned one part is physical that controls electricity and one part is cyber it's R2 or SCADA applications and it's like a last line of the physical and cyber breach once you control it you control the electricity you can control it through the R2 or you can directly send commands to the IID or you can trigger some SCADA application set points and it will directly affect the intelligent electronic devices but once you're planning a red teaming or pan testing activity you need to be aware of such a devices can affect the electricity and you need to be really careful what you are playing with. All right so now we can discuss about red teaming approach and red teaming scenarios. Before jumping into the details I wanted to discuss how much red is that because since it's a critical infrastructure since it's a last line of the custom touch can we be really free to be really red teaming in that case the most of the asset owners and most of the cyber security companies get afraid to avoid the consequences of that thing happens. So I may say that nobody does directly red teaming maybe it's like light pink teaming let's say because we really need to be aware of that the public safety and process safety is much more important than your color activity so you really need to take care of the process you really take care of the public safety because we always think in a that way if we shut down electricity for the hospital and if we kill someone in that hospital because of no electricity so it really has a great boundary for us to do our tests or pan testing activities or red teaming activities in a controlled way so it's not really red light pink maybe but to understand each other in a better way I want to express that part as well so I would like to mention about the core steps we divided into five main steps actually we discussed about the first two of them to understand the process understand the architecture once you do any red teaming activity in any kind of ICS infrastructure in that case we are talking about the power distribution we gave brief information about the electricity architecture distribution architecture skate architecture and substation architecture and we thought that power distribution companies process is not too much complicated we have very limited type of signals compared to power plants and petrochemicals so it's a really easy process to ease the attack and use the defense now we need to define our landscape and then we will try to create some kind of scenarios to directly develop for direct teaming activity usage and then finally we will perform some kind of attacks in our simulation lab I don't want to talk about the IT based or getting into the IT and then jumping into OT kind of red teaming activities or landscape but once you are talking about the power distribution red teaming we wanted to give you brief landscape information that what you need to know what you are going to face and how it will affect your planning so basically we have eight categories that we will discuss today the first one is protocols there are different types of protocols you will see in the field in the distribution companies basically in skater parts I mean the wide area network you will see ISC 104 and TMP3 and substation level you will see different types of protocols sometimes schools MMS and so on and upper level and supervisor level you will see soft pass and the control level you will see mobus tcpr2 even sometimes serif protocol and then if you have smart meters and even in skater application you may have the power line communication it's not it's still plc but it's different term we will discuss it today as well and then we said that communication media is very important if you get into the communication media somehow let's say you get into the apn network based on gsm or you get into the RF signals and you then directly interact with substations interact with R2s and interact with control center equipments and emergency control center equipments so communication media is also too much important for us to uh rectify planning on the other hand you need to be aware of the third part integration there are different types of integration it depends on the country and region and the regulation you see some of them in our list and also as a set owner you have some kind of remote locations or local locations like control center, energy control center, material control center, headquarter, payment offices or communication center for like RF towers so asset owner locations also matters to us on the other hand substation is very important for us because it is remote located and physical and cyber control is very limited compared to control center or emergency control center or headquarter in that case you will be facing with industry protocols on institutional devices and you may apply some kind of hopping attacks what I mean by that you once you get into the specific remote substation you can jump over the other substation you can jump over the control center or emergency control center you may create some tag signals it's like coming from the old remote substation and so on so it's very great and point and great defense point for us and but I should stress out that in substation we have some physical controls for example if someone opens the door or if someone opens the cabinet if someone moving in the substation it creates some alerts and sends signals over the one or four of the control center so we still have some type of controls that we need to be aware of when we plan associate activities or when we plan red teaming activities on the other hand technology I'm sure that all the villagers have a proper knowledge of them I don't want to express each of them because it's like the IT wise pan testing or red teaming because it's server network devices and some kind of field devices so I don't want to go each of them and on the other hand we have people for example in Turkey we have a specific regulation for assessment in the power generation and distribution companies and it requires social engineering activities for the energy people let's say the asset owner people sometimes we see that some red teaming activities hit the vendor engineers or OT partner engineering company engineers so and people's segment is also really a very and different types of mechanisms they have for example in Turkey we need to do physical pan testing we need to do phone calling we need to do email based social engineering all right and done by the regulation and also yet another landscape for us the industrial process and we will discuss it yet in another conference because since it is the less signals and it's less complicated in the power distribution and power industry the industrial process vulnerabilities may affect public safety directly so we avoid to mention the entry points of process vulnerabilities but we can discuss it later in for another industries on the following days all right so I hope we understood the process we understood the architecture and defined some kind of landscape again it may change the region country and regulation but we need to understand the basics of distribution so we need to create some kind of scenarios in this presentation we created three types of scenario we have created a specific table for that I will discuss it through them and it's again not IT based red teaming or pan testing we try to create some kind of directly effect on electricity based scenarios so in the scenario we have a chance to work with our IoT team leader and hardware security leader with Fatih Khairan actually he developed this scenario and applied in the field once upon a time we were in the distribution company and came up the idea that we figured out somehow the smart meters were controlling the city's electricity which means if we could find a way to send a proper comment smart meters it will directly shut down the electricity in that case the dead smart meters were talking through the power line communication and so we created our scenario based on this so to understand the team mates to each other in a better way we create such a table to define our success criterias difficulty factors and decide if the chain is required or not I will go through the one table and I will pass through the rest of the it because we will perform a real-time simulation for the rest of it in this scenario we targeted the shutdown electricity but before jumping into that we classified our tactic and techniques based on my tree manipulation of control and manipulation of weave and our entry points was smart meters power line communication complexity in this scenario was high difficulty was high because unknown protocols were there specific hardware design is required and high voltage work environment is can be dangerous because we lost one of our laptop and one of our team member got injured during this test because we work with the high voltage directly with the plugs and to better understanding you plug the smart meter into the city network so you turn into that specific smart meter into weepen to target the electricity for better understanding I will discuss it through this presentation so dependency was the communication interface reverse engineering or protocol reverse engineering required time was high for us and also what was our success criterias understanding protocol send and receive packets on the power line send command cutoff the electricity for a defined area sometimes we create some so c success criteria for our customers to detect better the next attacks in that case it could be hardware or smart meter log management oms log management core center log management or smart meter replication log management could be a success criteria in that case we defined log sources for redeeming activities and then we define a purpose method and a kill chain activity in that case our purpose was shut down the electricity via unexpected point of entry through unexpected communication media turn plug and matters into industrial attack equipment so our idea was simple so power line communication works through the power signals you modulate it and put your data into the electricity signals so it directly talks through the electricity in I think there yesterday there was a specific session about that in that case we will look into the how it's used in distribution companies in that case we have the power concentrator which is directly connected to different types of customers almost tightening and there are smart meters and there are some power line communication interfaces and it connects to the backend system through the APN in that case over the internet so guess what it was the broadcast messages going through the specific power line if we have specific hardware you can develop it or you can turn smart meter into the your tool in that case we made it and we were under we were able to understand the reading data and the shutdown the electricity commands so since it's broadcast each of smart meters get the data and once you give order everyone gets the order but one of them apply it and report back to center so once you sniff the data you see the smart meter ID and in that case the power line communication we're using the dlsm-ksm protocol in that case that specific number defines the shutdown the electricity command like double command in one or four very similar and also in that case we were able to get readout data in in this case this is readout code for dlsm-ksm protocol what we are trying to say that you don't directly attack the SCADA application R2 user IEDs the best way and easy way find the yet another proper line end of your goal so in that case the power line communication and smart meters gave us a chance to shut down the electricity but you need to deal with high voltage electricity you need to deal with power line communication new type of protocols modulation demodulation and encryption type of things require much more time but most of the time the acetoners and the pentesters doesn't pay attention on the deck channel so you really create a volume for your customer and people safety in that case so as I know the European countries also have great implementation of smart meters we need to take care of these standards as well okay so our last two scenarios based on the R2s and industrial protocols we will show how to do it industrial red teaming in a real lab environment which took days for Serkan and got all during these sessions basically we have two different scenarios for this presentation one of them extracting data from config files without further reverse engineering or further implementation of anything and think about that you have some type of configuration files you don't have any access to OT environment or substation yet but you will figure out some type of data to plan your next session of red teaming activities we have a specific example of that since I discussed a deeply and very detailed the last table I don't want to discuss it the losing any time on that so I will jump into the next one because we will discuss it real scenario to get another scenario for this session is the remote substation protocol attack in that case the attacker needs to interact with the substation equipments it can be done and via Raspberry Pi implementation and connect through the Wi-Fi and so on like we did in our lab environment and we will shut down the electricity using the protocol commands once we understand what kind of protocols used and how once we understand the protocols we will figure it out to where the center data and final center data to shut down the electricity to have better understanding each other what we are trying to say if you are planning to work teaming activity in a power distribution company or assessment you need to understand the process you need to understand architecture you need to understand landscape once you have a tree element then you can create your scenarios you need to think out of the box but that box doesn't mean you can go out public safety rules or process safety rules so it's really hard to balance and we want to give you some simple ideas to reach out your end goal rather than implementing some IT based or IT related red teaming activities I think I can be free from now and put second into fire as a tradition we face to face with the Murphy's room but finally we succeed on the setup of lab now I have you information about lab setup it's a very simple part of substation process we have one arches abd140 and one id device one scada server scada pieces and also one switch we use cap player software as a scada master and also we use mod plus tc protocol and also is one over four protocol mod plus tcp use in id device between r2 and is one over four we use it r2 between scada sm cap player device the tricky part is the heart implemented hardware substation as an attacker we think that we have some Raspberry device or the other device as attacker machine before jumping into the tails I would like to mention that this setup doesn't indicate any one of these on abv arches it's just a simple arches that we could use on the market and we know how to configure it so we will do some protocol based simulation but it doesn't just affect the abv it's based on we leverage of the protocol usage actually to avoid any misunderstanding and also it is very common r2 used in europe and asian sites this and also this is the second reason we choose this r2 now we can jump into the laps video all right so we will start with interfaces and signals the first video is about configuration r2 I jump into that just a second yes we use r2 until 500 software for programming criteria configuration r2 we created it before an open existing project this part a little bit takes time it may be boring they hide the project file deep inside my file system yes and Turkish character error now this is the r2 util 500 software interface this is the network tree we have three communication line one is is one of four for scada communication the other one is mod plus tcp for id device mod plus communication line you can easily see that some parameter of the communication protocol yes it is the one on four communication protocol setup as you see that's astro address astro address structure inform structure maximum length of id and then this is the mod plus tcp side configuration this is network tree now we in hardware tree in the hardware sites we choose our r2 main cpu model and also we add the field level signal information in that site hardware site and also as you see that the mod plus communication configuration zone this is the ip address of the id device and also the again one of four configuration section now this is the r2 interfaces this is the day it has two eternal interfaces as you see that ip address of the interfaces and this site we configured our field level signal like active power that is the mod bus site retolding register index number 13 and this is the scada is one of four sites astro address one information object address 103 and the other single like phase a current phase b current we record all and show the all parameters of the signal because you may want to online and maybe you want to replay your own lab so if you want to give you brief info the other sections will be much much faster let's say but once you understand that part configuration and it's much more easier to understand the rest of the simulation this is the type of the mod bus signal as you see that force commands signal commands and register read call status with cost as used for the information single point information digital input like position of circuit breaker and switch control means that sense control command to circuit breaker power limit set points and the other meter inch information phase a current phase b current phase c current it's a very simple model of the substation so we can jump into the second report in this report we directly connect the retu web interfaces as you see that's this is the ip address of the first internet interface use username and passport in that set you can easily see that configuration management site you'll see that the configuration file which configuration is now active when you update this configuration file and also gets configuration file from the device and also delete this configuration etc and also direct on sites you can easily monitor signal system log system event status and client station look and also hardware tree hardware tree is the live monitoring about r2 especially in the site you see that r2 is active r2 is operable means that it's connected to ied device as you see that's cpi switch position is on and also meter inch information about systems it's live data real-time data now i can talk about a little bit configuration file if you wish our third video related to configuration file and extracting some data again it doesn't integrate any wonder with t-zone to r2 but somehow if you reach out backup systems or if you reach out the file server and the it system once we have a configuration file now we will download it and extract some data from it it's really easy actually before furthering reverse engineering implementation in that case we are not into the remit substation we are not in the control room somehow we get data about the configuration file it can be engineering workstation part server again or backup system maybe a engineering partner workstation once i get the configuration file i am directly able to see what kind of r2 is used what version and what purpose they are using what kind of interfaces and what kind of ip addresses they have and sorry and also what kind of protocols they have it will affect my further planning actually in your red teaming activity what kind of devices connected to that r2 in substation and what kind of signal parameters they are looking for it so once i have that information without any probing any scanning activity or any physical attachment it's really the average of your efforts once you have that kind of specific knowledge we have also some specific projects that reverse engineering to read all the data not not people readable format at the moment you have much more better information and knowledge about the targeted system so in that case we want to show you you don't need to go to the control center of remote substation somehow if you are able to get config files you may read directly with the not pet plus plus and read some data understand the process understand the protocols interfaces and plan a better red teaming activity or targeted attack into the targeted system so i will jump into the your part sir i can yes before we do is about the normal traditional application and communication with scada systems and retu first of all i will show to my ip address and same subnet with r2 interface one and then we use set before kept server as a scada software scada master program this is the configuration of the master sites kept their sites kept server sites configuration file as we see that communication address common address advanced settings network interface as we have same subnet same address more advanced parameter for ac1 and 4 originator address like and also network interface network interface means that it's the red ip of the radio and the port of the is one of our port and this site we also configure our signal this means that it is analog short float volume astralis one of three and so it is the breaker control commands command single command means j say j actually it will directly affect the open and close uh breakers uh later then we will apply some scenarios it's really important to understand what type of parameter and what type of commands they take how we connected to our cheer as you see that this is the real-time data as you see active power 2400 and also breaker control is zero breaker position is one means that the closed now we sent the breaker control control command is one yes it takes the commands in the real-time and real-time operation when we sent this command we reanalyzed circuit breaker or shut down the circuit breaker with this command all right now and also I would like to show some wire shark track trafics between kepp wire and re2 this is the alternates we apply our display filter for is104 yes as you see that this is the test frame in the protocol so now we re-sent the command again and show the traffic yes this is command single command astralis one over seven as you see that this is the wire shark single command address is one i address is 107 and also set command value is zero as you see you can easily get this information from the wire shark because the is104 is an open text protocol not encrypted or hashing port hash protocol you can easily get information from the traffic in that case you see that the single or double command take place in is104 in that case we sent a specific shutdown or open command in a targeted area in case it was zero it means we shut down the electricity through a legitimate traffic I mean it was a traffic generated by the control center now we will try to apply as an attacker point of view who is in the remote substation via implemented hardware this is the five video of us yes we have information about the second interface about r2 now in the attacker machine I configure my IP address for the second interface of the r2 as you see now I use mmap for some research and some search functionality or open ports in that case we are looking for who has an is104 in that case in that protocol use specific ports if nobody changes so we are looking for in same subnet if someone has that specific protocol please be aware it's an attacker point of view and got into the substation looking for some is104 endpoints and two devices we found it this is the r2 device as you see from the IP address and also is104 is open port and also services up but now we have only information about r2's protocols and r2's ip address but we don't any information about the signal and signal address now we use capware again we configure capware again as you see we tried it one now it's connected to r2 now in the protocol structure we have a general integration command when we send this command r2 get a response and sends all information about in this r2 insight we send gii command to the r2 I don't know any information about the object address but when we send this command r2 response to this commands and now we can easily observe which address and which type of information inside of it as you see that so this is one IO address is 100 and value is also as you see 332 etc etc so basically protocol gives an opportunity to us to pull all kind of signals and data from the r2 for a specific protocol line as an attacker we use the exact same tool but it's simulation environment again you can use your lab environment that specific tool yet another tool we have it's developed by I think the master degree student in Germany called ISE test and to be make sure all of you we will send the latest command through the that specific tool call next again r2 now we send command again get information from terrific and also we sent commands to 107 as you see from wire shack traffic we sent commands and also on of on commands and also as you from terrific it is action confirmation from r2 in number of line 18 and 37 jcs cna x confirmation as you see this means that's r2 accept this comment basically resist this comment once you get into the substation you pull data through the protocol and you send the command through the protocol again in that case single commander double command supported by the 104 and then you are able to shut down the electricity in that case if it's your end goal you may apply very different type of scenarios and redeeming activities but we want to show you that it can be done there are some safety mechanisms or configuration mechanisms to avoid it sometimes you implement the IP based solution or animal detection solution to call that kind of activities so in the station we are end of our presentation with takeaways we would like to stress out during great teaming activity we need to think out of the box but we still need to take care of public and process safety it's really a rule of thumb for us power distribution environment is not complicated as process wise when compared to power plants or petrochemical but it has directly affected the other critical infrastructures and customers directly power distribution companies have lots of different interdependencies therefore information gets a square role for redeeming activities and power distribution companies is a target and is a defense compared to other ICS infrastructure so we have two minutes left if you have any questions please feel free to ask we will be on discord as well as well as well as we can so Sarkand if you have any comment please do it or we can get to us if you have any questions we are we will be in discord we will be happy for your answer for your questions John and Sarkand thank you for your talk I noted in the discord speaker Q&A that I consider this a mandatory talk to watch for both learning about 101 and assessments so really appreciate you all dying dialing in and supporting us thank you very much having us I hope you enjoy
 Thank you. Hello everyone, this is Jan from Istanbul, Turkey and I am at Sarkand today  and we will be talking about playing with electricity and red teaming in power distribution  companies or hacking in the power distribution companies. Before getting started, I would  like to thank the ICS Village team having us. It's really great opportunity to meet you  all. We really like to be part of the community activities all over the world. We also some  community activities in Turkey as well. So it's really great to be meeting you all over  here. Basically, we have one hour with you and basically we have three parts of presentation.  The first part is overview. We will make a brief information, give a brief information  about the electricity architecture and power distribution company architecture and give  you some scale application architecture on it. And then we will discuss red teaming scenarios  and then we will perform some attacks on our simulation lab. Actually, thanks to Sarkand,  our simulation lab had some nerve issues. We changed our hardware like four times last  three days. But it worked at the end of today and we did videos for this presentation to  await any problems. So we will have some videos and we will talk about it. All right, so let's  do it. Sarkand, please go ahead and introduce yourself please. Thank you, Jan. First of all,  good afternoon for American site spectator and maybe good night or good evening for the European  and Asian sites spectator. First of all, I'd like to thank you for giving us opportunity  in this beautiful organization and I'd like to express my pleasure being there. Now I will  give information about myself. I am Sarkand Tamal. I am an electrical and electronic engineer.  I have seven years experience about industrial control systems,  systems based on electric distribution, transmission and power generation. For last one year of the  my career, I'm focused on the cybersecurity and systems and also focused on the industrial  control system, cybersecurity topics. Thank you, Jan. We can go on now presentation.  I am also an electronic engineer and I have more than 80 years cybersecurity background and last  five years I mostly concentrated on critical infrastructure and I say SCADA cybersecurity.  At the moment, we both working for cyber-wise for critical infrastructure cybersecurity  at the moment and today, as we mentioned, we will discuss electricity sub-sector and power  distribution, red teaming and cybersecurity. All right. We want to start with why electricity  matters actually. It's not just for us but for all the rest of the world. It's the backbone of  all critical infrastructure. When it fails, it direct effects the data life or modern life  fundamentals. For example, it affects health sector, transport sector, transportation and  finance sector and so on. Once it fails, it directly affects people and public safety and  it's really backbone of the critical infrastructure. We want to take dead parts and we wanted to  build a presentation to point. We will be discussing about red teaming in power distribution  companies but before it, we need to understand the electricity architecture in process-wise.  Basically, it has three parts. We have power generation, we have transmission lines and then  we have a power distribution part. Most of the time, power plants and power generation  located in the out of the city centers. That means we need to carry electricity  long way of kilometers. It means we require the transmission lines and finally, that means  we need to power up-down operations. Once we are over from the transmission lines, we came up with  the power distribution. Actually, it is the last line of the customer touch. I mean, if something  fails in power distribution part, it directly affects customer and our business. To be honest,  the distribution companies and electricity distribution process is not too much complicated  when we compare the power plants or petrochemical industry. It is easy to attack and also it is  the defense. Serkan, would you like to add something? At some point in that presentation, today we  tell you the distribution, but I would like to be aware of the point. The transmission layer is a  critical part of the electricity architecture because it is a bridge between power generation  and power distribution. This is the backbone of the electricity architecture. Today's topics are  distribution electricity, but transmission is very critical in the cybersecurity perspective.  And actually, it depends over the countries or over the regions. Sometimes it is operated  by the government. Sometimes it is operated by private companies. It really depends on the region  and countries perspective. But I really agree with you that transmission lines are also the core of  the electricity architecture. Thank you. So let's dive into the power or electricity distribution  infrastructure. First of all, it's a really great example of the SCADA because you have people,  which means the supervisory element of the SCADA, and you have remote locations. As you can see  on the screen, there are lots of different substations connected via different types of  communication media to your control center or emergency control center. So what we said,  it's a great example of the SCADA application because you get data from all over the different  remote located substations, and sometimes you control over the remote substations.  So on the other hand, you have remote offices like payment offices, headquarters, government agencies  to report for, or you have direct integration. For example, in Turkey, Renewables Power Plans  has to report the nearest power distribution company for the regulation. Basically, what we can say,  there are lots of remote locations we have that we need to control, and that means we need  different types of communication media. In distribution companies, we really need to take  care of the communication media security as a part of the defense mechanism. On the other hand,  sometimes some companies or some governments or some countries has smart meter application,  which means smart meters has direct effected electricity. They open and close the electricity  via metering control center through the smart meters.  Why I'm telling you this? Because it will affect our red team scenarios and understanding the  infrastructure. What we need to understand from this slide, we need the loss of high level of  connectivity. There are different types of communication media, and we have lots of different  type of substitution and equipments. And the rest of it, we have lots of different type of  integration. All right, I'm gone. All right, I will give a brief information and pass to  Sarcan's stage. We discuss about the electricity architecture, and then we discuss about the  power distribution architecture. Now, we will discuss about the SCADA architecture. It's also  distributed in the server side. But before jumping into it, we need to understand there's a need of  high level of connectivity in such a power distribution company. Sometimes we need to  connect the outreach management system, ERP application, call center, and so on. Maybe  Sarcan give some example about that. Yes, we mentioned about the previous presentation that  we said that distribution, like the distribution, touch the customers. So this means that the  distribution company, so many customers works into like customers management,  outreach management, VFMs, other stuff, so many stuff for the customers. The reason of that,  the distribution SCADA systems must be and have to be integrated IT software applications,  like John mentioned, that's OMS. OMS, like VFM, like the other companies, third-party  software. Because of that, distribution SCADA systems, LW difference from the transmission  and power generation SCADA systems. And also in the distribution network, so many substations.  This means that so many data, so many connection stations. So we need the power rule SCADA systems.  We have to separate this load to separate servers, like application server, like communication server,  like data server, like backup server, and so on, like HMI server. So distribution SCADA systems  a little bit distributed and separated structure. It's very similar to IT environment, actually.  You have some type of application servers, communication servers. It do some kind of  load balancing, and it requires really great integration of IT application or business  application. Sometimes it's part of SCADA applications, like the called outreach management  system or call centers. They are directly talking or integrating with the RSCADA application. Because  once you have a kind of blackout or shutdown electricity, you will get some calls. You need to  reach out to customers. You need to get some data from SCADA. So it's really integrated with  IT applications, sometimes cloud applications. And on the other hand, you have entrusted parties,  like vendors, remote offices, other type of control centers or government agencies. So sometimes it's  done via the firewall, sometimes directly connected to your industrial equipments. It really depends  on the customer strategy, or sometimes they are not really aware of what kind of communication  channels they have. But what we need to remember through here is that RSCADA architecture is  distributed as a server roles, and it's like an IT application and it has integration with the  business side. And also it talks to the substation through our communication media. So I will leave  the comments to Sarkam about substation because he's expertise lots of years. Now we have talked  about the substation architecture. The substation architecture is distribution  substation process. We have some main devices for the process we use. The first one is RETU.  RETU is a telecontroller which connects field devices to SCADA systems. We think as a data  concentrator or data transfer devices RETU. Energizer is an energy meter which gets information  from the CT and VT transformer from electric sites information and translates in the digital  sites and give and directly send this information to SCADA systems. Protection relay, it is a critical  equipment in the distribution and also transmission and also generation as you know that. Protection  relay is the first IED device, first electronic device connected physical electric system. It is a  bridge cyber and physical world. Reason of that protection relay is the most critical parts and  most critical device in the distribution systems. As a cybersecurity perspective if you want to  shutdown the electricity you have to control the protection relay but maybe you can attack the RETU  maybe attack the SCADA systems. It's just blocked our monitoring from the field sites but if we  want to control electricity, shutdown electricity or re-energized electricity you have to control  protection relay. The fourth device is the smart meter. Smart meter as you know that's for building  purposes and maybe low voltage site for customer sites, shutdown electricity or re-energized electricity.  The last two devices is physical device. The first one is low-volt circuit breaker.  It is controlled electricity line and the last one is the medium voltage  criticals means circuit breaker also inside these criticals. It's controlled electricity  line, networks. Next slide please. I think yeah yes. Yes we had line IED device protection light  device. This is I would like to say it's again because it is very critical. Protection device  has two parts one of the heart rate the otherwise the software. The heart rate sites they have  unlock inputs, unlock output, digital input, digital output and the other cellular internet interface.  Voltage and current information takes with unlock input modules and also control  unlock system like set points power like set about the frequency let's set about the voltage  you have to send unlock output and digital inputs and digital inputs most critical  because digital inputs comes from basically circuit breaker position, isolated position,  the other information about the physical systems and digital outputs is control the circuit breakers  means that you control the electricity because of that in the scalar systems and most of the  communication protocols or animal direction or cyber security perspective we focus on the digital  output signal. In the beginning of this device they have serial interface because in that time  more Ethernet IP wrote and today most of the device has Ethernet interface and it gains  advantage of the Ethernet IP world but it is some cause of the site effect from cyber security  this gains of advantages I will tell about later. In the software site communication  protocols means that industrial communication protocol like Modbus, like Probus, like IC104,  DMP3, the other this helps communicates with R2 or communicate with the SCADA systems to  send information to the upper level. Logic functions control the like circuit breaker or other blocking  materials functions logic functions and configuration interface this is the critical part of the  AID device as I mentioned that they have Ethernet interface and most of AID device nowadays use  web service interface for configuration software or configuration interface this is the  some vulnerability about systems as a big point of this AID device nowadays.  Thank you Sarkam. Actually we always get afraid or get freaked about touch such intelligent  electronic devices because as you mentioned one part is physical that controls electricity and  one part is cyber it's R2 or SCADA applications and it's like a last line of the physical and cyber  breach once you control it you control the electricity you can control it through the R2  or you can directly send commands to the IID or you can trigger some SCADA application set points  and it will directly affect the intelligent electronic devices but once you're planning a  red teaming or pan testing activity you need to be aware of such a devices can affect the  electricity and you need to be really careful what you are playing with. All right so now we can  discuss about red teaming approach and red teaming scenarios. Before jumping into the details  I wanted to discuss how much red is that because since it's a critical infrastructure since it's a  last line of the custom touch can we be really free to be really red teaming in that case the most  of the asset owners and most of the cyber security companies get afraid to avoid the consequences of  that thing happens. So I may say that nobody does directly red teaming maybe it's like  light pink teaming let's say because we really need to be aware of that the public safety and  process safety is much more important than your color activity so you really need to take care of  the process you really take care of the public safety because we always think in a that way if  we shut down electricity for the hospital and if we kill someone in that hospital because of no  electricity so it really has a great boundary for us to do our tests or pan testing activities or  red teaming activities in a controlled way so it's not really red light pink maybe but to understand  each other in a better way I want to express that part as well so I would like to mention about the  core steps we divided into five main steps actually we discussed about the first two of them  to understand the process understand the architecture once you do any red teaming activity  in any kind of ICS infrastructure in that case we are talking about the power distribution  we gave brief information about the electricity architecture distribution architecture  skate architecture and substation architecture and we thought that power distribution companies  process is not too much complicated we have very limited type of signals compared to power plants  and petrochemicals so it's a really easy process to ease the attack and use the defense now we need  to define our landscape and then we will try to create some kind of scenarios to directly  develop for direct teaming activity usage and then finally we will perform some kind of attacks  in our simulation lab I don't want to talk about the IT based or getting into the IT and then jumping  into OT kind of red teaming activities or landscape but once you are talking about the power  distribution red teaming we wanted to give you brief landscape information that what you need to  know what you are going to face and how it will affect your planning so basically we have eight  categories that we will discuss today the first one is protocols there are different types of  protocols you will see in the field in the distribution companies basically in skater parts  I mean the wide area network you will see ISC 104 and TMP3 and substation level you will see  different types of protocols sometimes schools MMS and so on and upper level and supervisor level  you will see soft pass and the control level you will see mobus tcpr2 even sometimes serif  protocol and then if you have smart meters and even in skater application you may have the power  line communication it's not it's still plc but it's different term we will discuss it today as well  and then we said that communication media is very important if you get into the communication  media somehow let's say you get into the apn network based on gsm or you get into the RF  signals and you then directly interact with substations interact with R2s and interact with  control center equipments and emergency control center equipments so communication media is also  too much important for us to uh rectify planning on the other hand you need to be aware of the  third part integration there are different types of integration it depends on the country and region  and the regulation you see some of them in our list and also as a set owner you have some kind of  remote locations or local locations like control center, energy control center, material control  center, headquarter, payment offices or communication center for like RF towers so asset owner locations  also matters to us on the other hand substation is very important for us because it is  remote located and physical and cyber control is very limited compared to control center or  emergency control center or headquarter in that case you will be facing with industry  protocols on institutional devices and you may apply some kind of hopping attacks what I mean by  that you once you get into the specific remote substation you can jump over the other substation  you can jump over the control center or emergency control center you may create some tag signals  it's like coming from the old remote substation and so on so it's very great and point and great  defense point for us and but I should stress out that in substation we have some physical  controls for example if someone opens the door or if someone opens the cabinet if someone  moving in the substation it creates some alerts and sends signals over the one or four  of the control center so we still have some type of controls that we need to be aware of  when we plan associate activities or when we plan red teaming activities on the other hand  technology I'm sure that all the villagers have a proper knowledge of them I don't want to express  each of them because it's like the IT wise pan testing or red teaming because it's server network  devices and some kind of field devices so I don't want to go each of them and on the other hand we  have people for example in Turkey we have a specific regulation for assessment in the power  generation and distribution companies and it requires social engineering activities for the  energy people let's say the asset owner people sometimes we see that some red teaming activities  hit the vendor engineers or OT partner engineering company engineers so and people's segment is also  really a very and different types of mechanisms they have for example in Turkey we need to do  physical pan testing we need to do phone calling we need to do email based social engineering  all right and done by the regulation and also yet another landscape for us the industrial process  and we will discuss it yet in another conference because since it is the less signals and it's  less complicated in the power distribution and power industry the industrial process vulnerabilities  may affect public safety directly so we avoid to mention the entry points of  process vulnerabilities but we can discuss it later in for another industries  on the following days all right so I hope we understood the process we understood the architecture  and defined some kind of landscape again it may change the region country and regulation  but we need to understand the basics of distribution so we need to create some kind of  scenarios in this presentation we created three types of scenario we have created a specific  table for that I will discuss it through them and it's again not IT based red teaming or pan  testing we try to create some kind of directly effect on electricity based scenarios  so in the scenario we have a chance to work with our IoT team leader and hardware  security leader with Fatih Khairan actually he developed this scenario and applied in the field  once upon a time we were in the distribution company and came up the idea that we figured out  somehow the smart meters were controlling the city's electricity which means if we could find a way  to send a proper comment smart meters it will directly shut down the electricity in that case  the dead smart meters were talking through the power line communication and so we created  our scenario based on this so to understand the team mates to each other in a better way  we create such a table to define our success criterias difficulty factors and decide if  the chain is required or not I will go through the one table and I will pass through the rest of  the it because we will perform a real-time simulation for the rest of it in this scenario  we targeted the shutdown electricity but before jumping into that we classified our  tactic and techniques based on my tree manipulation of control and manipulation of  weave and our entry points was smart meters power line communication complexity in this  scenario was high difficulty was high because unknown protocols were there specific hardware  design is required and high voltage work environment is can be dangerous because we lost one of our  laptop and one of our team member got injured during this test because we work with the high voltage  directly with the plugs and to better understanding you plug the smart meter into the  city network so you turn into that specific smart meter into weepen to target the electricity  for better understanding I will discuss it through this presentation so dependency was the  communication interface reverse engineering or protocol reverse engineering required time was  high for us and also what was our success criterias understanding protocol send and receive  packets on the power line send command cutoff the electricity for a defined area sometimes we  create some so c success criteria for our customers to detect better the next attacks in that case it  could be hardware or smart meter log management oms log management core center log management or  smart meter replication log management could be a success criteria in that case we defined log  sources for redeeming activities and then we define a purpose method and a kill chain activity  in that case our purpose was shut down the electricity via unexpected point of entry  through unexpected communication media turn plug and matters into industrial attack equipment  so our idea was simple so power line communication works through the power signals you modulate it  and put your data into the electricity signals so it directly talks through the electricity  in I think there yesterday there was a specific session about that in that case we will look into  the how it's used in distribution companies in that case we have the power concentrator which  is directly connected to different types of customers almost tightening and there are smart  meters and there are some power line communication interfaces and it connects to the backend system  through the APN in that case over the internet so guess what it was the broadcast messages going  through the specific power line if we have specific hardware you can develop it or you can  turn smart meter into the your tool in that case we made it and we were under we were able to  understand the reading data and the shutdown the electricity commands so since it's broadcast  each of smart meters get the data and once you give order everyone gets the order but one of them  apply it and report back to center so once you sniff the data you see the smart meter ID and  in that case the power line communication we're using the dlsm-ksm protocol in that case that  specific number defines the shutdown the electricity command like double command in one or four very  similar and also in that case we were able to get readout data in in this case this is readout code  for dlsm-ksm protocol what we are trying to say that you don't directly attack the SCADA application  R2 user IEDs the best way and easy way find the yet another proper line  end of your goal so in that case the power line communication and smart meters  gave us a chance to shut down the electricity but you need to deal with high voltage electricity  you need to deal with power line communication new type of protocols modulation demodulation  and encryption type of things require much more time but most of the time the acetoners and the  pentesters doesn't pay attention on the deck channel so you really create a volume for your  customer and people safety in that case so as I know the European countries also have great  implementation of smart meters we need to take care of these standards as well  okay so our last two scenarios based on the R2s and industrial protocols we will show how to do it  industrial red teaming in a real lab environment which took days for Serkan and got all during  these sessions basically we have two different scenarios for this presentation one of them  extracting data from config files without further reverse engineering or further implementation  of anything and think about that you have some type of configuration files you don't have any  access to OT environment or substation yet but you will figure out some type of data to plan your  next session of red teaming activities we have a specific example of that since I discussed  a deeply and very detailed the last table I don't want to discuss it the losing any time  on that so I will jump into the next one because we will discuss it real scenario  to get another scenario for this session is the remote substation protocol attack  in that case the attacker needs to interact with the substation equipments it can be done  and via Raspberry Pi implementation and connect through the Wi-Fi and so on like we did in our  lab environment and we will shut down the electricity using the protocol commands once we  understand what kind of protocols used and how once we understand the protocols we will  figure it out to where the center data and final center data to shut down the electricity  to have better understanding each other what we are trying to say  if you are planning to work teaming activity in a power distribution company or assessment  you need to understand the process you need to understand architecture you need to understand  landscape once you have a tree element then you can create your scenarios you need to think  out of the box but that box doesn't mean you can go out public safety rules or process safety  rules so it's really hard to balance and we want to give you some simple ideas to reach out your  end goal rather than implementing some IT based or IT related red teaming activities  I think I can be free from now and put second into fire  as a tradition we face to face with the Murphy's room  but finally we succeed on the setup of lab now I have you information about  lab setup it's a very simple part of substation process we have one arches abd140  and one id device one scada server scada pieces and also one switch we use cap player software  as a scada master and also we use mod plus tc protocol and also is one over four protocol  mod plus tcp use in id device between r2 and is one over four we use it r2 between scada sm cap  player device the tricky part is the heart implemented hardware substation as an attacker  we think that we have some Raspberry device or the other device as attacker machine before jumping  into the tails I would like to mention that this setup doesn't indicate any one of these on abv  arches it's just a simple arches that we could use on the market and we know how to configure it  so we will do some protocol based simulation but it doesn't just affect the abv it's based on  we leverage of the protocol usage actually to avoid any misunderstanding and also it is very common  r2 used in europe and asian sites this and also this is the second reason we choose this r2  now we can jump into the laps video all right so we will start with interfaces and signals  the first video is about configuration r2 I jump into that just a second  yes we use r2 until 500 software for programming criteria configuration r2  we created it before an open existing project this part a little bit takes time  it may be boring they hide the project file deep inside my file system  yes and Turkish character error now this is the r2 util 500 software interface this is the network  tree we have three communication line one is is one of four for scada communication the other one  is mod plus tcp for id device mod plus communication line you can easily see that some parameter of the  communication protocol yes it is the one on four communication protocol setup  as you see that's astro address astro address structure inform structure maximum length of  id and then this is the mod plus tcp side configuration  this is network tree now we in hardware tree in the hardware sites we choose our r2 main cpu  model and also we add the field level signal information in that site hardware site and also  as you see that the mod plus communication configuration zone this is the ip address of the  id device and also the again one of four configuration section now this is the r2 interfaces  this is the day it has two eternal interfaces as you see that ip address of the interfaces  and this site we configured our field level signal like active power that is the mod bus  site retolding register index number 13 and this is the scada is one of four sites astro address one  information object address 103 and the other single like phase a current phase b current  we record all and show the all parameters of the signal  because you may want to  online and maybe you want to replay your own lab so if you want to give you brief info  the other sections will be much much faster let's say  but once you understand that part configuration  and it's much more easier to understand the rest of the simulation this is the type of the mod bus  signal as you see that force commands signal commands and register read call status with  cost as used for the information single point information digital input like position of circuit  breaker and switch control means that sense control command to circuit breaker power limit set points  and the other meter inch information phase a current phase b current phase c current  it's a very simple model of the substation  so we can jump into the second report  in this report we directly connect the retu web interfaces as you see that's this is the  ip address of the first internet interface use username and passport in that set you can easily  see that configuration management site you'll see that the configuration file which configuration is  now active when you update this configuration file and also gets configuration file from the device  and also delete this configuration etc and also direct on sites you can easily monitor  signal system log system event status and client station look and also hardware tree hardware tree is  the live monitoring about r2 especially in the site you see that r2 is active r2 is operable  means that it's connected to ied device as you see that's cpi switch position is on and also  meter inch information about systems it's live data real-time data  now i can talk about a little bit configuration file if you wish  our third video related to configuration file and extracting some data again it doesn't integrate  any wonder with t-zone to r2 but somehow if you reach out backup systems or if you reach out the  file server and the it system once we have a configuration file now we will download it  and extract some data from it it's really easy actually before furthering reverse engineering  implementation in that case we are not into the remit substation we are not in the control room  somehow we get data about the configuration file it can be engineering workstation part server again  or backup system maybe a engineering partner workstation once i get the configuration file  i am directly able to see what kind of r2 is used what version and what purpose they are using  what kind of interfaces and what kind of ip addresses they have and sorry and also what  kind of protocols they have it will affect my further planning actually in your red teaming  activity what kind of devices connected to that r2 in substation and what kind of signal parameters  they are looking for it so once i have that information without any probing any scanning  activity or any physical attachment it's really the average of your efforts once you have that  kind of specific knowledge we have also some specific projects that reverse engineering to read  all the data not not people readable format at the moment you have much more better information and  knowledge about the targeted system so in that case we want to show you you don't need to go to the  control center of remote substation somehow if you are able to get config files you may read  directly with the not pet plus plus and read some data understand the process understand the protocols  interfaces and plan a better red teaming activity or targeted attack into the targeted system so i  will jump into the your part sir i can yes before we do is about the normal traditional  application and communication with scada systems and retu first of all i will show to my ip address  and same subnet with r2 interface one  and then we use set before kept server as a scada software scada master program  this is the configuration of the master sites kept their sites kept server sites  configuration file as we see that communication address common address  advanced settings network interface as we have same subnet same address  more advanced parameter for ac1 and 4 originator address like  and also network interface network interface means that it's the  red ip of the radio and the port of the is one of our port  and this site we also configure our signal this means that it is analog short float volume  astralis one of three and so it is the breaker control commands command single command means j  say j actually it will directly affect the open and close uh breakers uh later then we will apply  some scenarios it's really important to understand what type of parameter and what type of commands  they take how we connected to our cheer as you see that this is the real-time data  as you see active power 2400 and also breaker control is zero breaker position is one means  that the closed now we sent the breaker control control command is one  yes it takes the commands in the real-time and real-time operation when we sent this  command we reanalyzed circuit breaker or shut down the circuit breaker with this command  all right now  and also I would like to show some wire shark  track trafics between kepp wire and re2 this is the alternates we apply our display filter for is104  yes as you see that this is the test frame in the protocol  so now we re-sent the command again and show the traffic  yes this is command single command  astralis one over seven as you see that this is the wire shark single command  address is one i address is 107 and also set command value is zero as you see you can easily  get this information from the wire shark because the is104 is an open text protocol not encrypted or  hashing port hash protocol you can easily get information from the traffic  in that case you see that the single or double command  take place in is104 in that case we sent a specific shutdown or open command  in a targeted area in case it was zero it means we shut down the electricity  through a legitimate traffic I mean it was a traffic generated by the control center  now we will try to apply as an attacker point of view who is in the remote substation via  implemented hardware this is the five video of us  yes we have information about the second interface about r2 now in the attacker machine  I configure my IP address for the second interface of the r2 as you see  now I use mmap for some research and some search functionality or open ports  in that case we are looking for who has an is104 in that case in that protocol  use specific ports if nobody changes so we are looking for in same subnet if  someone has that specific protocol please be aware it's an attacker point of view  and got into the substation looking for some is104 endpoints and two devices we found it  this is the r2 device as you see from the IP address and also is104 is open port and also services up  but now we have only information about r2's protocols and r2's ip address but we don't  any information about the signal and signal address now we use capware again we  configure capware again as you see  we tried it one now it's connected to r2 now in the protocol structure we have  a general integration command when we send this command r2 get a response and sends all  information about in this r2 insight we send gii command to the r2 I don't know any information  about the object address but when we send this command r2 response to this commands and now we  can easily observe which address and which type of information inside of it as you see that  so this is one IO address is 100 and value is also as you see 332 etc etc  so basically protocol gives an opportunity to us to pull all kind of signals and data  from the r2 for a specific protocol line as an attacker we use the exact same  tool but it's simulation environment again you can use your lab environment that specific tool  yet another tool we have it's developed by I think the master degree student in Germany  called ISE test and to be make sure all of you we will send the latest command through the that  specific tool call next again r2 now we send command again get information from terrific  and also we sent commands to 107 as you see from wire shack traffic we sent commands and also on  of on commands and also as you from terrific it is action confirmation from r2 in number of line  18 and 37 jcs cna x confirmation as you see this means that's r2 accept this comment  basically resist this comment once you get into the substation you pull data  through the protocol and you send the command through the protocol again in that case single  commander double command supported by the 104 and then you are able to shut down the electricity  in that case if it's your end goal you may apply very different type of scenarios and  redeeming activities but we want to show you that it can be done there are some safety mechanisms  or configuration mechanisms to avoid it sometimes you implement the IP based solution or animal  detection solution to call that kind of activities so in the station we are end of our presentation  with takeaways we would like to stress out during great teaming activity we need to think out of  the box but we still need to take care of public and process safety it's really a rule of thumb  for us power distribution environment is not complicated as process wise when compared to  power plants or petrochemical but it has directly affected the other critical infrastructures and  customers directly power distribution companies have lots of different interdependencies therefore  information gets a square role for redeeming activities and power distribution companies  is a target and is a defense compared to other ICS infrastructure so we have two minutes left  if you have any questions please feel free to ask we will be on discord as well as well as well as  we can so Sarkand if you have any comment please do it or we can get to us if you have any questions  we are we will be in discord we will be happy for your answer for your questions  John and Sarkand thank you for your talk I noted in the discord speaker Q&A that I consider this  a mandatory talk to watch for both learning about 101 and assessments so really appreciate  you all dying dialing in and supporting us thank you very much having us I hope you enjoy
DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_0_47.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_48_1019.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_1020_2447.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_2448_4643.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_4644_17999.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_18000_21827.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_21828_27383.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_27384_27551.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_27552_29723.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_29724_31439.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_31440_39875.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_39876_41099.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_41100_46259.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_46260_48359.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_48360_48923.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_48924_51095.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_51096_52859.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_52860_55367.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_55368_55415.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_55416_55499.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_55500_55583.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_55584_55655.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_55656_55967.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_55968_58991.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_58992_59159.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_59160_59303.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_59304_59435.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_59436_60047.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_60048_60107.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_60108_61763.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_61764_63575.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_63576_65339.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_65340_65579.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_65580_66035.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_66036_66539.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_66540_66683.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_66684_67487.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_67488_67799.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_67800_68219.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_68220_68663.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_68664_68843.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_68844_68891.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_68892_69863.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_69864_70031.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_70032_70199.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_70200_70499.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_70500_70547.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_70548_71543.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_71544_71603.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_71604_71747.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_71748_71963.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_71964_72023.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_72024_72071.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_72072_74699.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_74700_75311.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_75312_75407.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_75408_75491.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_75492_75563.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_75564_76655.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_76656_76739.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_76740_78611.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_78612_78683.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_78684_80663.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_80664_80759.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_80760_80843.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_80844_81515.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_81516_81671.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_81672_81743.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_81744_82547.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_82548_82703.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_82704_83099.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_83100_83267.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_83268_83375.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_83376_83531.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_83532_83603.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_83604_83687.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_83688_84287.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_84288_85631.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_85632_88775.png DEF_CON_Safe_Mode_ICS_Village_-_Demirel_Temel_-_Pl_H2RjbQ0YpAU_88776_89126.png