greetings everyone i will be
covering a variety of interdisciplinary
areas from the ics security point of
view
in order for us to be able to answer to
this question
do we really want to live in the
cyberpunk world
uh during the talk i will be sharing
only the actual stuff and their
potential implications in terms of the
ics cyber security
uh maybe you know them all but mostly we
deal with the details and lack of seeing
the bigger picture
when we're dealing with the ics security
also i want to point out that these are
my own thoughts and my own way of
interpretation
of the advancements in technology and
their correlation
with my own experiences obviously yours
might be
different than mine but i want to raise
an awareness about these subjects
and in my opinion we should not consider
these subjects separately
or different areas than the ics world
uh before i dive in further though allow
me to introduce myself
my name is max but you can simply call
me merch can click
because i have been known to being able
to collect from the early ages
of my life i'm a computer engineer with
the master's degree in cyber security
i promise i primarily focus on the cyber
physical systems as well as the wider
networks and the isp implementations and
their security as well
i work as an ics penetration tester in
the barricade cyber security
where i get to do a lot of penetration
testing to
a rich variety of cyber physical systems
now let's quickly define what cyberpunk
is so that we are on the same page when
it comes to answering our title question
the term cyberpunk was originated back
in the 80s as a sci-fi dystopia where
the society is dominated by computer
technology and big corporations
where everything was interconnected in
some way or another
in short we can describe it as the era
of high tech load life
and in the essence of it we can simply
call it like the hacker culture
back in the 80s ics operation and
management was considered as an
extremely sophisticated and serious area
of work
which is true even today scada was in
place and less people had to do the
dirty work on the field
what we basically do on the ics is that
we process the inputs
and take actions accordingly it was
mostly done by hand
from the control center but hence the
term control
system implies right things were less
digital back then
there were nixie tubes lots of switches
and indicator lights
etc nearly all of these components were
hardwired right so it was quite hard to
maintain and troubleshoot in case of an
incident
and also because of that the cyber
security was not big of a concern other
than the
physical violations also there weren't
many rf applications back then
even though there were some examples and
rf devices were
not big of a security concern because of
acquiring an rf equipment was not
feasible in terms of size
and the cost and also in 1979 modbus
was introduced by modicom and brought a
new way of communicating with rot
devices and most of these principles of
ics
still applies today
so by looking from the 80s to now maybe
we are living in the cyberpunk world
and there is only one way to find out so
i would
kindly ask you to put on your power
gloves and let's hack time
all right 1980s to today
the basic principle for the ics did not
change a lot but
the way of implementing it really
changed over time
even though it changed in drastic ways
we still have the modbus family uh it's
mostly modbus tcp but we get to see it
very often on the ics realm and isis
security still relies on
the physical security and security
throughout security approach
is a must when it comes to the ics
security
and there is a rapid transition to the
wireless we are
planning to convert most of our field
devices
into a wireless medium and we all know
what wireless means
it's accessible to anyone we now have
the
iiot as well which we will cover soon
and we have some models that we
implemented
such as purdue and but for
now we get to see a newer approach
for ics implementation and it's more
cloud-oriented architecture
we are planning to carry out our
operations and our
data to the cloud as well as any other
systems and also now the ics world
relies on the
geographical information systems where
we can use the gps
and other technologies that are out
there
so let's start with the real life
example for the ics world
for those who are not familiar with it i
will be giving some examples and some
possible attack vectors
in terms of ics security
so let's take a look for the gas
distribution systems uh
we try to distribute the gas
uh by going through different steps
where we tend to reduce the pressure up
to a point where we can use
in our household uh the gas is being
distributed in really high pressures for
to achieve high volumes
and we have to reduce it down to a point
where we can use it which is around one
to twenty for
21 millibar and it starts its journey
with the 60 to 75 bars atmospheric
pressure
as as long as we keep uh reducing that
pressure
the natural gas has this unique property
of
uh being cooled down about a half a
centigrade degree celsius
for every atmospheric pressure you
reduce it to
we use gas chromatography uh that's for
to analyze the compounds within the
natural gas
it's mostly done in on real time uh
obviously the natural gas does not
consist of only single compound it's a
mixture of compounds we have to measure
it and most of the
uh the distribution companies are being
you know
charged based on those values
and we use flow computers sensors and
all that kind of crazy stuff to achieve
that but also
comes with the price and we have to use
the gas analyzers which
has to be on some kind of embedded
operating system
but in my experience i have mostly seen
them using windows
ce also another interesting feature of
the natural gas it
that is that not contain any odor
so you can't really detect by smelling
the natural gas i know that
you know what it smells like but that's
not
by its default we have to use some kind
of alteration
to achieve that and we use some special
liquid that is called the thd
uh for to order that natural gas
that is being transmitted but the thd
is so potent that only one drop of it
can authorize about 2400
meter cubes of gas uh which smells
awful already so in order to authorize
the natural gas
we obviously use the scada system and we
have the plc or rgu
which is connected using the wireless
modem
it claims that we should cover it in a
safe area but i
don't see the definition for the safe as
for the example of the florida water
supply attack
where the hackers were able to you know
manipulate the system
of the mixture of the lye on to the
water supply
and changing the value to 100 to
11 000 parts per million and the same
principle
can be used to manipulate or use as an
attack vector
for the authorization technologies as
well
so we as you can see from the you know
data sheets we use the
old hardware they are connected either
using the serial port
or some kind of modem and most of them
are
still operating from the modbus protocol
so all in all we mostly use the same
principles of hacking when it comes to
conducting a pen test on the critical
infrastructure
there are also some hardware related
techniques but are mostly overlooked
security incidents in the past has shown
us that the air gap approach of ours is
not
invulnerable and in my opinion it won't
be
sufficient in the future as well it has
been known that there are countless
possibilities to try
if someone with malicious intent ever
finds a way into the ot network
uh triggering a denial of service on a
field device is the least that can be
done
there were incidents on the power
distribution lines where
attackers have access to the
infrastructure from a remote location
where they made their way up to the ot
network and in the end
they successfully manipulated the
syncrophasers
there are also some sneaky methods for
compromising the ot network and air
gapness
a single board computer with built-in
mobile data implementations can be
really hard to detect
uh especially if you have the network
infrastructure is not well established
in
a security oriented fashion i have seen
folks who are in charge of dlt network
made some ignorant claims about that the
specific vulnerability won't cause any
security problems to their network
uh they make these claims based on the
trust of the air gap implementation
but as soon as they see a demo about the
possible implant
implications of the spc implant which i
randomly place it
on an unexpected field switch and ask
them to pinpoint it by
physically or off of the network traffic
you get to see the fear in their eyes
and how
how hard it can be to detect such
devices if you don't have a
fully mature ot network on top of that
reminding them about the past incidents
of insider attacks
and the you know the new supply chain
attacks they
then tend to grasp the idea of why that
ms something something vulnerability
needs to be addressed
regardless of the internet connectivity
uh so most common hardware related
techniques is to
mess with the firmware and the serial
communications on the embedded device
itself
we fire up our logic analyzers bus
pirates and many other fancy gadgets to
have a foothold on the device itself
when you have an access to
devices such as modbus gateways or the
media converters
which are also overlooked and are
considered crucial most of the times
what do we get to see most cw259
hard-coded passwords
on top of that rfcoms are causing a
greater risk than ever before
thanks to our sdrs it is possible to
interact with rfcoms
nearly every portion of the spectrum
depending on your hardware obviously
all you have to do is to set up your sdr
to the desired configuration
so that you don't need to buy out of the
box radio which is designed to work
under a specific band
by the whole help of these devices such
as heck rf
not only we can receive signals but also
we can make transmissions too
uh therefore attacks such as gps
spoofing are out there for
nearly a decade now and the rf attacks
can cause very devastating outcomes
especially for maritime operational
technologies and such
now let's take a look for the emerging
technologies so that we can see these
advancements and there are similarities
with the ics security
tendency to make everything smart is out
of control there is iot and iiot where
an ordinary raspberry pi is being
used in heavy-duty industrial
applications we use cheap esp devices to
monitor and
monitor our hydrophonic food forms or
control our buildings and cities
and i understand that being able to grow
our food without using any soil and
stacking them up like server racks is
tempting
and cool but i have doubts about their
security implementations too
i said that there aren't many security
percussions in place on those systems
even though they are part of the
critical infrastructure as far as i know
we have to be able to keep away the
attackers from manipulating
the nutrition injection systems by using
the similar techniques
as we have seen in the florida water
supply attack
also people are now carrying a local
area network of interconnected devices
right on their bodies
as a result of that internet of medical
and internet of health things have
emerged
if you were to look for frequency
allocation for those medical devices and
their telemetry bands
it is clear that they are well within
our reach with our sdrs
ivmds are not something new but they are
also being
rf enabled in vast amounts uh doctors
now can monitor your health data
like an ics operator they can upgrade
your ibm these firmware or its
parameters remotely
insulin pumps are widely used today and
if you look at the functional diagram
we have rf links temperature sensors and
motor controllers
it's like a mini ics of its own in some
sense but they are designed
not to have an air gap to function
and there are the implantable rfid
devices
despite the fact that many people
purchase and implant them by their own
will
i don't see why not that we will be
asked to have such devices on us if we
ever decided to use the airports where
rfid tunnels can check our health and
vaccination status
in an automated fashion
so by putting all these together remote
healthcare became more effective we can
simply call it the backroom healthcare
i don't see any obstacles where
adversaries are
analyzed and make real-life correlations
with the victims historical heart rate
data
so that they can design a better
spearfishing attacks
even a read-only data can be used to
leverage those types of attacks
another cool topic uh bci the brain
computer interfaces
like the human machine interfaces are
here too
uh they are basically reading your brain
activity and decoding them
to the signals to operate a desired
external device
and there's this non-invasive vcrs are
like putting on a head and you can take
it off and desired but
on the other hand the invasive
applications of the bci
needs electrode implantation directly
into the cortex
wouldn't that be great to operate the
scada systems without even moving a
muscle
so one example of the bci technology is
the
open source project called the openvci
and so this technology can be easily
mapped or programmed in a way
to allow us to handle certain parts of
the ics
operations and also there are already
some products out there
where their primary concern is not the
health rather to take us one step closer
to the cyberpunk world
so just to be clear these technologies
are promising for sure and i don't want
to sound like i'm against them but
potential vulnerabilities
that might affect these kind of
technologies and their implications are
kind of scary
all i'm trying to explain is that ics
operators or people who are in charge of
critical operations
may have these kind of interconnected
devices on them
therefore their ivmds could be used as a
pivot point to compromise our critical
infrastructure
and when we are going to put this
possibility of our security policy
equations
i don't know but if so let's say we
decided to do that what are we going to
do
ask for an api key to their ibm d so
that we can include them in our pen
testing scope
anyway moving on simplest form of attack
against such devices
is battery drain attacks uh you can
consider them as denial of service but
for ibm these
and all you have to do is simply trigger
the rf
module over and over again as if you
were about to communicate with them
a case study and well detailed post was
published recently
it's a great example for capturing and
decoding an rf signal that is being
transmitted
off of an ingested capsule that is being
used to measure
and record the ph levels inside the body
utilization of autonomous vehicles are
also on the rise for both public and
industrial use
and certain in some certain industrial
areas they are being used as a part of
the production line
therefore in my opinion avs should also
be included in the overall evaluation of
those processes
not so long ago we have witnessed a
drone attack targeting the saudi aramco
soil processing facilities
this may be categorized as a matter of
national security and not the
responsibility of the ics governors but
in the same time custom-built drones
with autonomous flight capabilities
can be used to attack our facilities and
drone jammers won't be able to intercept
them
even if we decide to place them in our
infrastructure as it was like an
ot equipment yet i can't see any
possible
prevention mechanism and that we can use
other than the offensive approaches
which is whole another
discussion to make
i think we won't be able to hide behind
the air gaps false sense of security
anymore
because we are transitioning into a
phase where our most critical equipments
are being hyper connected more and more
every single day
there are millions of people with
medical implantations and one of those
people might be working in your
infrastructure without even you knowing
it
his or her or her device might have some
vulnerabilities and if you get to think
about that
these devices have all sorts of
reprogrammable components like
microcontrollers and fpgas right so even
today we
see a lot of windows xp's and windows
7's with our
uh with very old vulnerabilities on them
inside our ics networks
and companies who are not willing to
reinvest millions of dollars
just to erratic eradicate those
potential security flaws
and keep on running the process and
risk acceptance right so there is no way
of knowing that your
operator might being used as a gateway
to
exploit those systems as well and
attackers
won't have to find a zero day to further
penetrate into
dot infrastructure because they are
vulnerable already
let's look at this issue from uh
different perspective what if that
vulnerability of ibm d device is simply
unupgradable and you know the hardware
is not sufficient enough to
have that new firmware and the health
insurance won't pay for the new surgery
and that operator of ours might accept
the risk personally but wouldn't that
decision will also put rics into risk as
well
so that's a question that we need to
consider and also
i'm almost certain that we will get to
see ransomware issues on medical
implants
uh the cloud infrastructures that
operators of ours
might have been hospitalized and
desperately waiting for ransom to be
paid so that he can get his insulin pump
working again and as i mentioned earlier
i think
there are huge similarities between the
ot and these technologies that i have
been explaining
and these technologies are not designed
in a security oriented fashion
my point is that we should and must
actually put our security considerations
at
top priority if we are going to
interconnect everything
so basically we simply cannot deny these
facts
are here one last concern that i have is
how are we going to train more cyber
security experts who are capable of
tackling these challenges you know
ics security is one of those areas where
there is lack of labor environment it's
not as easy to train qualified workforce
for the ics as it is in id pen testing
there are definitely some great examples
of ics exercise
test beds but you have to be in the
vicinity of those environments to be
able to work with them
you know most of the time and if you get
to think about many of us
dragged into the cyber security field
mainly as a result of our curiosity
you know we break things and to make
things and more
young people will feel the same
curiosity too
when we made a mistake back then the
worst case scenario
was having a blue screen of that vsod
but that potential hacker of ours might
get tempted
by neighbor's son's ivmd and
unintentionally caused
irreversible problems
okay now for the last part the future i
will
briefly talk about what we might end up
seeing
when you put all these technologies
together and you know hyper connect
everything
together and the beginning would be the
transhumanism or human 2.0
this is where most of the sci-fi
dystopias are born
augmentations are like upgrades for the
humans
so you know you can consider them like
what steroids are today
not only the people with medical needs
will buy them but
people are expected to use augmentations
just to be more superior
by using the technologies that are
already here and trying to guess which
direction they're headed
i don't see why not people and their
augmentations could be
manipulated in a way that they have not
intended themselves
it could be as simple as pushing a
button in the skater room which they
shouldn't
or turning off a nuclear power plant
which they are in charge of
and you know what they say hackers gonna
hack and
cyberpunk world if it ever happens in my
opinion which is already happening
will be a new area for the cyber
criminals
thus we need to be prepared and we need
to
start working way our way up to
executing security measures for those
subjects
to come we definitely are not in those
good old days
where there were no mass data collection
was in place
but the last amount of data that is
being collected now
also includes a very personal and
real-time details about us
and in my opinion neglecting the
possibility of these data could
ultimately affect our way of doing
things in terms of
ics cyber security i hope
i'm not hacking too much time uh this
talk wasn't about you know
creating a debate about these subjects
but just sharing
my thoughts and i'm simply unkindly
asking you to open your eyes
because those stuff are not far away
from now
most of them are here already so
be prepared and we need to get ready for
them
obviously there will be some denial
phase it's understandable but it's the
first step
towards the acceptance
you needed the references and i would
like to thank you all for your time and
attention
and do send me an ebay email about
the uh do we really want to live in the
cyberpunk world question and
hope to see you in the void