Did you return your papers exam papers already? All right Okay, let's get started one of your friends asked a question. Well Arab, could you please reiterate that question so that everybody hears? Alright, so how do they start? carrying out inspections as I said here every non-nictor rep in state Party to the MPT that is a country Which promised not to develop Nictor weapons signed and ratified the treaty must conclude a safeguards agreement? safeguards Agreement must signed a safeguards agreement with the IAEA Within I guess six months after the ratification and this safeguards agreement Will be signed according to the model protocol because the model protocol in its 114 paragraphs Describes the the method and the procedure that will be applied by the IAEA in carrying out inspections So after signing the MPT as a non-nictor weapon state and ratifying it within six months Every country every non-nictor weapon state must conclude a safeguards agreement Based on the model protocol of 1970 which as I explained the first hour relatively weaker document and according to this document the IAEA and the country will Agree upon the methods and the procedures as to how to carry out inspections and after that safeguards agreement signed at a given time the IAEA will notify the country Whichever it's going to carry out inspections about its forthcoming visits Actually in the model protocol there was room for challenge inspections Normally inspections are carried out according to a schedule and the IAEA and the state authorities Sit and decide on the dates of successive visits of the IAEA during which these inspections will be carried out and Normally a nictor facility will be inspected maybe every year or every other year depending on its scale depending on the Significance of the material that may be there because you do not go and visit the same facility every year If there is nothing going on or there's not it is not likely for anything to go on in the future so it depends on the assessment of the IAEA technical body and This this fix a schedule as to how frequently These facilities that will be declared to the IAEA will have to be visited and inspection should be carried out so Once these inspections are carried out if everything is fine if IAEA does not find anything suspicious about the Amount of the nictor material that are used during the operations or about any other activity They say all right. I went to this particular Facility I carried out inspections according to the model protocols procedures and I have not found anything suspicious So I can say that there is nothing going on I can verify that things are going according schedule or according to the declared intentions of the states There is also as I said this challenge inspection a challenge inspection is an inspection Which will not be notified to the state authorities and the IAEA of course will on a very short notice For instance today is Tuesday and they send a cable They send a message or whatever call someone or send a telegram or something and Notify the state authorities that on Thursday a team will come and visit such and such facility to carry out inspections There may be some problems Because every single IAEA inspector will need a visa most probably to enter that country And if there is any problem with visa sort of issuance of visa this challenge inspection may be Postponed or they may not go to that country because of some other conditions or they may say well We cannot open our facility to to your inspections because of such and such operation going on Of course challenge inspection can be asked by the International Automotive Agency Board of Governors only if there is Good reason for suspicion about some activities going on so either after a routine inspection or After a challenge inspection the task of the IAEA is to report to the board if there's anything suspicious or if everything is Going on according to the declared intentions of the state if there's anything suspicious The IAEA Board of Governors will notify the state and will ask for further Clarifications about the points that the IAEA inspectors on the ground were not satisfied Either they may not be given escort to visit some place or they may not be presented enough material or they may not have enough Explanation about some missing material So the IAEA inspectors will say all right we went there But we were not satisfied so we cannot verify that they are doing everything fine So the board will ask for clarification and if the board If the state provides that necessary information which was missing during the Inspections then the board might be satisfied But if the board is not satisfied even after the clarifications of the state or No clarification at all The only thing the board can do is to take issue to the United Nations Security Council Because the board the IAEA does not have its police force does not have any enforcement capability so the only thing the IAEA can do is to sort of Transfer the file the dossier of that country to the UN Security Council and the United Nations Security Council Will of course deal with the problem so of course Can the IAEA rely on intelligence? According to model protocol the international atomic energy agency cannot rely on intelligence The IAEA does not have its own intelligence either. So the whole issue was of course depending on the Information that will be supplied by the state So if the state supply enough and and satisfactory information and allows inspections without any hinderance or without any obstacles provocations then the IAEA can go there and Carry out inspections if there's nothing wrong go back home to Vienna headquarters write the report and says There is this clean bill of health. There's nothing wrong with that country So therefore but if anything suspicious going on as I said or if they hear They get some intelligence From their resources, of course according to additional protocol. They can rely on this intelligence but Hans Plix was here a couple of weeks ago and he was the Of course previous former director of the IAEA before Muhammad El-Baraday and even before Rolf the chaos and Of course, he was the director of General of Unmovic and he said actually during his term as the head of Unmovic they were Provided with hundreds of intelligence reports from dozens of intelligence Sort of organizations and he said and I remember him saying that back in 2003 At the United Nations Security Council when it was presenting his report He said what we need is not lots of information lots of intelligence. We need is reliable intelligence So of course many states might provide intelligence Just as the ones that you see at the week leagues and many of which are baseless are just rumors are not Substantiated with facts figures data where five variable sort of a tangible information, but therefore This intelligence might fool the minds of these people. So what they need is Correct information reliable information timely information or intelligence about something that might be really going wrong and The IAEA of course depending on what kind of protocol is applied to that particular state May visit that country and if finds something wrong, of course, it will write in this report So the IAEA is prompted by of course first of all the the procedures and The sort of terms of the mother protocol They are given the right to ask for inspections for challenge inspections or to go to that country As part of the routine inspection schedule and if they hear something they may of course use this bilateral sort of Connections with people for instance the director general as I said in 2002 when there was this Revelations coming from the Iranian opposition group He went to Tehran asked for clarifications about Natan's facility, which was not declared to the IAEA and he was most possibly not satisfied because I was one of the scholars who were invited to the IAEA headquarters back in 2003 in early 2003 February if I'm not mistaken and El Baradei just came directed from Tehran and he did not even go to his office and came to the meeting room You might have seen this big hole the this the plenary room of the The IAEA and one of the first things he said I remember that Iran will have serious headaches about these allegations and Couple of months or a couple of yeah a couple of months later, and that was not public yet. I Was among these scholars who were informed by the IAEA Muhammad El Baradei about this situation, but of course we are not allowed to disclose This information to other people but Several months or a couple of months later He made this public statement and asked from the IAEA to sign the addition additional protocol and as I mentioned The deadline was December 31st and in early to November 2003 with the initiative taken by the European Tree The Iranian authorities signed but still not ratified the additional protocol according to which from November 2003 all throughout 2004 and early 2005 Until I made an adjunct came to power with the June 2005 election and a few months before that European Union Tree French British and German sort of Four ministers and Iran Incorporated as if additional protocol was enforced But as I explained when it came to carrying out inspections and parts in me meter base There was a deadlock. So this is again something about how difficult this situation is because after all on the one hand Iran has its sovereign rights to carry out in carry out all the Research and building facilities because according to article four of MPT States who promised not to develop nuclear weapons or not to divert their peaceful Nectar capabilities to meet your capabilities are allowed to develop Indigenously by themselves or by way of transfers with cooperation with other countries They can develop nuclear facilities for peaceful uses and enrichment as well as the processing are or such facilities they can be used for Peaceful purposes as well as meter purposes. So random enrichment enrichment and processing are Actually have two faces. They can be used for me tree and peaceful Me tree and peaceful purposes. I Mean if you and rich Somewhere between 3.5 to 8% It can be used in low-energy random light water reactors Or if you are rich up to 20% you can use in research reactors if you are rich up to 60 or even 80% you can use in submarines or aircraft carriers Because instead of carrying tons of thousands of gallons of gasoline if you have a Nectar reactor for sort of powering the The submarine or the aircraft carrier then it is of course no metric use I mean the fact that submarines might be or aircraft carriers might be me tree assets this does not mean that the use of 60 or 80% a rich uranium in submarines does not necessarily mean a military purpose Because when we say meter purpose we talk about weapons purposes and submarines fueled by nuclear reactor or For electricity generation for cleaning the air for Discellinating the water just to stay under the water for a long time. This is still within the context of peaceful use of course if a country has this much Unrich or even higher levels of them because in some submarines you have either 90 plus and which ran so a percent 90 plus percent and which ran so Still maybe within the formal formally within the context of peaceful use But this much a rich uranium is always something that can be easily diverted from Peaceful to major purpose. So therefore this is something I mean Richmond is a way Which may which might go all the way Of course 90 plus percent as weapons So you see from very peaceful uses In light water reactors, I mean power reactors just and generate electricity, etc Or research reactors 20% 5060 or even 80% in nuclear submarines or aircraft carriers still peaceful But when it comes to 90 plus percent and if the intention is to use in weapons warheads Then or as a atomic bomb that it is military Same applies to this you're processing as I try to explain you that I'm not going to go into the technical details not to bore some some of you but processing is the extraction of plutonium Actually, it is 238 Isotope which captures a neutron turns out to be plutonium to actually you 239 which is plutonium and this plutonium After some time, which is in the waste you sort of take the waste waste and put immersed in Deep water for cooling down takes about a year a year and a half and after that you take it out and you extract the plutonium Which is inside the waste and this plutonium can either be used in nuclear warheads directly Or can be used again for peaceful purposes in nuclear reactors And as I said before I mean in past previous weeks Many if not all of the Japanese nuclear reactors are fueled by plutonium and This is a real concern In some parts of course just like we have seen in the week leaks documents People do not say this allowed in front of public and they do not express their concerns about the stocks of plutonium That Japan has which according to some estimates might be enough to produce around 3,000 5,000 nuclear warheads But still the same plutonium can be used for purely peaceful purposes in more than 50 nuclear reactors of Japan But concerns are what if Japan one day changes its mind and Decides to go nuclear to develop nuclear weapons They will have enough plutonium stocked and They even you know built a very large plutonium-sensing facility in Rokosha Mura and Until such time they were sending the fuel The waste coming out of their nuclear reactors to France and Germany and they were getting back in terms of plutonium so this this plutonium stocks has have always been a very Sensible issue, but of course Japan is not a rock state. Japan is a democratic state Japan is a state which is quite aware of the very negative consequences of developing nuclear weapons by itself Breaching its international obligations not complying with the inspections, etc It is very unlikely that Japan might develop into weapons for the foreseeable future but if the whole international system changes and sometimes I mean unlike the past now the the frequency of Ground-breaking events ground-breaking developments is actually much smaller. I mean in the past Maybe every 30 years every 25 years some important things were happening now almost every Five ten years things are happening. So what if say from 10 15 years from today? some unusual developments take place some extraordinary developments takes place and and then Japan under the psyche of these developments for instance, North Korea and South Korea Reuniting and keeping their nuclear weapons capability. Japan then may decide to go nuclear This is something that was told to me by a Japanese ambassador So therefore and it was I mean he did not ask me not to say this anywhere. So this is not something Actually private and this is something that many people in the field know very well. So therefore These two technologies capabilities are Significant both for me tree as well as peaceful purposes It is important to bear this in mind and when a country develops a nuclear and Richmond capability or repossessing repossessing capability Of course, you look at the capabilities and the intentions remember threat is a combination of capabilities and intentions whichever of course should be Given more or a sign priority depends on the country that you're talking about and the context For some countries you may have to pay more attention To the developments in the capability because it might be a very stable country And it might be very unlikely for the intentions of that country to change For instance, Nordic countries Sweden, Denmark, the Netherlands Belgium Germany Well, Germany is still being doubted by some anyway, but it is I mean you do not doubt their Intentions because for instance Sweden back in the 50s discussed this issue in the parliament after long discussions They have decided to put in the constitution a restriction for the forthcoming governments That would prevent them from developing new weapons. So it is by constitution Unlawful for any government in Sweden to embark on a nuclear weapons program It will be anti-constitutional if a Swedish government did something to to build nuclear weapons. So therefore You might be much more confident about the peaceful intentions of Swedish government, for instance But what about Iran or what about other countries in the world that are that have been and still are At the focus such as North Korea so therefore depending on the context depending on the nature of the regime or the Administrative style or making politics because some countries are more true to their words. I mean they act the way they speak and What we have seen again from these weak links that Turkey is sort of Statements before the public and behind the doors are very similar and as I said many times Not only here, but also to foreign diplomats or in the conferences. We do not know how to make tricks So really, I mean, I don't know whether this is a plus or minus But it is not in our culture to be very to carry out tricky politics. We do not know how to do it So we will definitely fail even if we try to do something like that, but some countries are very professional I will not name here anyone, but you can guess so therefore it is it is very Important to look at some countries capabilities Whatever they say about their true intentions, you may not believe or you should not even believe at all So therefore if there's any increase in the capabilities Whatever they say with respect to their intentions that they do not do anything wrong You should pay attention to the capabilities, right? So therefore in order to make an assessment about the Dimension of the threats so therefore it is something very Difficult to assess in the past Before France developed its nuclear weapons in the second half of the 1950s Because they tested their first device in 1960 and in the run-up to their first new tests There were some discussions in the French parliament in the French public in the press and the public in academic circles As to whether France was developing the weapons and the French parliamentarians ministers from the government inform their own Cabinets and all that their own parliamentarians and said and always said Denied all the acquisitions that France was developing weapons. They said no, we're not doing anything like that All our intentions are peaceful. We are not developing into weapons at a time when there was nothing that would restrict France from developing nuclear weapons. There was no MPT nothing And even after MPT there were nuclear weapons state So there was no reason to lie actually but what they did was to not necessarily tell the truth because this is a matter of national security and Especially after the Suez Canal crisis and after the goal who saw how the United States behaved during the Suez Canal crisis remember 1956 and That they were let down by the United States because British French and Israeli forces attack Egypt and Who intervened it was the United States and Russia of course I'm the Soviet Union because they did not want this issue to escalate So after this incident France lost its confidence in the United States and actually Because I studied with French professors at Lissé de Galatasar. I I know the French mentality They have to be at the forefront of everything at the center of everything So they said we have to have our independent nuclear capability and they embarked on Nuclear weapons development, but at the same time they said that they were not doing it So and then after they detonated their first thinker device that everybody knew about nuclear weapons Capability of France they said well at that time we had no other option but to say what we have said So there's no country which Exactly or declares what it is doing in any especially in any of such issues which have Nectar security implications So therefore this is something that we should also bear in mind. So when it comes to I mean going back to this issue the United States Perceives Perceives Iran as a as a threat for its own interests as well as for the interest of its allies because they are not necessarily sort of Confident about the declared intention of Iran because Iran says we do not build nuclear weapons This is against Islam. This is against the Quran. This is against our belief system. This is against our World view and everything but not many people believe in what they say and what when they look at their capabilities especially over the last 10 years there's a steady increase in terms of military capabilities, I mean the ballistic missiles whose ranges extended from 1998 which was 1300 kilometers and this year or let's say 2009 or 2010 It's approximately not this is exactly 2500 kilometers Almost double the range of their Shahab three missiles in tests. Well, this is a little bit of Distorted information, I'm not sure if they exceeded 2000 kilometers But information suggests that they have exceeded. Well, I'm still do dubious I mean, I doubt it but yet there is a clear indication that there is a steady increase in their military capabilities plus in their peaceful capabilities in terms of Bush area after now starting operation and Will still be will soon be generating electricity in the coming months and also a number of scientists Number of facilities that they have built some of which were secret just this time last year secret enrichment facility a clandestine enrichment facility was surfaced by the CIA and before CIA's declaration Iranians themselves have Dictated the world that there was another undictated enrichment facility of smaller scale in Qum So the Qum facility Was supposed to have something a capability to host 3500 up to 5,000 and and centrifuges And when when compared to the Natanz facility which could host not for the time being but when finished fully Which can host 50 55,000 enrichment and centrifuges The Qum facility would be significant especially if Iran After having and reach random up to 3.5 percent. Let me just I mean Put this here. I mean this is Natanz its capacity is 55,000 centrifuges and These centrifuges are rotating very fast and separating 238 and 235 and I will not go. Don't worry into details. You can just Google on On the internet and find a lot of information or if you like you can just read some of my papers And the install capacity Around 8,000 centrifuges and operating capacity Roughly speaking 5,000 centrifuges and so far Iran produced approximately 2500 kilograms of low 3.5 percent and which low and which random and Actually 1200 kilograms of which was subject to the swap deal just last May and as I mentioned previously And then I will talk more in detail so the concern of the West is that in Natanz which was not declared but now that we know There is such and such capability and out of the install centrifuges They operate approximately on the average some 5000 of them 6,000 sometimes 4,000 some other time and so far they have produced 2,600 kilograms of low-energy uranium which can be used only in power reactors such as the one in bush air but Why do they produce this much? Because the fuel of the bush air reactor will be given by the Russians given by the Russians already and Russia has committed itself to give the fuel of Bush air reactor in the coming years But Iran say what if they don't so we must be on the safe side so we must say we now feel okay fine but the concern is if Iran takes 1200 kilograms of this 3.5 percent low-energy uranium and takes this because it is not under the IS safeguards Then takes this to another facility the one in kum Had it not been unearthed I mean had it not been sort of declared to the world and In much smaller time this 1200 kilograms of low-energy uranium could be diverted to something like 25 kilograms of high-energy uranium of 90 plus percent Which could be a Capacity to one weapon So Concerns about Iran stems from this Yes, they have well Undeclared declared whatever all this Tibet is now left behind The director general of the IAE gave all this ultimatum the EU to intervene They did just sign the additional protocol not try to fight Etc. Etc. But finally there is this public knowledge everywhere in the world that they have this capacity and they have That general produce low-energy uranium at the face value this low-energy uranium cannot do anything well, it could be Threatening only if it falls into the hands of terrorist organizations and terrorist organizations if even you know 3.5 percent or 5 percent lower-energy uranium if you explode with high explosives Of course, it will irradiate It will disseminate irradiation and we may kill people not because of the nuclear explosion not at all there will be no such nuclear chain reaction with this much energy ranium, but The the the particles that will be spread into the air into the atmosphere will Sort of emit radiation and which will make people ill cancer over over a period of time So terrorist organizations in order to cause panic might be after even low-energy uranium just to explode with high explosives And cause fear to achieve their purpose and other than that 3.5 and which random doesn't do anything militarily Of course provided that it stays 3.5 percent and the concern is because the IAE a cannot go to Iran and inspect everywhere and Cannot make sure about whether there is or there is not any hidden secret clandestine facility Then the intonation community cannot be satisfied that whichever Produce as low-energy ranyum will remain as low-energy ranyum, but if there is another undeclared comb like Enrichment facility and if Iran takes this To this undeclared facility, then they may produce low-energy ranyum out of this this much enough for one weapon these are the issues that are being discussed in the international arena and Scientists are the ones who make these comments. I mean, I'm not a Physicist nuclear engineer, so I may not be making a very different of the comments But as an industrial engineer, I can understand some of the background discussion here, and I can sort of Assess very what is being discussed by the intonation community makes sense. Yes, it does make sense Of course, we cannot we're not in a position to blame Iran for doing anything like that and Iran is not found yet or As of now as doing anything wrong like this But the point here is not that Iran is not found guilty, but the point here is that This situation that Iran is not being given a clean bill of health Because the IA says I cannot say that they produce weapons But I cannot say the opposite either that they do not produce weapons because I do not carry out enough Inspections and because and I would like they say Iran the IA says we would like Iran to have ratified the Edition protocol for us to carry out inspections everywhere to take samples from air from water Actually, one of the major issues that the IA is complaining and you can go to the IA's website the org and Somewhere on the right hand side, you will see Iran and If you click on it, you will see every single IAA reports resolutions issued by the IAA over the last several years which in a sense Continues to assess the situation and one of the major concerns of the IA authority is Not only the secret facilities that may exist they say we cannot of Sort of a certain that there are no other secret We're not sure if there is any any other secret Facility, but another thing is they want to talk with the Iranian scientists There are a number of scientists that Iranians That the IAEA would like to talk about Iran's nuclear activities and the Iranian authorities in the past Allow some of them during this EU 3 and Hatemi sort of government But since Ahmadinejad came to power all this just are done out of the window and there is no Close cooperation between the IAEA at least We understand from IAEA's complaints that they are not getting enough cooperation. They say yes, thank you for this Thank you for that but these are not enough and We need more in order to assert and to make sure that Iran is not doing anything wrong and we're not yet at this point So this is the point. This is the issue which makes the situation all the more difficult, of course There are not many options for you for the United States Yes, they are concerned about Iran being a threat for themselves for their allies for Israel for world security For whatever reason, but what can they do? As you can see here and this In this paragraph here Iran is not Iraq. I mean Iran is a much bigger country geographically Population-wise, meter-wise much more powerful and much more coherent because during the Iran and prior to Iran Iraq sorry Iraq war Or the war between the United States or US invasion of Iraq Iraq was of course Divided de facto into three no fly zones in the north and south and in the middle Saddam Hussein was exerting its power to a certain extent under the sanctions and Prior to war, of course the coalition forces the United States in particular Collaborated with the north the Kurds in the north and the Shi'a in the south so they in a sense Promise them that they would be you know democratized after Saddam toppled et cetera Et cetera, but Iran especially when it comes to the nuclear question Nectar issue is a very coherent country. I mean even those in the opposition mean those who may have complaints about Ahmadinejad or other sort of people who are governed in the country When it comes to the nuclear issue they want nuclear program to continue and they don't want the the current administration to step down or just a step back or Sort of given to the pressures of the United States and the West so it is there for something which is Quite difficult so we'll continue with the EU on Tuesday next week There will be no class on Friday. I will be attending a conference. So on Tuesday next week We'll continue with this issue and please Have a look at this PowerPoint and also some of the articles that I've written and also just you know There are many websites for instance. I merely just mentioned one from console on foreign relations console on foreign relations You know this journal for affairs. It's one of the leading journals in the International arena in the international relations discipline and it's published by the console on foreign relations And if I'm not mistaken the Wutol has just been awarded something yesterday The one of the hundred intellectuals. So it is by the console for relations CFR.org CFR.org and Amelia just maybe you can ask her Emily you can just send the link to those who and get Amelia's email if you like and just make your own research Because you don't have to be satisfied with everything discussed here only in three hours a week You have your readings. You have my website other websites for instance go to the website of ISIS and The ISIS website there are satellite pictures taken from space About you know some Iranian nuclear facilities and there are a lot of discussion on the technical Dimensions of the issue. So anyway, I'll do your own research And by the way, remember that the op-eds are due on December 17th and that simulation due is due on 21st December and These are all serious assignments that will make up 25% each of your overall grade and considering your grades coming from midterm you should be studying hard and Make your decision before the final date of withdrawals All right. I'll see you on Tuesday next week. Hopefully


Thanks for coming and uh please join me in welcoming Douglas McKee and Mark Borreza. Thank you and welcome. We're really excited to be here. We're glad you could come see our talk today. We're going to be talking about a zero day uh that we discovered. We're going to walk through our vulnerability research process, our exploitation process and post exploitation and hopefully have some really cool demos for you uh at the end.  Uh my name is Doug McKee. I'm a security researcher for McAfee's Advanced Threat Research Team. I've got a little over eight years of experience in volume research and pen testing. And I'm Mark Borreza. I have a little over eight months of experience in vulnerability research and pen testing. That's great. So first off most importantly what are we here to talk about today? We're going to talk about an ICS system produced by a company called Delta Controls. They refer to it as their IntelliBus Manager. And what this is is it's called a building controller. It's used to manage systems in a commercial building, things like HVAC, lighting, pressure rooms, etc. And important thing to note is that this device uses a networking protocol called BACnet. That's largely how it manages these devices. BACnet stands for Building Automation Control Network. And I also want to highlight that this is not specific to Delta systems. This is an industry wide use protocol. It also has a slight, a little bit of router capability built into it, which I'll touch on here a little bit later. And before I go any further, I often get the question, how do you pick your targets or why did you pick this target? Generally at HCR we try to pick targets that can have a very high impact as if they were compromised. Obviously there's a lot of critical systems that fall into that. And this happened to be one that we were able to obtain. And also something of interest is the fact that it uses the BACnet protocol, therefore it's network accessible. So let me take a moment to explain to you how this works in the real world before we jump into hacking this device. So what you see in front of you is we have a wiring diagram of one of these devices potentially for an HVAC system. So you have the Delta controller, which talks over a CAN bus to something called modules. At the highest level, these modules take inputs and uses it to control outputs. So that each device is programmed differently from the installer. And depending on the state of those inputs, it changes those outputs.  And this is just one example. It's used across industries for multiple things, which we'll get back to here momentarily. So understanding this, how do we start looking for bugs or where do we start looking for volume research? Well as I said, one of the most important things for us from attack vector is we like the fact that it's network accessible.  So now we know what direction we want to attack it from. We're going to do a network attack on this, hopefully. Well, what else do we need? It'd be really useful to have the software. Well, lucky for us, the developers left UART headers on the board, which was completely unauthenticated root access to the system. This made it simple for us to pull off the firmware. So if we look at that firmware for a moment, a couple important things to note is one, there was no ASLR and NX wasn't able. And also, it was quickly able to see that symbols were left into the program. This will become extremely useful and I will reference this multiple times throughout this presentation. So we want to use a network attack vector. So what does that mean? Well, we're going to start with fuzzing, like everybody else. So we decided to use a commercial fuzzer called Defensix. This fuzzer has a built in module for a backnet server. We weren't quite using a backnet server, but because of the router protocol, the routerness of the device, it had a lot of similar attributes. And one of that is the backnet protocol uses broadcast traffic pretty frequently. So we use this fuzzer as a starting point and started to fuzz the device. This is one of those packets that you see on the screen that the fuzzer chose to use as a test case. Couple things I'll highlight real quickly. Besides the fact that it's a broadcast packet, the fuzzer here is sending about 8,000 bytes in what's called the BLVC layer or the backnet layer of the packet. You can even see that Wireshark is telling you that this layer is really only supposed to be a maximum of 1476 bytes. I think it's pretty easy to see here that the fuzzer is trying to look for a buffer overflow attack. So we fire up Defensix, we run this test case, and after a few minutes we see this on the UART screen. Quite simply, what you see is that it's a core dumping and the system is rebooting. Now I'm a little bit of a pessimist when it comes to vulnerability research, so I never actually believe I found something the first time. And so I run the Defensix at least two or three more times. And for your amusement, I took a picture of Mark's face once we were running the fuzzer because this is pretty much what it looked like. And he got excited because we had a reproducible crash. Ironically though, I went back to that packet that I showed you on the previous screen and I sent just that packet to the device. Interestingly enough, the device did not crash. Well, I sent that packet twice and the device still did not crash. Through a lot of trial and error, I actually discovered that it took 97 packets to crash this device. And I'll touch on this here momentarily. But after discovering it took 97 packets, I was able to do it repeatedly. So that meant it was time to investigate further. Well, as you saw the system produce a core dump. So let's take a look at that core dump as a first place to start to try to figure out where to move on. Obviously we have a segfault here that makes a lot of sense, the device crashed. But what can we learn about that looking at the registers? Well, let's start with the R0 register. For those of you that haven't fallen asleep yet, you might notice some similarity in what's in the R0 register to the packet at which Defensix decided to send to the system. There's a lot of 22s or ASCII quotation marks. That's interesting. We know that that's network data. If we keep thinking about network data and we look forward at R3 and R8, R3 has the value 81 in it. For those of you that were smart enough not to read the backnet RFC, you wouldn't know that 81 is the first byte set in all backnet packets. This indicates the BLVC layer. Again, this indicates that there's some networking data in the system. And if we take a look at R8 and we account for the Indians inside the computer, we know that this is 47808 or the source or destination port. So once again, we have some clues that we have networking data where the crash is occurring. Obviously the next and most important question is where in the system is it crashing? And we can look at the backtrace in the LR register to give us hints on that. So let's just do that. Let's go to the exact addresses in memory where the crash is occurring. Well, lucky for us, we find ourself inside memcopy. And not only do we find ourself inside of memcopy, but the exact line of code which it's crashed on, it is trying to take the data in R3 and store it at the address located in R0. Well, this fully explains why the system crashed. R0 has an invalid address in it that came from our payload and it's attempting to store the first byte of the networking payload into that address. So this is obviously extremely interesting. But I don't know for you, the last time I opened up any commercial Linux application, memcopy was called more than once. So this is not enough. Sometimes memcopy is called hundreds of times. So what is the exact code path that triggered this crash? We can use the LR register to help us figure that out. In ARM, the LR register points to the instruction that's going to be executed after a function call. So to actually know what function was called, we need to look one instruction before the address being pointed to you by the LR register. But in doing so, we can see a function called SC net moved. Thank you again for leaving the symbols in. It was extremely useful. If we dig into a SC net move function, it's actually just a wrapper for memcopy.  And if we continue down this path, and we use the I2D compilers and a little bit of intuition, we can actually very easily statically analyze this bug and figure out why it's there. So I've renamed some variables here to help this be a little simpler to see. But what we have is we have a buffer, which I've named source. And that buffer is being used to read data off the wire through a socket function. That buffer is hard coded to be 1732 bytes, both in size and what it is to read off the network. And then after it's reading that off the network, it stores that in a variable and I've renamed that size. So I want to point out for a second that this in itself, there is no development flaw here. It's statically defined. It's ensuring that it doesn't read more than 1732 bytes. This is perfectly fine code. However, if we continue to look at this code, we'll see a second buffer, which I've named destination, which is allocated using the Linux packet alloc function to 1476 bytes. Again, if you didn't fall asleep in the beginning of the presentation, that number might mean something to you. That is the number that is the acceptable amount of bytes, which is expected in a back net packet. However, it doesn't match the 1732 from the other buffer. Those experience with vulnerability research and exploitation probably see where I'm going with this. There's a further call down the line where that sd net move function is called, and it uses both those buffers, but it hasn't validated that it's the same size. And hence we have a buffer overflow. But now I'll step back and remind you that I said just sending that large packet did not crash the device. In fact, sending two of the large packets in crash device, it took 97. So what's that all about? Well, the interesting thing is the large packet triggers a buffer overflow. It overflows a section of memory or an address is being stored for a future mem copy. So what we've overwritten is that address, hence why it was stored in our, our zero in the beginning. So in order to exercise this vulnerability, it took 97 more packets before it tried to access that address. And what, so what we have is we have the initial packet, which overwrites a section of memory because of the buffer overflow, and 97 packets later, it takes that data and tries to write it to that address. And we have a typical write what wear condition. This is really promising for us as vulnerability researchers, because this means that exploitation is highly likely. Well, now that we've analyzed this statically, and we think that we have something worth going forward on, we'd really like the ability to dynamic dynamically debug the system. Anyone that has done this type of work before, static analysis is great, but dynamic analysis really makes it a lot simpler. So as expected, we compile a GDB server for the correct architecture of our device, plopped it on there, and started to debug, except for we instantly had a crash. And as you can see, this has been heavily redacted at the request of the vendor. But what you have going on here is there is a, a watchdog error which occurs because we've triggered a watchdog timer and the system reboots. For those not familiar, in ICS systems, watchdog timers are extremely common. They're used so that if the system stalls in any way, because these are critical systems, it takes some action in order to ensure that the system doesn't stay down, and this instance, the system reboots. However, it's a bit of a problem if you're trying to dynamically debug the system. Well, because the error messages were left in, and because symbols were left in, it was actually very easy to track down this line of code. As you can see here, there are, I think it's about three, three counters, which are being decremented by five. So when the counters hit zero, it triggers the watchdog timer and it trips in the device reboots. Well, this is not a hard problem for us to fix as reverse engineers. We will just simply binary patch this, this binary. So we, we take the five, we change it to zero, and now as far as the system is concerned, it, it still executes that line of code and decrements the value, but it decrements it by zero. As you can see on the right-hand side of the screen, even Ida now removes that line. It's not that it's not there, it's just ineffective. So thinking that we're, you know, pretty smart, we reload this back home, the system, and we start debugging. And of course, it starts to work until exactly three minutes later. And three minutes later, the system reboots itself again. Now, at this point, Mark's pretty agitated because he thought he already fixed the problem. So now we're, we're looking and trying to figure out why the heck did the system reboot? Well, unfortunately, we forgot that in ICS systems, there's generally a hardware watchdog timer as well. And this hardware watchdog timer was set in boot, as you can see on the UART screen here, to 180 seconds or three minutes. So, how do we get past this? Well, if there's a hardware watchdog timer, that means the software on the system has to kick that watchdog timer. Well, in this instance, the developers for all of their functions exported the, the functions of the SO files, which means that all we had to do was use their code to kick the watchdog. So we wrote a small C program. We put, compiled the program for the device to execute those functions and then set it to run on boot up. And so when the system boot up, it called our watchdog kicker and it always kicked the dog. A combination of this hardware watchdog fix in the binary patch. And we were able to effectively remove the watchdog as a requirement for debugging. And we were on our way. Now, that was a short tangent, but I thought it was worthwhile. So let's get back to the job at hand. We want to write an exploit for the system. So, where are we at? Well, we have a broadcast packet with a payload of 1732 bytes. By sending that packet, we can trigger a buffer overflow. That buffer overflow by itself does not crash the system. In fact, it takes another 97 packets to cause the crash. But when we cause the crash, it manifests itself into a right-what-where condition. We know from our initial analysis that there is no ASLR enabled on the system, but we do know that NX or DEP is enabled. So, the next step is we want execution control. And if we have a right-what-where condition, this question simply becomes, what do we want to write where? Well, considering that NX is enabled, we want to find a location in memory that is writable that would allow us to gain some control of execution. Lucky for us, there's something called the global offset table. This is native to Linux. And it's a table created at runtime. Therefore, it is usually writable. And simply speaking, it has a list of function names and addresses. When a function is called, it looks up the address for that function, and then it jumps to that section of memory. Well, since we have a right-what-where and we can write anywhere we want, hypothetically speaking, we could take something like malloc, change the address of malloc, and then when malloc was called, we would be able to jump to our section of code. This would gain us control of execution. But we also need to know what function do we want to overwrite. Now we know where we want to overwrite, but what do we want to overwrite. This is a multi-threaded application, and so we really want to make sure that we gain execution control as soon as possible after the vulnerability is triggered. If we go back to where we saw the vulnerability exist in the SCNetMove function, we can see approximately 20 to 30-inch assembly instructions later. We end up with a function called SCD code backnet UDP. This becomes the ideal place for us to gain control of execution as fast as possible from when the vulnerability is triggered. With all that background, the next simple thing to do was to write our own code to gain to execute. And for that, I'm going to turn this over to Mark. Thanks Doug. Alright, well before we could finish ponying this device, it's important that we step back and look at the resources we already had available. So to begin, if you're paying attention and haven't fallen asleep, you know that we have execution control in the system using the GOT override that Doug mentioned previously. Additionally, the developers were kind enough to leave Netcat installed on the device. This is your granddaddy's kind with the dash E flag, so you knew this was going to be good. Lastly, we still control some memory on the heap from our initial buffer overflow, although a lot of it does get clobbered by the time we gain execution control. Okay, so that's all well and good. The next question we have to ask ourselves is, what do we want? A simple question, but as Mr. Gosling can attest to, sometimes you just got to ask. Well, we decided to start pretty simple. We wanted root access obviously, but ideally we also wanted persistence on the device across reboots. So the last questions we have to ask ourselves were, how do we get this? But more importantly, how do we get it easily? You'll soon see that we still had a very long road ahead of us, so we wanted something quick. Well, by looking back at what we already had available to us, a straightforward way to get root access was to use the Netcat already installed on the device to obtain a root shell or a reverse shell. We could accomplish this hypothetically by putting some shell code into that heat memory we control, and this shell code would essentially store a Netcat command for the reverse shell into R0 register, and then branch to the address of the system function in the libc. The system function, as you may or may not know, executes the command stored in its first and only parameter, in this case a Netcat reverse shell command stored in R0. This ultimately comes together to create what is commonly referred to as a return to libc style attack, and although this would not grant us persistence on its own, ultimately we could use our reverse shell in order to alter some of the startup scripts and that would that would grant us persistence on the device. So that's all well and good, but if we actually take a look at the heat memory we control, we'll see that it's actually not so easy. So the the memory we still have in that we control on the heap is the 22 bytes you see in front of you, and particularly we have the longest continuous chunk that we control is only 32 bytes long, highlighted there in red. Now why is this a problem? Well, the reason being is that somehow in this 32 byte section we had to fit all of our shell code instructions and the command string for Netcat, which on its own is 24 bytes. Using some very complex arithmetic, this leaves us with a grand total of two ARM instructions, which is simply not enough to do what we want. Now I know some smartasses out there probably thinking to themselves, just use thumb mode, you dingus, those instructions are half the length. But although this is a great idea, through trial and error we discover that thumb mode is actually not enabled on the processor on the device. So that's out. I'm gonna be, I'm gonna level for you guys here. At this point we were stuck. I couldn't sleep, I couldn't eat, I even considered switching over to an IOT webcam. Things were looking very, very dark, but suddenly I was struck with some motivation. I thought to myself, and if I could live off of chili chow, cup of noodles, register trademark for four years, then this should be child's play. And then I got thinking some more. Child's play, children playing, children play hopscotch, memory hopscotch. That was the key.  Well, when we started digging in further, we found that we don't have to just use the 32 continuous bytes. We could use any section of memory we control, as long as it's at least eight bytes long. This grants us one shell instruction and a jump to the next region of memory we control, or hop if you will. So if we look back at the heap memory we control, you'll see two such regions that qualify. This effectively doubles the number of shellcode instructions we have from two to four, which is a great news. But we weren't out of the woods just quite yet. Unfortunately arm is actually very cheap with its immediate values to be, to, as an understatement, in fact it limits them to only a single byte each with optional zero padding left or right. This meant that if we wanted to load the address of system into a register, it would take all four of our instructions and that wasn't going to fly. Well thankfully we were able to use the address already located at R4 because it was pretty close to the address of system, so with a simple offset we could get there. In the end this resulted in shellcode that met our tight space memory space requirements and granted us a reverse shell. But instead of explaining in detail how cool this all is, how about I just show you instead. So here we have a demo video of the reverse shell in action. On the right half of the screen, I hope you can read it, is the UR interface of the device. Now the first thing we're going to do is we're going to run ifconfig to find out that it's IP address. So you can see there ends in 7.14. Next we're going to print out the first few lines of the program, the device's startup script. This is just to prove that we are in fact in the delta device and you can see the copyright message there. Next we're going to show that there's no instances of Netcat already running on the device, as you can see, we'll refer to this later. Moving over to the attack machine on the left, we start up a Netcat lesson there on port nine, this will capture our reverse shell. And on the same attack machine we launch our exploit script, which leverages the vulnerability and launches the Netcat command you see there. So once it's finished executing, we move back to the UR interface and show that there is in fact an instance of Netcat now running that wasn't before. And it has the same command string, so far so good. Okay, moving back to the Netcat lessoner, which should have connected, we run ifconfig again and the IP address match. Imagine that. And just to confirm, we do in fact have root access. Okay, that's great. Mission accomplished, right? We've got root access to the system, everything's good, raw. Like a tenured physics professor, we don't know when to quit. I mean after all, we wanted IO control on the device. We're more interested in the HVAC systems, the access control, the pressure rooms that are being managed by this device. And root access does not grant us that on its own. We need to keep digging. Our next strategy was to look at how the device natively handles controlling the IO hardware and maybe get some of that code to work for us instead. So the first approach we tried is to look at the database files located on the device's file system. Now something that immediately jumped out at us here is that I had no idea what the hell I was looking at. This was too complicated. Well, the next thing we tried is to look at what happens in terms of a packet sent when we try to change the IO state from the touch screen. And maybe we could replace some of those packets. Now those of you paying very close attention might notice that the structure of the packet is actually very similar to the database and that I still have no idea what the hell I'm looking at. This was still too complicated. While the last thing we tried is hooking to the IO control functions natively. And this turned out to be just right. Now as Doug mentioned before, symbols being left and proved invaluable here because functions of names like CANIL right output immediately jumped out at us because we knew that the IO modules were controlled through the CAN bus. Third of more, through reverse engineering of these IO control functions, we discovered that there was different ones dedicated to controlling each category of IO hardware and there were six such categories. You got your inputs, you got your outputs and you got variables and these can all be either analog or binary. Now our first initial naive approach was to try and execute these functions from external C code like we did with the watchdog kicking code. But unfortunately the handles to these hardware devices were trapped inside the program space allocated for the Delta's existing programming and they simply couldn't be accessed from an external code. Somehow we had to figure out how to insert our malicious code whatever ended up being inside the program space of the existing programming. While the solution ended up being something called LD preload and for those that don't know, LD preload is a Linux environment variable and its job is that any shared objects this variable points to are loaded first by the dynamic linker when a binary is executed. Now this is not a new or novel idea, this is actually a pretty common approach for inserting code into an existing programming's memory space which is exactly what we wanted to do. So in our case we used our persistence on the device to alter one of the startup scripts, have this variable point to our malware and then get it inside the existing programming. Now that's all well and good but how does this work mechanically? Well let's begin by looking at the normal operation of the device. So in normal operation the first thing that occurs is that the delta programming will execute pretty straightforward. Once the dynamic linker starts doing its job it loads the shared objects in the following order. First the dactetra binary which is the entry point. Then all the delta proprietary shared objects and finally all the other miscellaneous libraries like libc. Now once the programming is actually running you have an IO polling thread that consistently runs in the background and this is what calls those IO control functions I mentioned earlier. So in this case we're going to look an example where it calls the function can IO write output in order to flip a relay. Okay. Now how does our use of LD preload change all this? Well as before the delta programming will execute but now the dynamic linker loads our malicious binaries first before any of the other shared objects. This becomes important when that background thread is running because now it loads the uh it calls the function with the same signature in our malicious binary instead of the real one because those symbols are loaded first. Better yet through the use of a C function called DL sim we're actually able to get a handle to the real function at run time which means we can sort of do a catch and release approach where we intercept the calls to these IO control functions, mess with them however we want and pass it back to the real deal with the program being none the wiser. Okay. So this is all well and good. We had malware. We knew how to insert it but the question is where the hell do we put it? Well here are our options. Now this diagram is a very high level overview of the startup routine for the delta programming and through some reversing we discovered that our best approach would be to use the function highlighted in yellow, can IO init. The reason why is because as Doug mentioned or maybe not mentioned I don't remember is uh that this programming is all vastly multi-threaded. So in order to avoid race conditions or inconsistencies we wanted a function that was called early boot called by single thread and only called once and this function met all those criteria. Now what is it look like once the malware is inserted here? Well this is what it looks like. When this function is called our malware spins up a thread that runs in the background and it listens for attack or for it listens for commands set by the attacker over the network. Based on the content of these commands the malware intercepts the corresponding IO control function in order to control the device the attacker wants to uh influence. Now I've sort of been doing a lot of hand waving about how we actually alter these parameters in order to get it to do its job so why don't I dig into that a little bit? Now although there's a whole array of IO control functions they did share one key commonality that we were able to take advantage of and that's the fact that the first parameter passed to them is a data structure that essentially just describes the hardware being managed or being controlled. So in this case you see an output of it here through GDB and highlighted in red is the device's ID the first four bytes and this is unique to each device. At a 12 by offset highlighted in blue is the current state of the device which is actually the most useful. In this case we have 75 degrees Fahrenheit as a floating point value and then at an arbitrary offset you could also find a descriptive string of the device which is also extremely useful because this is how we know this device in particular is responsible for monitoring room temperature. Using this information is actually pretty straightforward to just alter the state stored in these data structures pass it along and then we have control of IO. Okay so now mission accomplished right? We control the IO we got root access well the answer is still no. The reason being is that our motto here at ATR unofficially is to overdo everything and in that spirit we decided to pimp out our malware of all kinds of premium features. First of which you get automatic discovery of all the IO devices. Sit back and relax as the malware does all the recon for you. Next you actually get remote control of the malware through an interactive TCP session. My therapist told me that the most important key to a healthy relationship is now am I saying this malware will fix your marriage? Yes that's exactly what I'm saying. Next you can see the state of all the hardware in real time. So you can see exactly how much damage you're causing. Who said happiness couldn't be quantified? And last but certainly not least with a single command you can revert the device to its original unhacked state wiping it off any traces that the malware was ever there. And if you call the next 30 minutes you can get all this and more for just 30,000 easy payments of 1995 taxes and shipping not included. And if you're still not convinced be sure to check us both out at ICS village where you can see this bad boy in action. Now we were getting pretty happy for malware. Our baby was looking pretty good but we're still missing one key premium feature and that's a remote attack vector. Now this looked pretty grim at first because after all we're using broadcast traffic and that typically doesn't travel over the internet. But thankfully a certain backnet technology came to save the day. And that is BBMD or backnet IP broadcast management device. A real tongue twister but suffice it to say it allows for the transmission of backnet broadcast traffic exactly the kind we're using. Imagine that over the internet between different networks. So on the diagram on the right you can see two such backnet networks each having a BBMD. The way this works is that broadcast traffic intended for a foreign network is first sent to the source networks BBMD. This sends it to the destination networks BBMD and its job is to rebroadcast it on the destination network. That's a bit of an aside but how does this help us? Well through testing we found out that using this technology allows for our exploit to work entirely remotely. Now let me repeat that. At the time the slide was created any eBMGR connected to the internet of its default network settings could be pwned 100% remotely using this exploit. This is all pretty scary stuff but what's the actual impact? What can someone do with this? Well for that I'm going to hand it back to Doug. Thanks. So as Mark said we confirmed that this would work 100% over the internet. Now I know everyone in the room will agree with me that no one would ever connect these systems to the internet that would be completely unreasonable. Oh that's right. Shodan tells us a little bit differently. At the time that we created this slide there was approximately 500 of these exact devices running firmware that was vulnerable to this connected worldwide. Because of the nature of this vulnerability and where it's found in the code if we extrapolate out that other delta devices likely have the same vulnerability this number balloons up to 1600 to 1700 devices. Give or take about 10% for known honeypots. So as Mark said in the spirit of overdoing things we actually decided to build a fully functional HVAC unit controlled by a delta system in order to demonstrate the effectiveness of this type of attack. So if you'll watch on the video as we move to the back of this demo unit you'll see all the components you would see in a real working HVAC system. You'll have valves, pumps, fans, etc. And this was actually created by a contract company that actually puts these systems into current data centers. So this is as accurate as we could possibly make it. The only thing that's not 100% accurate is we use cold water instead of a compressor because my boss would not pay $8,000 for a compressor. On this side we have an enclosed data, miniature enclosed data center again with all the normal HVAC components a raised floor and a server which generates heat. For a moment I want to draw your attention to something that was just on the screen the independent temperature sensor. The reason this is important is it's the only component that you would not find in real life and it's there to, we always know the true temperature in the data center regardless of what the delta says. Then on top of the system we've added some lights that just show the state of different devices and to indicate an alarm is active. Once again the boss got annoyed at having a siren so we forced us to turn it into a light. So, but this alarm would simply indicate whether an alarm has been triggered. This could be in the form of an audible siren, a light or even email notifications. This just indicates whether an alarm has been sent or not. So if this is the system, an HVAC system that is cooling a data center, what would happen if we applied the research we did to this system? Let's take a look. Here on the left hand side of the screen you can see attacker running the exploit script and the top right is a picture and picture of the delta controller. The attacker leverages the vulnerability to download the premium malware which Mark was talking about and a few other extra pictures and the device reboots in order to implement the LD preload strategy which Mark discussed. Now when the device comes back up we've been a little creative with the images to show that the device has been hacked and we will also log into the system. I want to emphasize that logging into the system is not part of the attack. We are simply demonstrating what the screen would look like and to follow along. It is not needed for that trigger anything of the attack. So something the attacker might want to do is control outputs on the device. This is as I said, the device's function is to turn outputs on and off. So what would it look like if the attacker started to modify these outputs using the premium malware? You can see in the bottom right hand corner that the device will react accordingly. In the top right hand corner the delta screen you might take notice that it is not updating. This is because the attacker has the ability to choose to change or not change the screen. If they want the user to know that something is changing they can change it. If they don't it won't providing them this attacker with a lot of different attack scenarios. Now on these type of devices there are multiple types of outputs. There are analog and binary outputs. What you just saw was binary outputs. We either turn it on or off. Analog outputs require a specific value, a floating point value like Mark was mentioning of room temperature earlier. So here what we're going to see the attacker do is modify one of these values and this time the attacker is going to choose to modify the delta screen as well. Just proving that we can do it either way. So we have the fan speed and we have the valve and you'll notice once again that the components on the actual demo rig react as you would expect. So and also as a premium feature we've built in a reset command which sets everything back to its initial state. Now with the attacker still having persistence on the box. So controlling output is kind of fun. We can think of some scenarios that we may be able to influence by controlling each individual output. But if you remember from the beginning of my presentation the devices are designed to take data as input and react. So what if the attacker was to modify the data the system was ingesting or the inputs. As you can see here the attacker is going to change what the system is reading for temperature to third from the real temperature to 30 and 40 degrees respectively. Now what happens in your house if the HVAC system thinks it's 30 degrees in the room? Well it's not going to kick on it's going to turn off right and you can monitor our independent temperature system on the bottom right hand corner of the screen and the temperature in the data center is starting to rise. And there's no alarms being triggered because the system thinks it's 30 degrees. Why would it trigger an alarm? There's nothing going nothing that's going on wrong. So this is just one small scenario of one purpose of these devices in HVAC system in a data center of the impact we might have. I don't know if anyone here manages a data center but what would happen if your data center went unattended with no HVAC for a long period of time? I cannot imagine that it would be a positive effect on the system. So let's look at some of the other scenarios that are possible with control of an industrial control system like this. One of the interesting things about systems like this is they are using a very wide variety of industries because they're using commercial buildings. You're not going to find one at home but you will find them in the different industries listed here. I'm going to take a moment to talk about just a couple. I'm going to look at healthcare, government and education. Excuse me. Healthcare is an interesting new case because that's usually used for something called pressure rooms. For those that don't understand what that means in a hospital setting there's different rooms are kept at different pressure points in order to prevent disease from spreading and it's not much.  And if attacker was to get into one of these systems which is this is what it's used for and to just set all the pressures to the same value and chose not to update the screen and not to allow any alarms to send nobody would notice it's not something you're going to feel going in a room that the pressure was different. All of a sudden those diseases that were contained by one of these systems could easily spread throughout the hospital. Might sound slightly dramatic but it's definitely possible in this scenario. If we move on to a different situation and think about government through OSINT we were actually able to pull up documents openly available on the internet to see that these systems are used for access control in some state government buildings. I don't think I have to explain too in depth what the impact would be if an attacker was able to open and close doors as they chose in certain pretty sensitive areas of buildings. And lastly I want to talk about education just because I think it's fun when people ask me questions why would I care if you change the egg vacuum in my kid's room? Well, you probably don't care but one of the other avenues of attack on these systems is they're an entry point into the network. If I have a hundred percent control of one of these devices and it's not isolated which again is nothing we ever see in the real world but if they're not isolated from other networks this now becomes the point that we can leverage in order to get onto other systems. I don't know maybe stream cameras from different rooms out to the attacker's terminal screen or other things like that. All of a sudden you start to become slightly more concerned. So this is an example of some uses in the industry and because of this and because that it's a true RCE over the internet it was assigned to CVSS store of 9.8. Per McAfee's responsible disclosure policy once we understood what we have we reached out to the vendor. This was in late 2018. We assigned the CVE number and we started working very closely with the vendor. The vendor was extremely responsive and ends of June of 2019 they ever released a patch which fully mitigates this vulnerability. ATR has also tested the patch and can confirm that it is in fact effective. I'd like to take just a moment to highlight this because I think sometimes there's a problem in our industry with security researchers and vendors. Delta was extremely cooperative was wonderful to work with and we were actually able to come up with a solution to help fix this problem. And I think this really needs to become the gold standard in the industry for security research. We need to do this type of research to find these type of bugs and the vendors need to be receptive just like Delta was in order for us to be able to fix these problems before the before malicious attacks can be created. I hope we've demonstrated that the impact of these attacks can be pretty severe and if they're not attended to we can actually have a problem. So thank you Delta for your cooperation. So with that said that concludes the technical part of our presentation. I thank you very much all for coming. If you have any questions as long as the goons allow us to stay up here we'll answer them or please see us in the back. I believe that's where they're doing questions. So thank you.