Digital Bond

For Secure & Robust ICS

  • Home
  • Consulting
  • S4x19
  • Dale Peterson
  • Hire Dale To Speak
  • Contact Us

S4x15 Video: Simulating Multiple Substation Failures

May 7, 2015 by Dale Peterson Leave a Comment

This is a great session for power engineers and those involved in substations to watch. It is an extremely technical session by Dr. Chee-Wooi Ten of Michigan Technological University.

The key point is actually easy to understand. The most critical substations to secure may not be the highest voltage substations, and this session provides a set of mathematical equations to perform an impact analysis to identify the most critical substations.

Dr. Ten gets into the modeling and mathematics in significant detail in the video.

Filed Under: S4 Tagged With: S4x15, Substation Security

S4x15 Video: Power Fingerprinting

April 29, 2015 by Dale Peterson Leave a Comment

We generally do not allow product presentations at S4, but occasionally there is a technology that is novel or potentially important that we make an exception. For example, we had Kaspersky present on their ICS operating system at S4x15.

A second exception was made for Carlos Aguayo Gonzalez of PFP Cybersecurity to present the idea of using Power Fingerprinting to identify changes in PLC or RTU logic or firmware.

I won’t attempt to summarize the technical details; watch the video. It includes a demo of the technology.

However it is interesting that the Power Fingerprinting sensor is in fact not connected to the device it is monitoring. Hello air gap. It also is a potential tool for addressing the supply chain problem.

Filed Under: S4 Tagged With: Power Fingerprinting, S4x15

S4x15 Video – Creating Secure ICS Protocols

April 6, 2015 by Dale Peterson Leave a Comment

At S4x14 Adam Crain of Automatak, along with Chris Sistrunk, presented the results of their Project Robus that fuzzed DNP3 stacks and found most had problems with processing malformed or illegal responses. This year at S4x15 Adam talked about Avoiding Insecurity in ICS Protocols.

Adam compares Schweitzer’s Streaming Encryption Protocol (SEP) with DNP3 Secure Authentication Version 5 (SAv5).

Two of the main criteria he discusses and demonstrates with those two protocols are 1. have a clear trust boundary and 2. keep it simple. It is clear why there were so many bugs that led to vulnerabilities in the DNP3 protocol stacks.

This is a must watch for any group adding security to an ICS protocol or those that need to start this important and necessary ICS protocol feature.

Filed Under: S4, SCADA Hacking Tagged With: Adam Crain, DNP3, S4x15, SEP

S4x15 Video – Ginter on Embedding Malware in ICS Protocols

March 27, 2015 by Dale Peterson 1 Comment

Andrew Ginter of Waterfall Security Solutions speaks on Embedding Malware in ICS Protocols. His conclusion is this is harder than one thinks. The easier solution might be to use the SQL server, web server, ftp server, or other commonly exploited protocols that ICS applications integrate.

Fair warning – the second half of the session gets a bit commercial on his/Waterfall’s view on why unidirectional security solves ICS security challenges.

Filed Under: S4 Tagged With: ICS Malware, S4x15

ICSage Video: Eireann Leverett on Catastronomics

March 20, 2015 by Dale Peterson 2 Comments

Eireann Leverett of the University of Cambridge Centre for Risk Studies looks at control system related catastrophe scenarios and the economic impact of these scenarios with an eye towards how insurance and reinsurance policies will be written and priced.

Admittedly critical infrastructure cyber security is a new topic in an insurance industry that has been around hundreds of years. Eireann points out that insuring against malicious attacks is not new to the insurance company. They insured against piracy on the seas.

The session provides some relevant macro economics in easy to understand language and graphs, and Eireann admits “we’re inventing rough metrics in a land of no metrics”.

His initial efforts are related to an important cyber incident that could impact the US, UK and European bulk electric system. The % loss of GDP due to an incident sounds like a good measure if it can be credibly calculated.

The Q&A in this session was particularly good, which is understandable since there are more questions than answers at this time. It’s a fertile field for those looking for an important economic problem.

For what it’s worth … this was my 18-month old daughter’s favorite session.

Filed Under: S4, Security Economics Tagged With: Catastronomics, Eireann Leverett, ICSage, S4x15

S4x15 CTF ICS Village Page

March 16, 2015 by Dale Peterson Leave a Comment

The Capture The Flag (CTF) contest in the ICS Village at S4x15 was a big hit. We have had numerous requests from attendees and those that heard about it for more information and data. So Stephen has put together a page of information. The page includes:

  • Examples of flags in each of the five categories
  • Packet captures with ICS protocol and attack data (the most requested item)
  • Screenshots of detected data and the scoreboard
  • Pictures from the ICS Village
  • An explanation of the event

You may also want to watch an interview with the team that won the CTF.

Great job by Stephen and the team of volunteers who put the CTF together and kept it running under three days of attacks. It puts a lot of pressure on the team to make it bigger and better for S4x16.

Filed Under: S4, Tools&Talks Tagged With: CTF, ICS Village, S4x15

S4x15 Video: Ralph Langner or Cyber-Physical Attack Engineering

March 10, 2015 by Dale Peterson 1 Comment

Ralph Langner presented at ICSage: ICS Cyber Weapons during S4x15 Week. As always Ralph is introducing new thoughts to push the industry forward, but this session is more on how to orient and organize the ICS communities’ thinking on attack / defense on ICS.

There is entirely too much attention paid to 0days and compromising an ICS computer or application. This is still trivial to do based on code quality and is almost always unnecessary. A more useful line of thinking is what would or could an attacker do with this access, what would be the intended result, and what can we do to defend against it.

  • At the 9 minute mark, Ralph discusses different types of ICS cyber-physical attacks.
  • At the 22 minute mark, he breaks down impact categories of cyber-physical attacks.
  • At the 29 minute mark, he discusses examples of how to identify the defensive controls to prevent catastrophic results.

The pull quote, in my opinion, was “is there any combination of bits and bytes that if I throw that at this plant will result in harmful physical effects? This is a question that can be answered through engineering methodology”.

Filed Under: S4 Tagged With: Cyber-Physical, ICSage, Ralph Langner, S4x15

S4x15 Video: ICS Malware with Kyle Wilhoit

March 2, 2015 by Dale Peterson 2 Comments

Kyle Wilhoit has found and analyzed a large portion of the ICS malware found in 2014 / 2015. He goes into the details of:

– The Sandworm group looking for Internet exposed HMI and their targets

– Blacken / Black Energy targeting the GE Cimplicity HMI

– Havex scanning OPC Servers (including videos showing it being installed and exploiting the system)

– Trojanized SCADA software … WinCC (32 samples), Advantech (24), and Cimplicity

Filed Under: Anti Virus, S4 Tagged With: BlackEnergy, Havex, ICS Malware, S4x15

S4x15 Video: Kaspersky Control System OS

February 23, 2015 by Dale Peterson 4 Comments

Kaspersky announced their project to develop a Control System OS back in October 2012. We tried to get them to present some details on the design criteria and goals at S4x13 and S4x14 without success. So we were very happy to have Andrey Nikishin give a session on the Kaspersky.

In this video you will see:

– the OS is for “embedded connected devices” (examples given: Smart Grid, PLC, Medical Devices, Network Appliances, Automobiles)

– the OS is not a clone of any *nix

– a broad view of the architecture including separating the microkernal from the security server. The security server determines the “security verdict” for all communication.

– the concept of a “verdict cache”

There still are many unanswered questions, and Andrey forestalled these questions by asking the questions he would not answer at the end of the session.

Filed Under: S4 Tagged With: ICS OS, Kaspersky, S4x15, SCADA OS

Unsolicited Response Podcast – Interview with Kim Zetter from S4x15

February 17, 2015 by Dale Peterson Leave a Comment

zetter-book

We had Kim Zetter on stage for an interview at ICSage during S4x15 Week to discuss her new book: Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon. This first 2015 episode of the Unsolicited Response Podcast features that interview.

The podcast includes:

  • Who was the target audience for the book
  • Why Siemens didn’t play a bigger role in the book
  • The hard to believe Sean McGurk chapter
  • Did the US want Stuxnet to be discovered
  • How her book differed from David Sanger’s book
  • How Stuxnet infected Natanz
  • Details on Stuxnet version 0.5 that only spread through Siemens project files

The Unsolicited Response Podcast has been inactive for a while now, which is a shame because I enjoy doing it and get a lot of positive feedback. Much of the difficulty in recording the podcast has been solved now that I have a very mobile podcast rig that I can bring with while traveling.

I’m committed to a minimum of 20 podcasts in 2015, and there are a few compelling guests already lined up. We will wait until five episodes are recorded before bringing on podcast sponsors, but let us know if you are interested in sponsoring Unsolicited Response.

Subscribe to the Unsolicited Response Podcast in iTunes.

Filed Under: Podcasts, Stuxnet Tagged With: Kim Zetter, S4x15, Unsolicited Response

  • 1
  • 2
  • 3
  • Next Page »

Subscribe to the S4 Events YouTube Channel

S4x19 Is Open For Registration

Jan 14 – 17 in Miami Beach

Follow S4 Events on Facebook

Tools & Talks

DNS Squatting and You

DNS Squatting and You

February 24, 2016 By Reid W 3 Comments

Basecamp for Serial Converters

Basecamp for Serial Converters

October 30, 2015 By Reid W 3 Comments

escar Asia

escar Asia

September 9, 2015 By Dale Peterson 1 Comment

Unsolicited Response Podcast: Cyber Insurance

Unsolicited Response Podcast: Cyber Insurance

August 27, 2015 By Dale Peterson 3 Comments

S4 Events Newsletter

Subscribe to our newsletter on leading / bleeding edge ICS cyber security information and S4 Events.

* indicates required
Email Format

Dale's Tweets

About Us

Digital Bond was founded in 1998 and performed our first control system security assessment in the year 2000. Over the last sixteen years we have helped many asset owners and vendors improve the security and reliability of their ICS, and our S4 events are an opportunity for technical experts and thought leaders to connect and move the ICS community forward.

Recent Comments

  • Chris on Attacking CANBus – Part 1
  • Chris on Koyo/Automation Direct Vulnerabilities
  • Brandon Workentin on The ICS Security Stories We Tell And Love
  • Joe Weiss on Insanely Crowded ICS Anomaly Detection Market
  • Stuart Bailey on Unsolicited Response Podcast Is Back … With John Matherly of Shodan

Search….

Follow @digitalbond

Copyright © 2019 Digital Bond. - All Rights Reserved ·