- It's Steel Mountain, isn't it?
- It's Steel Mountain.
- [Film Character] The hacker's dilemma.
- We're going to go ahead and do this
in the real world, David.
(David and OccupyTheWeb chuckling)
- I didn't see you enter any authentication stuff here.
- [Film Character] Bingo.
- There's no authentication, no.
(upbeat music)
- Hey everyone, it's David Bombal, back with OccupyTheWeb.
If you haven't watched our previous videos before,
he's the author of this book, fantastic book
if you wanna learn Linux from a hacker's perspective.
He's also the author of this book
if you wanna learn to become a master hacker.
This book has been updated.
Is that right, OccupyTheWeb?
- Yeah, and it's gonna be published by No Starch.
There'll be a new version, and it's gonna be called
"The Cyber Warrior Handbook,"
so it's gonna be really a new book with new material in it,
but we don't expect to have it out until winter
at the earliest, next summer at the latest.
- So for anyone who hadn't seen the previous episode,
I've linked it below.
This is the best kind of videos ever.
We get to go through "Mr. Robot,"
and OccupyTheWeb explains what's going on.
- We're on, I think we're on season one, episode five.
Did you do your homework and watch "Mr. Robot"?
- [Elliot] Hello, friend.
- I did. (chuckling)
- I think I watched that episode like three times this week
just to make sure I got everything right.
- It's Steel Mountain, isn't it?
- It's Steel Mountain.
- [Film Character] The hacker's dilemma.
- Iron Mountain is the real one, isn't it?
I think you said.
- Iron Mountain's a real company that actually does
almost exactly what Steel Mountain does, yeah.
- So Master OTW, please continue.
I don't wanna stop you.
- Those of you who are familiar with the series know
that there has been a hack of Evil Corp,
this big conglomerate that basically owns everything
that Elliot actually works to protect,
but he really hates, because in part they killed his father
and his friend Angela's mother,
and that's part of the storyline here,
why he really dislikes this huge conglomerate.
The hack was basically a form of like similar to ransomware,
so what they've done is they've encrypted all of the data
on the servers.
This corporation is the largest in the United States,
maybe in the world.
They have big financier, they have a bank,
and they have many other activities.
When their servers go down, it causes a lot of consternation
and difficulties in the economy.
The economy basically collapses.
So the strategy at this point is that
Evil Corp, of course, has backups.
So even though fsociety has encrypted all their data,
they have tape backups, and like most major corporations
and even small corporations,
there are backups stored off site.
Big corporations, in the US at least, use a company
that's called Iron Mountain.
The company in "Mr. Robot" is called Steel Mountain,
and one of the services that they offer is to store
tape backups in a secure location
where it's climate-controlled.
They have HVAC systems that control the humidity
and the temperature so that
your backup data never gets destroyed.
Elliot and his crew have decided
that they have to get to the tape backups
so that Evil Corp can't restore the data.
Now, this data is all stored on tape, and you might say
to yourself, "Hey, who stores their data on tape anymore?"
Well, a lot of people still do,
and so they've got to go ahead and somehow destroy the tape.
And they realize that the tape will basically,
this is electromagnetic tape, and so it has a film on it
that stores zeros and ones.
They figure out that if they can raise the temperature
of the tape, that it'll basically disintegrate
and lose the data.
So their plan is to get their way into Steel Mountain,
this highly secure environment that's a ways away
from New York City where they're based,
and they want to get inside the HVAC system,
which by the way, is a SCADA ICS system.
Almost all of the HVAC systems are SCADA ICS,
so this is really once again, a SCADA ICS hack,
similar to the last one we did.
These are all run by these PLCs that talk to each other
in this protocol that you probably aren't familiar with.
In this case, they're probably using Modbus,
which is the most widely used,
but first they have to social engineer their way
into the facility, and like I was saying
in the earlier YouTube videos is that social engineering is
a really, really important part
of information security, cyber security.
A lot of newbies in the field don't give it
its full importance.
Even in the most important hacks that ever took place
in the history of cyber security,
there is a social engineering element.
The same with this hack.
In our first video we did,
there was a social engineering element there too,
where they had to get the policemen to turn away
from the system so they could pack the Bluetooth.
In this one,
there's even a bigger social engineering element
in that Elliot has to find his way physically
into the facility.
Now, I find it interesting that Elliot has to find his way
into the facility, and they didn't try to hack this
from the outside, because many of these facilities,
you can access over TCP/IP.
It may be that this one was offline,
and he couldn't access it.
I doubt that's the case, but it makes
a more interesting story that they have to get inside.
- Yeah, yeah.
- So they're trying to get inside.
Elliot works his way in,
tries to social engineer his way in,
and he's got a Raspberry Pi with him
that he wants to connect into the network
to be able to turn the temperature up
in the facility that holds the tapes.
- Is that real world that the tapes will melt or whatever,
lose their data if the temperature goes too high?
- I'm not really sure, but I would suspect that it is true.
That's why you store your tapes
in these climate-controlled facilities.
Most data is susceptible to either static electricity
of having too low humidity,
or susceptible to too high or too low temperature,
so that's what these companies sell, is they sell
a climate-controlled facility that your data will remain
intact for decades if need be.
In the show, they say 97 degrees Fahrenheit is
where it begins to disintegrate.
Mm, that sounds reasonable to me, but I haven't tested it.
And so they social engineer their way into the facility.
Elliot pretends to be this tech billionaire.
Eventually, they run into some difficulties
in trying to be able to get to the facility they want.
They wanna get into a particular vault
where Evil Corp's tapes are being held.
They decide that what they need to do is to send
a spoofed SMS message to the woman who's talking to Elliot.
As you can see on my screen here,
we have the Social-Engineer Toolkit.
This is what they use in the show.
It's no longer in Social-Engineer Toolkit, all right,
because it's run into, spoofing SMS has run
into legal issues in the US.
In my book, "Getting Started to Become a Master Hacker,"
I actually recommended a site, Spoof My text.
This site used to be able to spoof text.
You can see here used to be able to send in a sender number
and a recipient number, and you could put anything,
and it worked great until just about a year ago.
You can see it says, "Maintenance.
We currently only support the sender ID."
Because the law has cracked down on this service,
it's more difficult to be able to spoof SMS.
There are ways, though, that we can send an SMS message
to anybody in the world,
and this is one that comes from a site called textbelt.com.
And I think they'll let you do one free text a day,
but if you wanna do more than one text a day,
you have to purchase it,
and you can see that I only have 48 remaining right here.
And this is right here, let me show you the basic syntax.
It's a curl command, which by the way,
we have Advanced Linux coming up next week,
and we'll be, is one of my classes,
and we'll be working with curl command among other things,
but any case curl, dash, X POST,
then it goes to their website,
and then it's data URL encode,
then the phone number you wanna text,
and then the message data URL encode message.
Message, a message has to be in single quotations,
so does the phone number, and then it's dash D,
and then the API key that you get from their website.
On the show, the message that was sent to the woman
who they were trying to get rid of was a message
that basically said there was a medical emergency,
and that she then had to leave.
She was upset over having to get this message
that there was some medical emergency.
So what I've done is simply create a message that says,
"This is St. Thomas Hospital."
Of course, we could expand the message,
and I'm gonna send this to David,
so let's go ahead and do this.
- That's a real number on my phone, which I've got here.
- I'm gonna go ahead
and send you a message. - Go for it.
- All right, so this is what message I've been getting
from them lately.
It says, "Sorry, ability to send URLs via text is limited
to verified accounts."
I get this on occasion.
They're trying to limit people sending URLs.
For some reason, they see my message as a URL.
Let me try again.
There we go, it went through this time.
(text send tone)
- And there you go, yeah.
Yeah, it's arrived. - Did it show up there?
- Yeah, I've got three, because you sent it previously
as in a test, but the third one's just arrived, yep,
just arrived. - Let's try it.
Let's try it again, make sure it works again.
(text send tone) - Yep,
do you wanna change the message,
just so that, for all the people telling us
that we're faking this?
- Okay, let me do that.
See it here in orange here, "David, we need you now."
All right?
- Yep.
(text send tone)
And there we go.
- [OccupyTheWeb] Did it come through?
- Yep, oh, it's right here.
This is really interesting, 'cause you're based in the US,
and I'm based in the UK, and you've just sent an SMS.
It's showing up as a US number that I've received here.
- Now, the only limitation, of course, of this is that
I can't use any phone number as a sender number.
It used to be that you could, until recently.
This is next best thing.
We can send a message and say, "Hey, this is the hospital.
It's an emergency, come quick," what have you,
and be able to distract in the case of the show,
where they distract the woman who's giving Elliot the tour
of the facility, and basically telling him he can't go
where he wants to go, which is where the vault
where all the data is.
This is a way that we can go ahead and send a text message
to anybody in the world, basically.
I mean, this covers about any phone numbers in the world.
I think they got like 200 countries that they cover.
There's a number of different ways also
that you can do this,
but this is the simplest and easiest to do.
They charge I think $3 per 50 messages,
so that's pretty inexpensive.
- They used to let you spoof the sender,
but now because of the legal stuff,
you can't do that so easily these days, yeah?
- Exactly, because of the legal stuff,
you're gonna run into problems with the law,
and the sites that used to allow you to do this,
the services have all been shut down.
Either they've shut down, or now they'll just let you send
a SMS message, but coming from their phone number,
just like this one here, it comes from a US number,
'cause this is a US service,
so somewhat limited now because of the law.
- But like you said, the idea is that she was distracted
and distraught, because she got a bad message,
and then she walked away and left Elliot alone.
I don't know
what St. Thomas's Hospital's number actually is,
so I mean, you can see why this works.
- Yeah, it might.
I mean, the only thing is if somebody was really aware,
they'd go, "Well, that's a US number.
It can't be St. Thomas."
This is actually, what?
This is in London, St. Thomas in London Hospital,
but if somebody weren't looking very closely,
they might be distracted by an emergency coming
from St. Thomas Hospital.
- You get a lot of strange texts these days,
so you don't always know the origin of that text,
but you could have said phone some number,
and then she could have, I could have phoned,
and then you could have told me,
pretended to be the hospital, couldn't you?
- Exactly.
There's lots of ways you could use this,
as you point out, to be able to social engineer people.
One of the things that they won't let you do is
they won't let you send a URL unless you're
on their whitelist.
So if you're trying to use this to be able to get people
to click, it says here, says,
"Send URLs via text is limited to verified accounts,"
so you can get on their whitelist and then send URLs,
but obviously, if you start sending out links
that are malicious, you're going to get on a blacklist
instead of a whitelist, but you can send messages
and spoof messages to anybody in the world this way.
- Perhaps we could just ask people who are
on different parts of the world if you've seen systems
that are still usable in, not the US,
but let's say other countries that can perhaps do it.
Like in South Africa as an example,
people get constant barrages of spoof SMSs of spam SMSs.
It's a constant problem,
and I think the regulation isn't as good inside there
as in some other countries.
- SMS messages has now become a way of advertising.
It's become a way of social engineering people.
It's become a way to send messages to fast audiences
all at one time, so it's become kind of the spam
of the phone in recent years.
- Yeah, yeah.
- So, but for our purposes here,
this is the closest that we can get presently
to what was actually done in the show.
Let's move on next to creating
our Raspberry Pi hacking system that he's gonna use
inside the hospital.
He's carrying this in his pocket,
but before he gets into the facility,
he has to build it first, so let's talk about that.
- We're not gonna cover the cloning of cards.
We can maybe cover that in a different video,
just for anyone who's wondering why we only,
we jump to this part of the video or the episode.
It's gonna get too long,
so we'll cover that perhaps in a different one.
- Yeah, I'd like to do that in another episode,
and we'll clone- - That'd be great.
- What he does, they get inside Steel Mountain
by cloning an ID card, and they do it bumping
into a fellow in the coffee shop that they know works there,
and they basically make a copy of it, and then make
a new card that they use to enter the system.
So if you wanna build a hacking pi, Raspberry Pi,
you can see this is at Kali's website, and you can go ahead
and get the ARM version of Kali,
and build a Raspberry Pi with it.
So you get a Kali system on a Raspberry Pi.
That's basically what he is doing in the show.
You go ahead and you download this,
and then create an image on an SD card,
and then you go ahead and put that image onto an SD card,
and then you can boot the Raspberry Pi from that image.
- I've created a video showing you that full process,
which I'll link below if you wanna see the whole process
of downloading, and installing, and booting it up.
- Because of the limitations, I'm gonna use,
limitations of making this video,
I'm gonna be using, instead of my Raspberry Pi,
I'm gonna be using two virtual machines.
So I've got one Kali 2020 over here,
and this is gonna be my pi machine.
Then over here, this is going to be the machine
that I'm going to control the pi with.
One of the things that Elliot has to do,
there are some areas here that stretch credibility
(David and OccupyTheWeb chuckling)
as there are in all these shows,
but really it's closer to reality than any other show.
Here's the issue he has to do.
If he goes ahead and puts the pi into the system,
into the network inside of Steel Mountain,
he has to somehow control it.
He has to be able to access it.
There's lots of ways that he could do that,
but one of the ways that he could do that is to be able
to go ahead and create a Netcat connection between himself,
his Kali, and the Kali on the Raspberry Pi,
so let's go ahead and do that.
Let's open up a listener here.
All right, so what we're gonna do is,
Netcat, if you're not familiar with it,
it's a real simple tool that basically allows you to create
a TCP connection between any two systems.
And so what we're gonna do is we're gonna go ahead and go
sudo Netcat, and then we're gonna go dash L listener,
dash P, which is what port is it gonna be on.
We'll put it on five nine,
'cause this is the five nine hack,
and then we're going to go ahead and execute,
dash E the bin shot.
So let's go through that command, pseudo to get
root privileges, NC is Netcat's command,
dash L is listener.
This is the port to listen on,
and then this is what we want to execute
to somebody who connects to it.
I'm gonna back up just one moment and check my IP addresses,
sudo I F config, this is 107,131,
so now we'll go back and we're gonna create
our Netcat connection, Netcat dash L, dash P,
and it can be any port.
I'm using five nine because the hack
in the show is the five nine hack.
It was May 9th, and then dash E, and then bin shot.
What bin shot is, that's just gonna open up a shell
for somebody who connects to it,
so we got that sitting there waiting.
So we've set up our pi with a listener, a Netcat listener.
Now we can go back over here to our system,
and connect to it, sudo Netcat, 192, 168, 107, 131.
That's the IP of the hacking pi system, and then the port.
Okay, you can see I got nothing on the screen,
but I've made a connection, and I now have,
I'm now inside of a shell in the pi system.
So let's go ahead and just check that, and go I F config,
and you can see the IP address, and I can go, who am I?
I'm root, and go PWD.
So you can see that I'm inside the pi system.
So now when he puts that hacking pi inside of the network
inside of Steel Mountain, he has control of it.
- Would it have made sense to do reversal,
like when he plugged the pi in, that it does a connection
back to this computer, like his laptop?
- That's an option as well, so either way,
we gotta make a connection between these two systems.
- He had to have like a 4G, or 5G,
or some kind of cell phone connection
from the pi to the outside world?
- What I would've done if I was him, and it doesn't us
in the show, is that I would've made the pi into a wifi AP.
The issue with that is that it has a limited range.
You can make the Raspberry Pi into a wifi AP,
make it into a rogue AP, and then connect to that AP,
and then go into the network that way.
In this case here,
he's gonna have to actually be able to hit
this public IP address from outside.
And remember, we were talking earlier about why didn't he go
in from the outside?
If it was offline, if this facility was totally offline,
then being able to connect
to the Raspberry Pi wouldn't be possible.
One of the other options, of course,
is that he could have developed a script,
and that script would execute as soon as it got connected
into the system, but that would require a knowledge
of the system of the network that he couldn't have had
without actually doing some reconnaissance on it.
So now that we have a connection inside that hacking pi,
we can start doing our reconnaissance on the network,
and so we could go ahead and, say, do an end map scan
to see what the IP addresses are in that network.
So this will be the first step for him to start doing
reconnaissance to find out what IP addresses there are,
so now because he's connected to the pi,
and the pi is connected inside the network,
he can begin to do reconnaissance on the network.
And this is where things get, stretch credulity.
To be able to hack this HVAC system, it can be done,
but you have to study the system.
You have to know what the system is before you can go in
and actually hack it.
So now what we've done is we've gone ahead and scanned
what IP addresses are in that system.
After he's done that, the next step to be able to hack
this HVAC system, remember this HVAC system is a ICS system.
It's a SCADA ICS system, and he knows what IP addresses are.
One of the things he would look for is potentially,
he could look for the what's called
the Human-Machine Interface.
Somebody has to have monitoring and control
over the HVAC system.
He can go in and start looking for that system,
and try to take control of it.
Because he's inside the network, that might be simpler
than doing it from outside the network.
The other thing he could do is to begin to look
at what are the various units within the system,
and begin exploring those units.
When I say units, I mean unit IDs.
The PLCs all have unit IDs.
Let's go ahead and start MSF console.
Remember, we're remotely controlling the pi.
We're gonna open up MSF console,
and we're gonna do some exploring of the HVAC system
to be able to find out what are the unit IDs
and other information.
One of the things that we want to do here,
this is Metasploit.
If you haven't seen it before, this is a hacking framework.
Let's go ahead and just do a quick search,
and looking for Modbus units.
These are the modules that deal with Modbus,
and Modbus is the most widely used protocol
in these HVAC SCADA ICS systems.
Schneider Electric, who's the developer of Modbus is
one of the largest players in the HVAC industry.
- I love this story I heard you tell about,
you used showed 'em to find system online,
and just tell us the story.
They weren't very impressed with you, were they?
Because you had got into the news and stuff,
or something like that, yeah?
- Yeah, I can show you that.
I've got it here. - That'd be great, yeah.
- [OccupyTheWeb] Schneider makes
these automated building systems.
Basically it's an HVAC system.
It controls the temperature, the humidity,
locks and doors, what have you.
Here's a sample of what these look like,
and what I did in this case is I just went up
and got on Shodan, and looked for systems
that in their banner say
that they're Schneider Electric automation.
Looks like there was, less than 100, 65 it looks like.
I started playing around with them,
and I just SSHed into one of 'em.
- So you found the IP address on Shodan,
then you just SSHed directly to it, yeah?
- I just SSHed directly into it, and you see it says,
I've logged in here.
There was no password to SSH.
I'm going in as admin.
This is 2016, so this is actually
after "Mr. Robot" takes place,
so this could have been what Elliot would do,
he could have done remotely if the system was online.
- Yeah.
- So I went in, SSHed into it,
looked at the help screen on the SSH.
You can see I went ahead and just typed release.
Notice that I'm in as admin here, right?
- [David] It's crazy.
- This isn't a test system.
This isn't an educational system.
This is real live system,
and just ran a couple of commands on it.
I did the Uptime on it, and looked at the etc password file.
- Just explain that.
So you did Uptime pipe cat?
Can you just explain what you did there?
- What I did in this case is it's the pipe command
right here, so I did Uptime, and then did cat,
that's a pipe, and then cat etc password.
Etc password in an older Linux system is
where passwords were stored.
Now it's where all the accounts are stored.
Passwords are stored in shadow, etc shadow,
So I just ran a pipe between Uptime and the cat of the etc.
- You didn't have to use the Uptime command?
You're could have just did cat directly, yeah?
- In this case, if I remember correctly, yeah.
I had to actually use the cat to get into it,
so this is one of the many weaknesses of the system is that
we can pipe system commands to the underlying server
after these SSH commands,
so to get to the underlying server,
I had to pipe it. - Oh, I see.
Okay, so you run like a valid command,
and then you run an underlying command.
That's why you did it that way.
- Exactly, yeah, pipe it to the underlying server.
With SSH, you're limited to SSH commands.
What I'm doing here is I'm using an SSH command,
then piping it to an underlying server command.
Now I can go ahead and do sudo I, and now I've got root.
- [David] And did you have to put a password in?
- No, there's no password at all.
(David and OccupyTheWeb chuckling)
So I published this in 2016.
This was like, I think it was August of 2016,
somewhere around there, and I put this up on Hackers-Arise,
and you can see I'm in-
- Oh, I see now you can do the cat, yeah.
- Now I got cat of etc shadow.
Because I'm root, I can get the passwords off the system.
There's also an area where the whitelist rules,
which they were not using, (chuckling)
and I went ahead and showed you that I could get
into the whitelist rules, and I could have gone ahead
and added myself on their system,
and I would've been in there for indefinite amount of time.
This would be a system similar
to what Elliot was trying to get into.
I had total control over this building.
This is an industrial building.
I'm not gonna tell you where it's at,
but it's an industrial building.
After I did this, Voice of America did a big article
on the weaknesses of SCADA ICS systems,
and they interviewed some people and they said,
"The industry is so vulnerable
that this anonymous hacker just published an article
about how he hacked into this system and got
root privileges, and that's how vulnerable the industry is."
Thank you very much.
That was my whole point, right?
And then once that happened,
Schneider Electric got very upset,
and I got some nasty emails from Schneider Electric,
and I said, "You guys knew about this.
Don't get mad at me about demonstrating to the world
how poor your security is,"
and so we had a lot of nasty back and forth,
and then within a couple of months,
they went ahead and fixed this vulnerability,
so everybody who runs one of these systems should send me
a Christmas card.
- [David] Exactly.
- [OccupyTheWeb] 'Cause I saved you. (chuckling)
- Is it still bad today?
- It's still bad today.
It's not as bad, but it's still bad.
Here's Schneider's website on their automation,
building automation systems.
This is what they sell.
They're probably the biggest seller in the world
on these systems.
They are the oldest company in this industry.
Anyways, let's go on and see what Elliot could do now.
There's a module in Metasploit called find unit ID,
and what this does is that these PLCs within this network
all have identifying numbers.
They're called unit IDs, kinda like an IP address.
There's up to 255 of 'em.
Well, let's go ahead and just demonstrate what it can do,
and I'll just do an info on it.
There's also a module that does the same thing.
Nmap has a script that does the same thing as this.
It says, "Modbus is a cleartext protocol used
in common SCADA systems, developed originally
as a serial-line async protocol, later transformed to IP,
where it's called Modbus TCP.
Default port is 502.
This module sends a command.
It's a in hex, it's zero four read input register
to the Modbus endpoint.
If this command is sent to the correct unit ID,
it returns with the same function ID."
What it does is it goes out and tries to find
the PLC numbers, essentially,
the unit IDs of each one of the PLCs,
and so what we're gonna do is we're going to go ahead
and do this in the real world, David.
(David and OccupyTheWeb chuckling)
So I'm putting you on notice here
to a (censored) building control system.
So we're gonna go ahead and go set R host,
and then now that we've got that set,
we'll just do show options,
so you can blur out this IP address.
- You've got SCADA courses coming up, is that right?
- I have a SCADA course coming up in September.
- So you'll go through this kind of stuff.
The stuff I can't show, you can show in your course.
So I'll blur whatever needs to be blurred out.
- And so this is very similar to doing, say, an Nmap scan,
but it's in a SCADA system.
In this particular, it's a Modbus system.
We're trying to find the IP addresses.
Maybe it's closer to like a ping sweep,
but it's inside of a SCADA ICS system.
Let's go ahead and do exploit.
Part of the problem of using Metasploit remotely like this
on the hacking pi is that being able
to stop it is difficult, 'cause it wants, to try to stop,
it actually will drop the connection.
- Yeah, I forgot you actually, you've actually got
a Netcat connection to the pi, haven't you?
- Right, this is, I'm actually controlling the pi.
The pi is doing this work.
- Yeah.
- The pi is going out and connecting to this system.
Now, it'll have up to 254 of these station IDs,
and so if we just let it run, it'll take a while.
I'm gonna try to, I mean, we could do that,
but for the sake of brevity, ah, it dropped out, okay.
This might actually be in our favor.
My connection to my hacking pi is maybe dropped.
I'm not getting any response from it right now.
Let's see if I can do an IF config on it.
Oh yeah, I got it, okay.
Now that we're back now, we got a command line,
that's back in the shell still, and I've installed
another tool on that hacking pi that's called a Modbus CLI.
I'll go ahead and just show you how to install it here.
It goes gem, install, Modbus CLI.
Okay, that's the command.
What we can do with this tool,
we can begin to probe the memory within those PLCs.
We can go ahead and take a look around,
and see what's in memory, and this is where Elliot,
what he's trying to do is he's trying to find the PLC
that is controlling the temperature.
If you can get to the human machine interface,
that would be ideal, 'cause then all he has to do is take
the little meter and turn it up, right?
That would be, it's unlikely, but it's a possibility.
But now that he's inside the system,
with some reconnaissance, he can begin working his way
through the PLCs, looking for the control
that's gonna change the temperature,
and this is a tool that basically allows him to probe
the memory within these PLCs.
- I've had to blur out a lot of the video,
because I don't wanna lose my YouTube channel.
OccupyTheWeb did this live,
so it's all open, nothing's blurred.
So if you want to see an example of this
without everything being blurred and edited,
then have a look at the video below.
- This is what Elliot would have to do is to write
over those values to be able to get the temperature.
So the system, the HVAC system is gonna have
a minimum temperature and a maximum temperature.
It's gonna try to keep the temperature between those values.
Elliot could then basically, like changing a thermostat,
go ahead and change it to raise the temperature
to 97 Fahrenheit, and therefore be able to disintegrate
and make useless the tapes.
This is where it stretches credulity
in that it would take a lot of work.
If you worked round the clock at it,
and you knew these facilities well,
you probably could do it in a matter of days,
but certainly not in a matter of minutes or hours,
maybe a month if you were fully aware and fully understood
how this Modbus protocol works and the PLC works.
It's interesting that two of the biggest hacks
in season one are both SCADA ICS hacks,
which I think is the one area of hacking
information security, cyber security that is overlooked.
People don't give it enough attention.
With cyber war breaking out between Ukraine and Russia,
the attacks now are beginning to go to this level
of getting down to the industrial facilities.
In any case, this is what Elliot was doing.
This is getting inside the facility,
putting in a hacking pi, and then being able to do
reconnaissance on the network inside of the facility,
and then once he knows what's going on inside the facility,
he can begin to change the values inside the facility.
Now, the other thing that's important to note here,
you can write externally to some
of these industrial facilities.
What I'll see oftentimes is that I can read externally,
but they'll have a blacklist, or more generally,
they'll have a whitelist of who can write to the facility.
He's inside, so his IP address is inside the network,
so he's gonna look like he's a safe IP address writing
to these PLCs.
That's another reason why he would want to be inside,
because oftentimes like we saw in the case
of that facility that I hacked in 2016,
that they have a whitelist and blacklist.
You might be able to read from the outside,
but you can't write, which makes a lot of sense. (chuckling)
I mean, that's the way it should be,
but Elliot is inside the network now,
so he should be able to read and write both.
- Is there a special type of cabling used on these systems?
How does that work?
- In most of these SCADA ICS systems,
internally they're using RS485,
which is a serial type of cable.
Basically, they had to have power,
and they had to connect to the network,
so we had to have both ethernet or some connection
to the network, so when he's actually in there cutting
the cable, that might be a serial cable.
I didn't look at it that closely to be able to see,
but internally, these networks communicate
over a really simple serial connection,
kind of similar to what they used to use for printers.
We used to use RS232 for printers.
This is RS485, it's very similar,
and it's used in most of the facilities.
You'll see sometimes in some of the facilities nowadays,
newer ones where they'll actually use ethernet internally.
Many of these facilities have been built years ago,
and they're still using serial connections.
Modbus, and many of the others are
all basically serial protocols.
Even though they will communicate to the rest of the world
over TCP/IP, internally, they'll communicate using Modbus
or PROFINET, or OPC, or what have you.
There's about 200 protocols.
There's about 50 or more companies making these things.
Almost all of 'em have their own protocol.
Modbus is the closest thing that we have
to a single protocol that's used in multiple facilities,
because they were first, 1978.
When people build PLCs today, they will often still put in
a Modbus connection to allow that PLC to communicate
over Modbus or their own proprietary protocol as well.
This is part of the research that you would do is to go
and look at their products,
and they actually have schematics on their website.
They talk about being able to connect to multiple protocols,
so you see these are thermostats, room controllers.
They'll have multiple connections to multiple protocols.
Modbus is the one that basically was developed by Schneider.
It's the most widely used, but when you say
most widely used, we're still talking about less than 50%.
So that's what Elliot would do if he was actually
gonna go ahead and try to turn the temperature up.
One of the things that would make his job
even more difficult, if he gets inside this HVAC system,
he not only has to turn up the temperature,
but he has to turn up the temperature specifically
in that one vault.
(David and OccupyTheWeb chuckling)
He'd make it even more challenging,
'cause if he turned the temperature up
in the whole building, they would immediately be noticed.
- I love what you said like on the previous episode,
and other times you've spoke at,
the hacks in "Mr. Robot" are very close to the real world,
it's just the time scales are wrong, yeah?
- He's using the right tools,
he's going about it properly, but the timeframes,
because nobody's gonna sit around and watch hours and days,
or weeks of people doing research and reconnaissance,
that wouldn't be interesting television,
but the tools are right, the approach is right.
the techniques are right, it just,
the timeframes are compressed for the attention span
of the folks who are watching the show.
- Is there like a simulation,
or is the only way to learn this,
I think you've mentioned previously,
is the only way to learn this to buy the equipment,
or can you like simulate it to learn it?
- I'm actually putting together a simulation system
for the class in September.
People have been asking me for a simulation system,
and I'm putting one together.
You can do it at your own home.
You don't have to go out and do it in the real world.
PLCs can run anywhere from a few hundred dollars
to tens of thousands of dollars.
You can get 'em used off eBay, what have you,
but in any case, I'm putting together a simulation system,
and hopefully we'll have that ready
for the class in September.
- Are you gonna buy real devices, and then connect them in,
put them together in a lab that people can access?
Did I understand that right?
- It's not gonna be real PLCs.
- Okay.
- Because if I put together real PLCs, remember,
they're communicating via serial connections,
so we want something that we can connect to remotely
over TCP/IP, so it's gonna be a simulation.
It's not gonna be a real PLCs.
- No, but that's fine.
I mean, it's better to learn sometimes
on something like that.
Are there any books that you recommend?
Because let's say I'm interested in learning SCADA.
I mean, I can attend your class, but it's only in September.
Any other things I can do,
like buy books, or stuff that you recommend?
- The CISA has some good educational materials there.
You might take a look at those.
There's a number of books.
Let me see, try and remember what the names
of those books are.
I'll look around here,
and see if I have any of 'em on my shelf.
- OccupyTheWeb, I really wanna thank you.
Thank you so much for sharing, and making this fun,
because it's really nice to see "Mr. Robot,"
and what they're actually doing
in the reality of you showing it properly.
- Give us some feedback on what hacks you wanna see.
There's a lot of hacks in this show,
so let us know what's most important to you,
what's most interesting to you, and we'll try to do those.
- Brilliant, thank you so much.
- Thanks, David.
(upbeat music)