[Bucharest] From SCADA to IoT Cyber Security
5 likes1,133 views
Bogdan Matache is a cyber security specialist with over 15 years of experience in IT, energy, and industrial control systems. He has penetration tested and hacked several industrial control and IoT systems, including fuel pumps, asphalt stations, cars, drones, and smart home devices. Matache now works as an auditor at EnerSec, focusing on cyber security for the energy sector. He discusses the growth of IoT and risks of attacks against availability, integrity and confidentiality in both SCADA and IoT systems. Matache also outlines common attack types, hardware, software and malware used to target these systems.
![[Bucharest] From SCADA to IoT Cyber Security](https://image.slidesharecdn.com/owasp2015v2-bm-151026105121-lva1-app6892/85/Bucharest-From-SCADA-to-IoT-Cyber-Security-1-320.jpg)
![[Bucharest] From SCADA to IoT Cyber Security](https://image.slidesharecdn.com/owasp2015v2-bm-151026105121-lva1-app6892/85/Bucharest-From-SCADA-to-IoT-Cyber-Security-16-320.jpg)
![[Bucharest] From SCADA to IoT Cyber Security](https://image.slidesharecdn.com/owasp2015v2-bm-151026105121-lva1-app6892/85/Bucharest-From-SCADA-to-IoT-Cyber-Security-34-320.jpg)
[Bucharest] From SCADA to IoT Cyber Security
- 2. from SCADA to IoT Cyber Security Bogdan Matache - Romania 2015
- 3. About ME, Bogdan Matache Cyber Security Specialist – Military Technical Academy SCADA Security Specialist – InfoSec Institute Auditor – ISO 27001 Specializations: Cryptography, Social Engineering, SCADA Pen testing IT&C – over 15 y Energy @ OIL Sectors – 10 y SCADA for Renewable Power Plants – 5 y Pen testing – OIL Sectors systems – 3 y Pen testing – Electrical Systems – 3 y
- 4. What I hacked ? Fuel Pump ( I changed densitometers values )
- 5. What I hacked ? Asphalt Station ( I Changed the percentage of bitumen)
- 6. What I Pen Tested ? VoIP Networks WiMAX BTS Cars (doors open system, tachometer, gps) Intelligent House System, Smart Buildings 6 companies in 8 months ( Social Engineering ) PLC’s (programmable logic Controller) Smart Electricity Meters Smart Gas Meters Magnetic & RFID Access Cards Drones Control System Etc.
- 7. What I do ? I work as a security auditor at EnerSec, a company specialized in Cyber Security for Energy Sector
- 8. Definitions What is SCADA What is IoT What is Security
- 9. ICS and SCADA Industrial Control Systems (ICS) is an umbrella term covering many historically different types of control system such as SCADA (Supervisory Control and Data Acquisition) and DCS (Distributed Control Systems). Also known as IACS (Industrial Automation and Control Systems), they are a form of Operational Technology. In practice, media publications often use “SCADA” interchangeably with “ICS”.
- 10. SCADA system
- 11. Cars OBD 2 (On-Board Diagnostics)
- 12. Airplanes ADS-B ( Automatic Dependent Surveillance Broadcast )
- 13. Ships AIS ( Automatic Identification System )
- 14. Other hackable SCADA systems Power Plants (Nuclear Plants) Transportation System ( Train Switch Crossing and Beacons ) Robots in factories Etc.
- 17. What is IoT ? The Internet of Things (IoT) is the network of physical objects or "things" embedded with electronics, software, sensors, and network connectivity, which enables these objects to collect and exchange data.
- 18. IoT Growth
- 19. SCADA vs IoT More devices More Systems More data More connectivity / access points More ‘home’ users Equals - More opportunities
- 20. Attacks Types for SCADA Power System or Water System ( most likely terrorism ) Attacks upon the power system. target – power system itself Attacks by the power system. target – population ( make dark or rise lever of chlorine ) Attacks through the power system target - ex high voltage for a specific company
- 21. Attacks types for IoT Open doors ( Bluetooth Lockers, hotel rooms) Unwanted Surveillance (baby monitors or smart TV’s) Damage things ( Sprinklers, cooling systems ) Pace Maker GPS ( fleet monitoring ) Burglars ( profile from smart meters, energy consumption)
- 22. CIA vs AIC IT Security confidentiality, integrity, availability SCADA and IoT availability, integrity, confidentiality
- 23. Protocols For SCADA ( PLC’s) ModBus, DNP3, IEC 60870, IEC61850, Embedded Proprietary, ICCP, UCA 2.0 For IoT Bluetooth low-e, Wi-Fi low-e, NFC, RFID, ANT, Z-Wave, Neul, SigFox, Thread, 6LowPAN, ZigBee, Cellular, LoRA WAN
- 24. Software for Hacking SCADA / IoT Black Arch Linux Hack Ports Helix, Kali Linux Samurai STFU Security Onion OSINT Dedicated software exploits for PLC’s for Siemens, Allen Bradley, Schneider, ABB, etc.
- 25. Hardware tools for Pentest WiFi Pineapple Rubber Ducky
- 26. Hardware tools for Pentesting Hack RF
- 27. Prox Mark 3 clone RFID Mifare cards Hardware tools for Pentest
- 28. Malware example for SCADA / IoT Stuxnet, Havex, Flame, DragonFly APT is most dangerous
- 29. Critical risk scenarios RS 01 - disrupting the operation of control systems by delaying or blocking the flow of information through control networks, thereby denying availability of the networks to control system operators; RS 02 - unauthorized changes to programmed instructions in PLCs, RTUs, or DCS controllers, change alarm thresholds, or issue unauthorized commands to control equipment, which could potentially result in damage to equipment (if tolerances are exceeded), premature shutdown of processes (such as prematurely shutting down transmission lines), or even disabling control equipment;
- 30. Critical risk scenarios RS 03 - send false information to control system operators either to disguise unauthorized changes or to initiate inappropriate actions by system operators; RS 04 - modify the control system software, producing unpredictable results; RS 05 - interfere with the operation of safety systems.
- 31. Defence / Alerts ics-cert.us-cert.gov CERT-ICS.eu