Our next speaker is John Palachiar. He's going to be talking about modeling impacts of vegetation changes on landscape pollution. I want to thank James for the invitation to come and speak. Thank you. I'm going to be provocative in my first slide and propose that the first low-primary morphologists have often taken climate change to be synonymous with changes in runoff, destroyed precipitation, some combination of those things, i.e. the driving, shear stresses of the landscape. And I'm going to show you some examples and hopefully convince you, at least in this subset of cases, that common vegetation cover changes can lead to changes in erosion rates and topographic activities that are in order of mounting larger changes in driving shear stresses. So the resisting strength of the landscape, the anchoring effect of vegetation in particular, can be much more important than those driving stresses, which in my sense is typically emphasized. So just some examples of motivating data from the last century from real literature. This is Mark Melton, excuse me. This is Mark Melton from 1957, looking at drainage density primarily in Arizona and New Mexico. There's some variation in precipitation, you know precipitation, in these regions. But the primary impact on drainage density, as you go from relatively forest-covered environments to relatively bare environments, there's a two-order magnitude increase in drainage density. This is an example of antibiotic change from done in 1979, working in Africa. So he showed that gotta give a meaning in a runoff, antibiotic changes in vegetation cover can lead to order of magnitude changes in certain fields. So vegetation is clearly important. And some of the things I want to touch on in this talk follow upon an NSF-sponsored workshop that was held in Tucson a few years ago. And there's a publication that came from that that fed many of the people who were here in this room, who are also present then. And I thank you for your participation. I just want to highlight a couple of things about this particular thing. So the question we posed was about forecasting the response of those surfaced to future climatic and land use changes. This is a review. In particular, we spent a lot of time on what ended up being a supplement, but a very long and comprehensive supplement that goes past this zone, but past this zone, and demonstrates what we think is our current capability to make forecasts and also what the knowledge gaps are. So if you read the paper, there's actually a supplement that has a lot more detailed information. We like the interest again. And this is just some key points from the 10,000 foot view from the large scale view that we wanted to emphasize in this paper. Number one, that the response is to vegetation cover is a key knowledge gap for all the process zones. So whether you're working on hillsides or sand dunes, it's important. And it's, in some cases, the vegetation cover effect is dominant. Number two, generating reliable forecasts for future requires of models and validated, successful fine casts that are essential, obviously. And so for a future talk, I'm actually going to spend a lot of time in the distant past in this particular talk. And I hope that's okay, but it's coming from this motivation. And finally, genealogists should collaborate more with their system models. And that's sort of an obvious thing, but it requires that we move to a larger scale than we are typically used to working at, working at as a community. So I'm going to try to touch on and provide some examples of all three of these things.  I apologize in advance for that, but it's worth what I know best. So I'm not suggesting that other work is a little too good. So in terms of vegetation changes that have impacted the landscape in a major way, one example is the glacial, renegotiable transition of the Pleistocene to Holocene transition in the southwestern United States. Forests were at 800 meters above sea level, at LGM, and they're probably at 1,800 meters above sea level. So there's been a shift to one kilometer in the biomes in the southwest United States. Elevation is king. You can go from Mahali to Sonora to Chihuahua and you get slight differences in those elevations, but these are the key numbers and they impact a huge proportion of the landscape. So I took in my home state of Arizona as an example. This is the Grand Canyon. Everything below, everything that's a blue is below 800 meters above sea level, everything that's an orange is above 800 meters. So two thirds of the state or more is in this region. It's on the back and forth between forested and non-forested conditions, roughly 20,000 in the paternity. This is important as you morph it through. How do I know this? Well, we have a really nice database of elevation-specific paleo vegetation in the southwestern United States and other areas around the world. These are pack-rat buildings. They are ingesting seeds of plants within their range, which is about 100 meters from their den, and they're building up these these are deposits and ECUs there that are associated with stratigraphy. They are radio carbon datable back to 50,000 years and they're elevation-specific. So rather than a lake core or some other geologic record that's innovating over a large airshad, this is specific to this one place, and that becomes very valuable. So in terms of modeling, my model framework that I'm going to analyze a lot of examples that I want to talk about today looks something like this. I'm defining erosion as being an erosion rate as being positive with materials being removed. And so the erosion rate is equal to the divergence of a volume metric in a seven flux. This is a corubial term. This is a corubial term. So when I'm in the channels, this is channel flow, and when I'm up on the slope, this is overland the real flow. That's this component right here. So there are some typographic terms. So typically when they're doing corubial sediment transport, we have some type of non-linear diffusion model, there's a diffusivity sitting out in front, and in the transport limited case, some of the weaver that in most soil mantle landscapes, it depends on soil texture, will believe that most soil marrow landscapes are in fact transport women, which is a little bit more difficult to model computationally, but I think it's worth doing in most cases. So the divergence of the previous sediment flux looks something like this. I try to resolve the channel width in one way or another in my models. Otherwise, this is just a same power model that is specific to the unit area. And so I'm actually not going to couple a hydrologic model to an ecosystems demographic model to a geomorphic model. And I understand that that is the idea of systems that I support that kind of work. But what I'm going to show today is the examples of what I would call maybe implicit coupling. That is, rather than an explicit coupling, I'm going to make this diffusivity a function of vegetation cover, and that could be tight or a percent barrier area, it could be multiple aspects of it. And I'm going to calibrate this value to data and look at how, look at transient natural experiments to see how things vary. So, and I'm just going to emphasize it, although I'm not looking at coupled models, so I can't do all the feedbacks, I do claim that the calibration of these values locally to these particular case studies is going to be tight. It's not that hot. I'm not changing things kind of willy-nilly. I have a small number of parameters, but I know exactly what they are. So, this is a diffusivity. This is a trivial transport efficiency, if you will, for a given unit area and given for given slope, how much material is capable of moving. It's a function of grain sizes, a function of storm distributions, a function of many things, including vegetation cover on the hill slope. So, in general, what I want to propose and show examples of is that diffusivity goes up, whereas the plant cover goes up because more plants see this faster by activation. And I'm going to argue that in most cases, this is an order one. We, this is kind of the changes that I'm already talking about lead to changes of, you know, a factor of two, something like that. I think what's more important is the fact that there's an inverse relationship between the transport co-efficiency and the vegetation cover such that fewer plants, because more one after the same rainfall and even more importantly, more bare area acting as sediment sources. And this, in examples that Michelle is larger by about an order of magnitude relative to this effect. So, I'm taking the wrong approach to cultural experimental watershed where a nice natural experiment has been set up in the late Coliseum. This is, the upper half of the watershed is grassland, the lower half of the watershed below 1,430 meters above sea level is a shrubland today. We know from news, however, that this portion of the landscape was a grassland until 2,000 years ago. So, we have a case where we have a portion of the landscape that is grassland throughout the Coliseum. We have a late Coliseum transition from this to something new that has a much larger percent bare area. So, we've got a natural experiment set up where there's similar uplift in the leaf. So, the tectonic setting is similar between the active faults in cutting and creating large changes from here. But, and the precipitation is slightly lower at lower elevation, which is typically the case for these elevation gradients in the west. But it's a small difference, 10 percent lower. The sediment yield in the erosion rate is 30 times higher in the shrubland than it is in the grassland, which isn't too surprising. When we cover grass all over the landscape, it's hard to get soil off of the landscape. And you go, it can change down to a shrubland-type landscape. You're going to change drainage density. You're going to start removing soil. And in fact, we see that the AED horizon is well developed in all of this landscape is completely stripped from this landscape. So, there are soil indicators that indicate how much erosion is taking place. And we see also significant changes in drainage density and also stream tail cohabitation. So, I'm going to go into this a little bit more detail. The essence of this is the vegetation change. This is our control setting, if you will. And this is our transient experiment. Another nice thing about roller cultures is that my friends Mary and Mark and their colleagues went back in time and built a state-of-the-art homes that are actually measuring every grain of sand despite the extreme episodicity of sediment transport in this environment. They're actually trapping everything and measuring those volumetric sediment fluxes in a way that's very useful for me as a modeler. And also, grain size information. So, there's a lot of information here. And I'm just spotting the total volumetric sediment flux in this case as a function of drainage area. And so, I'm going to be calibrating a sediment transport model, wanting to do area and slope if you want. But the key thing is that because they have a range of drainage areas that have these things, and because they have them in the shrubland and in the grassland and they notice this huge change, we can look at vegetation cover and we can also look at how erosion rates there is a function of spatial scale. This is unique data in the world, at least for semi-arid environments. So, the drainage density varies a great deal. This is just a wide argument and they assess showing up particularly well here. But these are these instrumented watersheds in the Lucky Hills area. This is the Kendall area. There's less instrumentation over here because less is going on, the one thing. But if you just take that wide IDM and you extract the channel network, you can get a drainage density or if you prefer to think about it, the mean distance from the topographic divide to the first valley head. It's about 15 meters in the shrublands. That is the previous system is much more fine than dissecting the landscape compared to about 16 meters in the grasslands. That's one of the main features. So, what I've done in a recent paper here with Mark and Mary, this is Easter 2016, is I have modeled drainage density as a balance between rubial excavation of the valley head and perlubial infilling of the valley head. So, there's a competition between those two things. One can set up a mass balance equation, set up equations. And so, at valley heads, the perlubial erosion rate must exceed the collubial deposition rate, because the road crossing is positive in that place, must exceed the collubial deposition rate by and not equal to the net erosion rate of the landscape. So, there's a collubial erosion rate, there's a perlubial erosion term, there's a collubial deposition term, and one models the channel head or the valley head in detail, including the channel width. And one can predict the drainage density and drainage density variations in time following this transition from grassland to shrubland. And so, what I've got here is just a map. This is a function of distance from the divide, and I've got the magnitude of collubial erosion, collubial deposition, and I've got the total erosion rate down here. I'm not going to take you in detail to all the curves, they just want to know that one can predict with some accuracy using, I think, a model that has no free parameters at all. It's taken couple of using the available data at Walnut Gorge, one can predict this length scale of 15 meters for the shrubland and 60 to 65 meters for the grassland. So, this is a prediction of drainage density as a function of vegetation cover and time. Just another example that I want to touch on, this is if you go to high elevation of Tibetan plateau, you see actually a broadly similar landscape just on steroids. This is deeply dissected landscape. If you've ever been to the area around Lhasa or other places to the west along the Yolongsangpo Valley, all of the landscape is absolutely hammered with gullies. And so, this is what it looks like. And these gullies basically penetrate partly at the landscape, they're vertically walls. It does look like recent incisions. So, a number of years ago, I went to the fan deposits for there, the base of these gullies, did OSL dating, and we were able to bracket this decision event on between 5,000 years before president and 1,000 years before president. And this coincides with the onset of astralism in Tibet. So, and there's no known climate change or vegetation that changed at this time that would lead to this kind of event. So, we think and we propose in this paper that the increase in drainage density and the increase in stream channel concavity was a function of overgrazing due to this anthropogenic effect. And so, we produce some amount of models at the time that would show that a transient increase in K, that angular rotability coefficient, can reproduce both the long, long profile and the map view changes geomorphically. I want to come back to the southwestern west and think a little bit more about the long time scale. So, here I'm plotting up all of the backup reading data for the place to see the Holocene transition in the central Mojave Desert, which is the richest source of leading data in North America. And what I'm going to take advantage of is the fact that the forests, as they go from lower elevation and retreat to higher elevation during warmer time periods, it is a time transgressive retreat. And it's one that is fairly slow, so from about 15 or 17,000 years before president to about 9,000 years before president, the forest area was extended by 215 years when they went out much faster. Now clearly, there are multiple ways. This is juniper is abundant and this is juniper is absent, so I'm using the pinion juniper forest as my transition point between the shrubland and the forest. There are other ways to track the biome shift to higher elevations, but this is what I've chosen here is I've integrated this curve into a numerical model because what I want to do is predict, I want to test this hypothesis by predicting aggregation on fans downstream from source engines that are forced in this way. So this is a map that makes a prediction everywhere in the Mojave Desert for the timing of onset of aggregation due to place to see the Holocene transitions up so far in that location. So it's using essentially a full routing algorithm combined with the data that I just showed you to make a prediction about the onset. And there's some details about, I made some assumptions about exactly when the source region was undergoing a transition to cause the triggering. And there's some details in the paper that we have to talk more about it, but in general basically you get earlier predicted deposition when the source region upstream from you is at lower elevation and later deposition when it's higher elevation. And so this is a comparison to optically stimulated luminescence ages, that are rarely what I call the Q3A stratigraphy, that is the stratigraphy that is the primary depositional event during the Pleistocene Holocene transition. And the open circles are the mild predictions and the black ones are the LSL ages at the same site. So there's a nice general trend and there's some differences and some of the ages are just the maximum ages, not because of the stratigraphic context that they're in. But there's a pretty good trend towards later deposition onset at higher elevations. And I also want to make one more point without getting too much in the weeds in this particular example. When you look on fans, it's interesting we can actually get two terraces from one side of the pulse system. So I want to emphasize that when you look at Pleistocene Holocene transition terraces in the southwestern United States, we actually see two. There's a Q3A and a Q3B. The Q3A is the timing that I just documented. The Q3B is inset into that deposit and occurs much later. It's a near photosyn age typically deposit. And so the modeling that I've done can predict both the Q3A time and the Q3B time. So the point here is that the decrease in vegetation color, the increase in percent bare ground, triggers an increase in drainage density, the pulse of sediments. So what's happening is that the global system is expanding, all those restoring global sediment are now forced to other channels. The flux in the sediment, like fire hose, down on these fan systems, they're causing a pulse of sediment to the fans, overwhelming fan systems, causing a vulture. And when the sediment supply is increasing, that's when fan building takes place, when the sediment supply is declining, the fan heading trenches, the channel narrows like crazy. And it actually reworks a lot of sediment from the primary zone into the distal zone. So these are two terraces from a long response, okay? And so we always see the Q3B inset into the Q3A. So there's a very specific map relationship that we can use to test this model. And also we can make predictions about the timing of deposition and abandonment of the surface and this one as well, the one that's inset that represents the waning phase of the sediment pulse. So I'm now testing this in other areas around the southwestern United States. Just an unsolved problem that I'd like to throw out to some ambitious graduate student. This is a lower Colorado river, okay? It's integrating a very large watershed obviously, so they're interested in questions about what might be happening. But the statistician is pretty well known, and I just want to point out that there are three time periods in the last five million years where more than a thousand cubic kilometers of sediment has been stored along the lower Colorado River, okay? So these are huge avidation events. Why? Because, well, this is 200 meters vertically. It's 500 kilometers long. It's 30 kilometers wide. I mean, this is a huge area that's undergoing major avidation. There's no literature on this problem whatsoever. There's no interpretation. I don't think there's tech products going on. It's significant. Some people argue for the pyrogenic uplift of the Colorado Rockies potentially driving something like this. I think it's related to climate change. I have my own ideas and I've been testing these things, but I think this is a good modeling target, one that is ambitious obviously because of the scale of the problem, but it's so important. Basically, this is the Colorado River upgrading 300 meters coming back down to its modern level, re-aggrading, re-ensizing, re-aggrading again multiple times, and we're talking a huge volume of sediment here. The stratigraphy is well known. The dating is well known. There's no interpretation. So moving to shorter time scales. I want to talk to you a little bit about wildfire. And so wildfire is of course one mechanism of removing vegetation catastrophically. We're seeing big wildfires around the western United States and I've been interested through the CZO program on looking at the impressive wildfire landscapes. And one of the things we found is that when you measure all the origin rates that are wildfire affected and that are non-wildfire affected, so this is a high-severity wildfire less-conscious 2011, these are non-wildfire affected regions before the fire and because we're integrating these lines in your tidal sediments and we do other long-term erosion rate studies, you can run the numbers and you can show that wildfire is responsible for 99% of all sediment exported from these watersheds over geologic time scales. So essentially nothing is happening in the absence of wildfire in the few years following high-severity wildfire. That's where everything takes place demorphically. So this is an idea of hot moments. Things are extremely episodic. I'm not saying that this is true everywhere in the world, this is specific to the various caldera area. But in high elevation forests of watersheds where there's non-wild sediments being exported in the absence of disturbance, disturbance is critically important. A few years ago I started working at the Global School and it was actually really open. It really opened my eyes to the fact that if you work at the Global School, people care about what you're doing. Usually I write a paper and nobody reads it, nobody cites it, right? And so this was a case where I was interested in sediment fluxes and James Sylvester has worked on this for many, many years. So I produced a model that had, I think, some things that I felt were important, like slow texture and vegetation color and the river profile globally, every river in the world has a launch to a profile where sediment takes place along that profile. So this is just an example of sort of the baseline case for that anthropogenic effects. This is with anthropogenic effects included in agriculture basically. This shows a major increase in sediment yield by about a factor of 30 globally in a shift from the western United States to the eastern and midwestern United States due to that anthropogenic effect. So this is just an example but I produced this paper and started hearing from the Earth's system modeling community and got really excited about the fact that they cared about people who are asking people like me to follow just through asking questions at the global scale. So I started talking to them about Earth's system modeling and I said, no, you know, we always assume that soil, that's the bedrock, is two years everywhere in the world. And it doesn't that work? And I said, no, you know, first of all, really there's things like satellite below the soil that was used to some of them. And so basically I started a project to do something better than a two meter global average. I'm not sure that this is the best available data in the world, but it was my attempt over several years to create a map of depth to paralytic materials, so not necessarily fresh bedrock, but I make several layers in this database which is now available to James. And so this is the average soil uplands and you've got a few meters above bedrock. And then in lowlands, of course, you have large seminary pauses like the Ogallal Foundation, the lower Mississippi. So that was the integration of geologic data and models. Models were began in the Suzio program at the watershed scale. And within a few years, and within the time scale of this project, this data, these data are now used in the CLM. So this is an example of a Suzio product began, you know, in the mountains of Arizona. And over the course of a few years, the land global and CLM, the best land model in the world, was modified to accept this data. And this data is in CLM. So this is not an idea of how, you know, this is an example of how Suzio research, as one particular example, has a direct impact on the quality of the best soil system model in the world. I think I can say that because we're here in Boulder. Okay, so it's an example. And, but I think it was very exciting for me, so there's actually two papers. One is on the dataset. There's also another paper in the general climate that shows the impact on the results of CLM by doing variable depth of bedrock. So I just want to touch very briefly on the issue of the colonial transport terms. I've been focusing on the strength problem, and I've been focusing on the sediment yield in the fluvial component. So I just want to say very briefly that Leakwood Liar, from a student of mine, has been looking at cinder cones across an elevation gradient from Arizona to Oregon. And the cinder cones are nice because they're radiometrically dated, and they typically start off steep with a nice initial condition, they're like big anhyls, right? And so they're at the level of the pose, and over time they develop soils, so there's a soil component to the study, and they also evolve into a product primarily by collubial processes, okay, by dry gravel and by various landsliding processes. So what he was able to show, without going into all the details, is that looking at the development of asymmetry over time and relating that to the potential controlling factors, he was able to show that it's the vegetation density on the north-east of South Basin slope, not today, but actually at an interglacial climate that controls the aspect development of these columns. So if you're in a, if you're in a Pleistocene color like this, since we're 100,000 years old, most of its life was not spent in a Holiston climate, it was spent in a near-glacial climate because of the asymmetry of the global temperature curve. Most of the Pleistocene is not like today, it's like that out of time period, so when you look at vegetation cover as a function of elevation in Arizona, this is the current setup where there's more plants on the north-east of South, well at LGM that was actually reversed, and that's critically important for explaining the asymmetry. So we argue that the data, and it's the host of data, who's named slope aspect and also drainage density, can only be explained by increase in this diffusion coefficient with biomass. So some conclusions for you. Common vegetation cue changes can trigger order of magnitude increases in erosion rates and topographic metrics, and hill slope removal systems, and I should say that I have a version of this talk that has wind erosion, because I do wind erosion work as well, but I just focused on hill slope removal systems due to time constraints, and increase the trivial alertability curve, which usually produces the first order behavior, i.e., a transient increase in drainage density and channel convectity, with the resulting pulse, abrogation, and fans, which we can study and date. More vegetation cover can increase the Corvio 7 transport, or this seems to be a small magnitude in cases that I've studied anyway. In global scale, earth system models and dynamic vegetation models can be used to determine future hot spots of geomorphic change. Such models may require better component models and input data on geomorphology, and we, as geomorphologists, can continue to do that. Thank you very much. I'm just trying to follow up. So now you have the work on this and this, and how does that affect any accuracy? You could tell us this sort of and you deserve some of the vegetation we have. That's a good question, but also, or maybe more on that type of region, or more affecting the critical surface, are you thinking about it? Yeah, it's a good point. So I was doing the simplest part of the possible modulation of those in critical coefficients. I think in the cinder cone problem, it's sort of interesting in the only case study that I talked about that's really sensitive to the critical angle, is the cinder cone problem, the one that I talked about at the end, because they start off exactly at the angle we pose. It's a volcanic plastic deposit, it's a type of fallout, and so it is a sand pile, truly. And it does depend sensitively on the SFC value, but it takes quite a while, about 100,000 years for a forest to develop, because at the beginning, these cones are just absolutely porous. It's full abity drainage all the way through. So you need to have enough dust input to the surface to actually uniquely run off and actually support plants. And so that's just another component of the problem. I'm not just missing any concern. I'm just saying that at least over the first 100,000 years or so, there's not a lot of vegetation cover to speak of, because there's not a lot of snow development. So while they're sitting right at that sensitive slope, and they're sitting right here at SFC, and there's a lot of nonlinear colloidal sediment transport, I'm not sure that vegetation is going to control SFC, because there isn't a lot of vegetation present in the early time period it becomes. But your bladder point is going to take it. Yes. So you're interested in that? Yes. So you said forest won't take a long time to grow, but it depends on what the climate was exactly at the point, because the plants adapt, and probably we're not looking at this right, right? Because if you look at Oma yet in 2015, he actually solved this problem using child, like a landscape violation model, based on other things too, was in private where it starts about vegetation, and it's back on the soil erosion, and not facing slopes, how they differ on not slopes. You have episodic erosion, and you can look at it as a function of me, but I don't think bioturbation is the only reason for that. Maybe it's because you grow up the amount of, no, you can save more moisture on the north side, not facing slopes, so you grow forest, but at one point you see that it cannot sustain the weight, so it's just episodically question on that. Probably everyone knows this, but I'm just saying probably that's the reason why you see a bee as a function of me is fine. If you look at a long-term view, but on a shotgun view, it might show you the reverse, because there's continuous soil erosion on the south facing slope, because of radiation, there's no plants, there are no trees, let's see, so you have a career erosion. Do you have any insight? Well, yeah, you're going to come to my slope after the first shot, right? Yeah, I think you are coming, right? So yeah, no, I mean, you're so, yeah, so I mean, I think that I'm not sure I answered your question, but I would say that, yeah, I think we should talk after, you know, maybe about the specific details and the special time scale you're raising. I'm trying to, I don't know if this is one answer for all field studies, and so, you know, I think that the models that are produced are motivated by these specific field studies and patterns of data. I mean, I don't start with a model, I always start with data, what is the pattern, and then iteratively try to see, marry the two, in a way that is still, you know, a good test of the model. I'm not trying to force the modeling to the data, but it is always alluded. So if I consider a broader range of sites, and I come through a different group and crew. So as a follow-up to that, I'm curious, what you mentioned at the beginning, the value of this one data set at this section, and you're going to vegetate it, or the grassland or some sort of, what additional data could be collected that would be most impactful to help constrain the models? I think that's a good question. I mean, I think that in my answer is that I don't have a lot of good data on how the diffusivity, the diffusion coefficient, varies at one level specifically. I have tried to look at, you know, to do some study state and look at rich top curvature, which is a standard approach that comes from, you know, the UK group and whatnot. And I had a hard time finding the systematic results from that sort of thing. It could be that it's just not a study state. It could be that the landscape is also undergoing a tilt-style uplift, which is different from what we usually assume a landscape evolution model is a block-style uplift. So I think that there's a lot to be done in serious landscape evolution modeling of all my goals in particular. And I'm not going to do it all. I'm just going to be the first people to get there. And I tackle this particular drainage density problem using this vegetation change as a hook, but there's a whole lot more to do. It's a great place. And if you have data on channel width, if you're interested in channel width, I mean, they've measured to anything you want. They've probably measured it. And so it's a huge, it's a great resource that many people know. It's supposedly being written as you speak in us. Thank you.


First of all, I want to start off by inviting Spencer McIntyre up here.  Here he is right here. Spencer works for secure sake, right? Okay. And he's been doing meter research for them. He's also doing AMI assessments as well. And what they've done is they've released an optical tool, at least a framework that you can start with. We're actually going to be talking about how I did that in just a second. But we're not releasing our tool publicly. We're releasing it to vendors. We're releasing it to utilities and to security researchers that we can confirm are working in this industry. And the reason for that is ours has a little bit more stuff. No, no, sit down.  And, hang on just a second. Because we have a little bit more functionality in our tool, just built in. Spencer's broken it out a little bit. So it's his tool, Terminator, is on Google code. If you go and look it up, you can download it. You can have his code. It'll be the initial framework that you need to communicate with the meters. I'm sure he has modules that he has that are proprietary. But you can write your own. So also, with that being said, if you're a security researcher in the utility field, please contact me. Come to the Q&A afterwards. I'll get your card. We'll research it and we'll get to our code as well. So Spencer McIntyre, everybody, he's done a great job. If you haven't seen EatPeak, you should check that out as well. I use it in all of my wireless assessments. Thank you. Okay. Looking into the eye of the meter. When I first started working on meters, I went over to the carpenter ranch, Met Carpenter. He couldn't make it here today. But I really appreciate all his help because he really got me into the security field as far as AMI goes. And I had never done hardware before. So when I came over to the carpenter ranch, he said, pick up that smart meter and take it apart. But as soon as I picked it up, the first thing I noticed were two IR LEDs on the front of it, on the face of it. I'm like, what are these? And he said, well, when the field technicians have to make a modification to the meter, what they do is they first they try to contact it with the radio because they all have radios in them. But if they can't contact it, and it's some type of condition that they don't want to pull the meter off, lots of rain, really hot and they're really sweaty, lizard conditions, what they'll do is they'll use the optical port to either pull data off or reconfigure it. I was like, oh, that's cool. Can we talk to it? And he said, well, you can get the vendor software to speak with it. But all that lets you do is to program it and to read the configuration of it. Each meter that you have has specific software that you have to register with the manufacturer to get.  I just want to run stuff on it. It's like, yes, that's what we want to do. I was like, okay, who's done this before? Nobody's done this before. So ever since I started working on the meters, that's been winking at me. That's why I called it looking into the eye of the meter. Now, I'm cut away. Some of you know me as Don Weber, but I'm cut away. I came on with inguardians because I learned things very fast.  So that's what we decided to help them with. And we've been really successful. This is the talk that I was going to give at Shmucon. Okay? I was going to give it probably to about 100 people at Shmucon. Looking around here and counting the people we were at Blackcat, I've now reached out to probably over 1,000 people. So thank you very much for coming. It's awesome. It's way better than that. I would have loved to give it. But somebody contacted us. I gave this out. I gave the presentation out two weeks before I did the presentation. I gave the code out about a month before. I actually got vendors responding with code updates and with requests for modifications to the slide deck so that I was more accurate. But one company didn't feel comfortable with moving forward. Wanted to speak with us more. So that's what we did. We pulled the talk so we can talk with them. And then obviously we've made them feel better because here we are today. Now, this slide was in the first one. I've updated one bullet in this because of something that somebody asked me. And it was actually something that needed to be in there. But I'm not going to talk about specific meters. Or specific vulnerabilities in specific meters. We're not going to mention vendors because we don't really need to. Smart meters are smart meters. There's about six or seven different types out there if you just count the main ones. And you're going to find stuff. We're going to talk about stuff that is a concern with all of them. But they don't apply to each one. And therefore you have to look at each one slightly differently. It's just like any other embedded device. So we're not going to talk about those vendors. We're not going to talk about anything specific. But we're still going to get some good education. Am I? Excuse me. Advanced metering infrastructure. It's the whole solution. We'll talk about it in just a second from smart meters to the back end servers.  They're high voltage electricity devices.  All right. Who knows Travis Goodspeed here? Who's ever heard Travis Goodspeed yell? Travis has yelled at me. I started reaching for a meter. Actually that was taken out.  I'm a marine. Okay. I jumped. Travis just yelled at me. Okay. But it made a point.  I've seen Atlas get shocked. I've seen Q get shocked. I've seen Matt Carpenter get shocked. Q's arm was numb for about three hours. Okay. And it wasn't even plugged in. That was just the energy coming off the cap that you'll see in just a second. Okay. Don't do research on your own. Get permission. Yeah. All right. What we're going to talk about. We're going to talk about what the smart meters are so that people who don't understand it will understand it. Okay. Then we're going to talk about what security researchers are looking for. But I say criminals because that's exactly what we're looking for. We want to figure out what the criminals are doing. Okay. And they're going to look at it just the same way we're doing. So we're going to outline those steps and we'll be able to understand the risks associated with that. Then we're going to look at how that information can lead us, gather us information so that we can start building tools. We're going to build assessment tools. Some people are going to build attack tools. And then we're going to talk about the optical tool and if we get to it some of the mitigations. And if I don't get to it, let me say it now. The mitigations that I have in these slides are already implemented out there. That's why I feel comfortable talking about this. They're not all implemented by every solution, but just like everything else, you know, people are trying to build a good solution. They're doing their best. And it's stuff like this that's helping them understand it and get other mitigations built in. Now the purpose for this presentation is to get the word out. I want to educate people. I wanted to educate a hundred people at Schmucon, but now I've got to educate a thousand. So I'm happy. But I've also educated the vendors. You know, they've started making talking completely differently about their solutions now just from that one talk getting canceled. I wasn't scared about talking about this because we had released the AMI attack methodology back in 2009. Okay? Everything we're going to talk about here is what basically I use this as a guide to help teach me hardware, teach me meter assessments, teach me embedded device assessments. Okay? And we're going to walk through that. And we're doing it to do things like generate anomalous data so that they understand what it looks like on the back end, on those servers. So this is the basic breakdown of an AMI methodology. The stuff that's outlined in red, those are the publicly facing devices. The one on the far right is a smart meter. Now smart meters can be meshed together. They either communicate over 900 mega or, yes, 900 megahertz, communicating with other meters and with the aggregators that are, excuse me, that are on the pole top. Or they've got network interface cards that have, they have network interface cards that have cellular modems in there. So 2.4 gigahertz. And those won't need an aggregator except for in remote locations. And those will just talk back directly to the cell tower. But we're concerned with all of those things in the red. The rest of this stuff, the cellular network, the edge resources like the routers and the firewalls back into the internal, that's just like a network. Okay? That's just a business network. We do the same types of assessment, helping them do web assessments, database assessment, looking at configurations of the different stuff on the internal side. But we're talking about the external, publicly facing devices. So what are the criminals going to want to do? Well, let me tell you this. We've got five bullet points up here. Utility industry has been doing this for 100 years. They've got a list that's about four times this long of the things that they're concerned with. Okay? All right. So free energy. Every time I talk to somebody, I'm like, yeah, man, I do research on smart meters. And they're like, oh, man, can you get me free energy, dude? What's up? And I tell them, no, I don't do that type of research. I mean, I know a lot about a smart meter, but because each meter is different, doing this is different for every meter. But it has been done. Criminals are doing this. Back in, I believe it was February. It might have been a little later. You can check Brian Krebs's blog. And you'll see that he talked about this happening in Puerto Rico. What happened is, is that there was an FBI report, investigation into utility, stealing energy down in Puerto Rico. And they estimated that if it continued, it had been about $400 million worth of theft of energy. They actually got 10% penetration. What I mean is, they had an insider steal the software that was supposed to be programming the meters. They knew the password, because it never got changed. And they were able to modify 10% of the meters in Puerto Rico so that businesses and residents got cheaper electricity. So it has occurred. This is a problem, but it was completely ignored because it was suppressed by the FBI. Okay? So that's why we're trying to, that's one of the things we're trying to help people understand. Corporate espionage, it is a concern. If you can understand the consumption of a business at a certain point, a critical point, you know, are they going to make their deadlines? If you need to understand that? Are they working on something new and something good? Okay? They probably don't want you to be able to read that data off of there. But if you can't tell from the tools that are provided to you by the manufacturer, whether or not that information is accessible without a password, you need something to help you understand that. There for another reason for our tools. Access to the back end resources. That's a given. Okay? Can somebody take a meter, take an aggravation point, and can they get to the servers on the back end and insert shell code? Okay? But also, you know, they're just like any other business. They try to consolidate resources. So they're skated devices, the stuff in their substations, those potentially could be communicating through the aggregators. Alright? So can I hop from a meter? Can I do something to meter and hop over to their skater network? So they're concerned about that. A kinetic attack. I have to explain this one a lot. And they, a lot of people don't have their heads wrapped around this very well. I say, yes, I can disconnect your meter. And the first thing they say is like, well, I can hit it with a baseball bat. They actually call it the baseball bat attack. Or they say, well, I can drive a truck into it. The truck into the substation. Okay. Yeah, you can do that. But when you walk up to the meter, if I change it via the optical port, the configuration, if I turn it off via the optical port, which one can you tell happened? The one that has been beaten up with a baseball bat? Or the one that has been changed via the optical port? You're going to know instantly. And here's why it's a big deal. They hate these pictures. These two pictures up right up here? They hate them. Because I'm pointing out that there's a residential meter. Commercial meters don't have a disconnect. But residential meters do. So I can disconnect, and that means you turn off the power. Now, if I am able to do this, I have the security code and you do need that. And I know which function to run. I can turn Sprint off on this cell phone tower. I can't turn the other two off because they're on commercial meters. So they need to understand where they're deploying these types of devices. And then they turn to me and they say, oh, well, we just turn off that functionality. Well, you just use a function to turn that functionality off. So I turn the functionality on, and then I turn the meter off. Thank you. Okay. And then obviously we all know, we know about hacktivism. We talk to people a little bit. People are getting more educated about that. But at the same time, they're going to use any resource they have to meet their agenda. Okay. We are talking about smart meters, but this is what kind of a good example of an aggregator on a pole top. The concern about these things is that, you know, they're high up on the pole. They're connected to the power lines usually. Okay. And is anybody here want to steal a transformer?  I saw the hand go up. I saw you.  You might be able to pull copper out of there or something like that. So somebody may be able to do that. But when they figure out that there's network capabilities on the pole top, you don't think they're not going to go for it. I can sweep those lines really easy. Actually, the neighborhood that this is in, it's on a side street. No houses face it. And there's a ditch on the other side of it. It's not too hard to steal these things. And if I can figure out a way to modify these things and put some type of device in there, the next one I'm not going to steal. I'm just going to hop up on it, they have no tamper detection and alerting that I'm going to put my device in there. And I'm connected until they finally figure out that I'm in there. And I'm using this as my entry point.  You know, because it's a network port. You can just tap, you know, throw my laptop right on there. I did talk to somebody who did an assessment on this one. He said they have actually have that locked down really well. Bigger concerns, bigger priorities that they needed to address on that and they did work on it. But only one of them winks at you. At least one winks at me. Every time I pick it up it's still hey, I need you to talk to me. So how am I going to get a meter? Well, I just, I call the meter vendors and ask them to give me one. That's how I do my research. Sometimes they're nice, sometimes they're not.  But they can do it themselves if they want to, if they don't, then they have somebody else do it. You know, I mean, this is freaking dangerous right here, but it's just, I mean, even if it's locked, if they don't have a tamper alarm, or who cares if they have a tamper alarm because they're not going to do it, you know, you don't have to plug them into your house to work on them. That's the actual example of an adapter that I was talking about. You don't want to take a smart meter and just plug it into this because it's still, it's still not protecting you, so please still be careful. And these pads right here with the danger on them, those are the ones I was reaching for that Travis yelled at me about. I'm going to figure out what other people are going to do. I break it down. Data at rest and data in motion. You have your microcontrollers, memory devices, radios, and that's data at rest. If they haven't protected those components, then I can just pull that stuff down. I can grab the firmware from the microcontrollers, obviously data and potentially firmware from the memory components. The radios might have firmware in them, but in motion, they have to communicate between the two. If I can tap that, and I'll explain that in a second, if I can tap that, then I can see the information that they're passing, which is actually more important because it's necessary. So data at rest, we just need to figure out what components are on there. It just takes a little bit of research. I mean the data sheets are all published exposed or partially exposed. We can, there are devices out there that you'll see in a second that can actually communicate with those. You don't need to even power the full meter to pull the memory off there. The ones on the images on the right are ball grid array components. They're a little bit more complex. It makes it harder to potentially tap these because these are really nicely designed embedded devices. They're very complex. But we can still pull those off. We can still heat up those boards and pull those memory components off. I did that for, actually Q did it. We did it for a client. We were talking to the client and we said, yeah, when we pulled the memory off, we got this other information, we didn't get very far. They're like, what do you mean you got information? The vendor told them it's all there. They showed them that and they can start asking more questions. Once you have those devices, I'm sorry. Yes, sir. Depending on the, the question was, do they have JTAG interfaces? Depending on the microcontroller, they'll have those. Radios will have different data debugs depending what they're using. Does that answer your question? The question was, are they subject to differential power analysis or vulnerability? You know, generally you're going to test for it. Usually what I do is I prioritize. I might have a particular thing that I'm going after. For this, I'm specifically concerned with the optical port. So I was going off that. I wasn't doing firmware analysis at this portion of, or it depends on what type of assessment we're doing. So we prioritize. Does that answer your question? Okay. All right. Back to memory components. So we just get devices that communicate with them. The aardvark device communicates with some very easily. You know, it's very simple. It'll power the memory component and pull the data off and then you have a data file. For the ball grid array components, it's a little more complicated. It's actually, you know, more expensive. And that's the ZELTECH on the right-hand image. But I, you know, and one of the things I want to tell you about is that the component is expensive, but if they haven't made an adapter for it, they're about $500 a piece. But the fact that I can actually call them and say, you don't have this. Can you make it and they send it to me within two weeks? That means it's not that hard. And I can pull, you know, it just makes it really easy to pull stuff off of those components that are ball grid array.  If you find him, I was actually hoping that I could find him and get some boards up here to pass out or at the Q&A. So if he shows up, we might have some there. But all you have to do is contact him. Look up the good fed and you can write your own custom extractors and get memory off of things that are strange and don't have a commercial tool for them. But once we do that, it's just like any other file system. But there's no pointer saying that this is the actual file or the data that you're interested in. You can run strings on it. You're going to get some interesting information out of there. You might even locate something just by perusing it. So what I turn to is I turn to the communication standards, the ANSI C12 stuff that we'll be talking about in just a second. But the reason why I do that is because things are going off of radio, so they've got timing issues. They don't have a lot of CPU power. So sometimes they just write straight to memory. So you can use these to help you understand how they are and maybe try to locate certain things within that file that you pulled out. So if we can't find anything, nothing pops out at us from our memory. And the reason why I do that first, even though it's hard, I might not do it, it's the easiest thing to do. So I grab that data, something might pop out. But then now I can start turning to data in motion. Because as I mentioned, they're only going to pass the most important data generally. So you can focus in on that data very quickly by monitoring data in motion. But you don't have just component to component communication. Meters are made up of metrology boards which count. And those have to communicate. And what's great about it, what we figured out, is that the Nick generally has to authenticate to the metrology board in order to get that information. So now it has to pass the security codes across those lines. And that's what we're going to focus on. This is an example of tapping the pins on memory components. Hopefully you guys have seen this before, but if you haven't, I'll describe it. Basically in the video, that's a logical analyzer. I prefer this Laological Analyzer. It's small, it's easy to carry, and it works really well. It's got some really good analyzers you'll see in a second. But basically it's just a, you know, we tap into the pins, we use the micro grippers to monitor each one of the pins so that we know what's going across those pins at any one point in time. And actually what the image that you see right here is the microcontroller driving the pin. And you can't have enough memory to keep that. So the microcontroller has to manage it. It has to send it the next hop, the next hop. Who understands frequency hopping?  Now you can start using that for your analysis into other things like finding patents, generating that hopping pattern. And if you can do that, now you're getting into the next phase that I really want to get into, and we're already working on that. The right hand side, if I can't get the micro grippers on there, if it's just line, like the Bob Gritt array components, or they're really small, I can't get the grippers to grip onto there, then I'll tap with the hypodermic needles. It's really good because it's got that point in a grip on there. But the problem with both of these things is that if I tap this with my elbow or my knee when I'm standing up to go do something, all of that stuff pops off. And you don't know how aggravating it is doing this for trying to get those hypodermic needles on there for 30 minutes just to look up, bump it, and have to do it all again. So it's really tough. So what we do is we look for debugging pads. Most of the debugging pads are for reprogram microcontrollers so that the developers have an easy way to push firmware up into the memory components. But when we go on board to board, sometime we have those as well. And the board to board is going to show the communications that's passing between the nick and the metrology board. And so we solder on that. And we pull those lines out onto our breadboard. And now we've got a more persistent connection. And we can put our logical analyzer on there. And if we understand how it's communicating, we can get devices and connect to those lines as well. So in the right-hand image you see my logical analyzer. So I'm still analyzing the lines. But I'm also putting an FTDI chip in there because I know it does serial communications. And now I can use this. It's important that's why I'm bringing it up. I can use this for serial communications. Because once I get to this point, now I can do man in the middle. I've got the lines that are coming out. I have to reconnect those lines. I can put those, make those lines go anywhere. So I can pass either those companion opponents any data that I want. I can let them communicate to each other if I want. But in order to do that, I need to understand the communication standards. And I did have to buy these. I don't think a vendor ever gave me one. So I did have to buy them. But they're only $200 a piece. So it's really not that big deal. I tried to search for them for this talk online. I couldn't locate them specifically. So C1218. That was their first stab at it. And this is so that they develop this so that they can have interoperability. So they have multiple manufacturers developing things and they all communicate the same way. Even though we all know how that works, they do it slightly differently at every organization. So C1218, it's not secure. The security code, the password, in the clear, all the other communications is in the clear. But it was their first start. It's actually a really good protocol. C1221 was their attempt at securing it. More securely. And what they did is they used DES encryption to pass a token between each other so that they had mutual authentication. But they had two problems with this standard besides the DES part. Is that everything passed after that mutual authentication is in the clear. So I still see the security code. But as a part of the standard the mutual authentication is optional. So to say that you're doing C1221, all you have to do is say that you're doing it. You don't have to do anything else.  So their answer to that was C1222. It was really hard at creating a standard so that supported networking, TCPIP you can do C1222. The problem is that they selected an encryption protocol that had not been approved by NIST. NIST didn't approve it because it's vulnerable to attacks of if you send a back... I might have this wrong but I'm going to try to do the best I can. If you send small packets, one, two bytes, it's to brute forcing the key. In this protocol you're never going to send anything I think less than 8 bytes. So it's not vulnerable to this attack. But because it's vulnerable and NIST won't approve it therefore none of the vendors will implement this until NIST says they okay because they're working on interoperability standards. So now ANSI has to go back fix this it'll probably be about 2015. Then the vendors can start doing the development so those meters will get C1222 in about 20 years. I'm just kidding. I'm sure somebody's working on it. Did that wake you up? I didn't plan that. Are you volunteering? I'll give you $10. Okay, so looking back to our logical analyzer, talking about the communications this is actually the output from a Soleilogical Analyzer and you're seeing actually the information service response packet here. And this is where they say they're going to do C1221 they just change that one byte. But what's important here is that the logical analyzer tells me what's going across these lines. As long as I configure it correctly then it's smart. For this right here it's just acing serial. The nick and the metrology board are just communicating via acing serial. And what I can do is I can not only use the analyzers to get the data it's parsing but I can export it to a CSV file. And then you know where I'm going there. How does it look? Because I've got low res. Okay, good. It came out good. So now I can start labeling the packets. When I first got those standards that I was talking about I read this for about two weeks because I'm really good at analyzing documentation and writing protocols and communications and stuff like that and it completely baffled me. I got this output and as soon as I can start labeling these bytes I'm like, oh man, now it makes sense. This is frickin' awesome. I know exactly what they're doing. I know every part of that packet. What's great is then I merge the files because you export the receive pin and then you export the transmit pin and you can merge these files. Now you can see the full conversation. The request and response. The nick card logging in. The metrology board saying okay. Identification, negotiation, logon, security. That's a security quote. Now I know how to log in. If they're using that code for the optical port that's what I'm hoping. Probably the next most important thing is the actions. The read, write, run procedures because those are still kind of hard to understand but also every manufacturer does it differently. If I can see them how they're acting, now I can start programming that myself. As I'm sitting there looking at these things, the first tool in my toolkit is a basic parser that will take both of those files, merge them together, mark all that stuff because it takes a long time to do all of that by hand. That was the first part of my toolkit to speed things up. As I'm writing that, I'm looking at it and I'm like, wait a minute. When I was working with Atlas working on the MSP430 disassembler and emulator, he told me when you're working with Python tables are the best way. Tables are the fastest things to reference. I'm like, holy shit, I've got tables because every response and request is exactly the same. There's a slight difference, there's a control byte, but I can account for that. It's exactly the same. I can just write tables to tables and if I can write the tables and I know what's coming back, now I can start generating my tools. Now that I have a persistent connection now that I can start writing tools for that, I have an advanced persistent tether. I can communicate with a device, I can send things to it and see what kind of response it gives. If I do this correctly, if I just think about what normal replay attacks do, you just send a packet. In this case, I didn't care about what it returned. Well, I cared about what it returned but I monitored to see what that response was. I didn't modify my behavior according to that response and so I would send a packet, I would send that logon packet, the negotiate packet. All the way up to the security packet, if it came back and when I analyzed what it was sending in return, I logged in correctly. So now I've got a man in the hand. So now I can receive responses via the logical analyzer, understand what's going on, know that I'm doing it right. And now I've got a hardware, this was the second one in my toolkit. A hardware client to communicate with the meter, log in, see what those configurations are and do it over and over again in a repeatable process. But I still have wires coming out of it. This is just on my laptop. On my desktop. I'm still not getting that full communication. What's great is that those meters, once they're powered, they will connect back to the radar tower.  So things could be still passed on there. But it's not the side of my house. I walk outside, I walk by my smart meter and it's weakening at me madly because I want to talk about the optical port. For just 30 seconds. How many of you are in here going to stay for the next talk in this track? Raise your hand if you're staying for that talk. How many of you are planning to go to FX's talk? Shit, would you help me count? All right. Thank you. Everybody give him a big hand. Everybody lied, right? But in order to communicate with it, basically it's just developed according to a standard. They all have to do it the same way maybe. But it's just IR. IR LEDs. So what's the first thing I do? I'm like IR LEDs. There's plenty of projects out there that do that. Plenty of projects online. They don't do it the same way. And they don't do it that's easy to do for async serial. I was in a time crunch so I bit the bullet and spent $350 on the optical probe because you can buy them online. It's expensive but no big deal. And I get it. And I plug it in and I look and I've got TTY USB 0. USB to serial. Because my FTDI chip, the one that I've been sending for my hardware client was the same thing. So I'm halfway. I'm even closer. I'm one step closer because I don't really have to modify that much more. $350 is kind of expensive. I did try. There's a project out there that somebody set up. They didn't outline the pins to a normal serial that I'm used to. I'm not really good at modifying boards just yet. So I contacted the people that make one of the IR dongles, Gwana Works. We helped fund some of this research and they were able to get an initial production. It doesn't quite work just yet. But what's great is not only do they have a serial, a module that has a serial out. So now I can plug in things like an XB module that you see right here. Cellulum modum. Now I can start making wireless optical probes. People are already doing this. $350 expensive. This will probably run between $50 and $75 if they told me correctly. If you're interested in this project, please contact at Gwana Works so that they know there's interest in the new development of it. But what do I need to do? I've got a client that will send data. But I need to respond in order to speak with optical port, I need to respond intelligently. So really I've done pretty much all of those things except for the response part. And so that's what I did. I wrote a client which was the primary tool within our toolkit that we're calling OptiGuard. It's next to it for smart meter optical communications kick. I thought it was okay but we decided to change the name to OptiGuard so that the utilities would not think it's mean.  They didn't like that either. So we went with OptiGuard. Thank you, John Soria. If you weren't in here before, let me know. Okay, so the optical client. Basically it's just a whole bunch of functions that will do what the manufacturer's tools do. But actually this first bullet point I need to point this out because I was asked to do it. This is the bullet point I was asked to add.  It doesn't mean that you can't do things without it. It's basically what our tool is designed to do. We don't need a security code to run it, but if you want to make modifications to it, you have to do stuff like the research that I just talked about in order to get it. Or you need to pay somebody to give it to you. So if you don't have it, but you have the tool, you just can't run around rampantly changing and make them modifying things.  One stuff without a password. To see if are there any tables which is where the stuff that contains the data, configuration data, the settings and so forth, they call them tables. So you can pull that table information out. Now you can attempt to pull it out without a password. Some manufacturers protect everything. Some manufacturers only can protect the ones that they think are important for security. But they've made that decision instead of the utilities. Now we have something that the utilities can use to test. Pull that information out and say, you know what, we don't mind about tables one, two and three, but you really need to table number 15. I can read that without a password and you need to protect that. Same with procedures. Did somebody mess up in development and leave a procedure in there that allows you to do something such as disconnect the meter without a password? With the regular manufacturer tools, you can't test for that. But now we can test for it as well. Actually, what we were able to do once we had the security code, now I was able to run every procedure at the same time. So I ran every procedure and then with, okay, first I just sent no data and didn't get any data, no joy. But then I sent a zero. I'm sitting there and I'm waiting and then all of a sudden the meter turned off. And that's the sound of the meter turning off. I'm like, oh, what? So I quickly look because I have some good logging in there. I'm like, okay, this number right there. And so then I just ran that one procedure with a zero and nothing happens. Crap. Now I send a one. The meter turns back on. Now I can turn this meter on and off. It's awesome. And then of course, you know, I called everybody in InGuardians and made them listen to Klunk. They called my friends. I'm like, what is that? I'm like, Klunk? Some knew, some didn't. Okay. But now we're showing that we can do this. I don't need a manufacturer to software to run this. So I can development. Criminals can develop it as well. But what's great is now we have an assessment tool to generate that data, to do those types of things so that they can start looking for it. Okay, we're running kind of short. Unfortunately, one meter manufacturer found out that if I ran all the procedures at the same time, so I did it. And then it started acting a little funny, but not too funny. So I'm trying to figure out how to reconfigure it. And then I look over at the screen and it says uncalibrated on it. Uncalibrated. I don't know what that is. I don't see it. Oh, yeah. Yeah, utilities can't fix that. You have to send it back to the vendor.  It's like, yeah. It's like, woo-hoo! But I didn't say that on the phone. But now we can tell the utilities that and we can pass this information back to the vendors and they can start looking into it because we're generating anomalous activity that they weren't expecting. I'm kind of moving on because we're getting short, so I want to make sure I get to some of the mitigations. iChart is basically just brute-forth method. I don't need the password to log in, attempt to log in. I can brute-force it just like any other service. But what's great is I have a tool now. I just go through all that memory that I dumped before and I generate every single password that's in there and you need it. I do the login. So even though I unique it and got 12,277 passwords, it's still going to take me seven hours to run it. And I've never actually gotten my tool to run for more than about 20 minutes consistently. I can build some smartness into it and just restart it. But that's kind of important for utilities to know. Can they detect those brute-force logins? I can generate my own dictionaries. I don't have to get one out of memory. So are they using stuff like the utility name as the password? The vendor name at the password. So you can develop your own dictionary files and generate that kind of data. I was going to give a demo when we thought about it. But then something kind of dawned on me when I was thinking about my demo for Smookon and Black Hat. I realized that even if I show you the demo, if I have a meter up here and I click on the clock because it's cool, it doesn't mean that I'm really showing you anything. I'm showing you something that I can do with the security code on one meter. Okay? And there's at least seven different types of manufacturers out there and they all develop multiple types of meters. So I'm not really showing you anything. What I would really like to show you is that I can make the meter click on clock and then I can point over to the detector to detect it. Because that's what I did. I got on the phone with one of my clients. I turned the meter off and he's looking at his logs and he goes, I can see it. I'm going to screenshot that. I'm like, woo-hoo! That was my biggest woo-hoo because now I've actually shown that they can make those once I make a configuration change out in the field. Something that's unauthorized. Now the operators can identify it on the back end. Now they can create a large suit and form my security research. Mitigations, as I mentioned, most people do a lot of the mitigations that are going to be outlined right here. We talked about the residential meters, making sure you put those in the proper area. Actually, deploying a million meters and having a million different passwords is probably another security vulnerability. But you can still do it intelligently. So we talked to them about that. Obviously, we just talked about incident response plans, tamper alerts. On the smart meters, maybe not so much because there's so many out there, but definitely on the aggregation points for the pull tops, you'll want to do that. Encryption has to be done properly. We all understand that. The configuration integrity checks, we just talked about that. Some people break the standard a little bit just on their meters. They send an authentication code, but what's great about that is I can still build into my tool kit, you know, the method to pass the token.  So it makes it really difficult to work on those. So, you know, start thinking about different things if you're going to be researching this. I already thought about, you know, the wireless optical port readers. You know, we talked about that with the ZigBee optical spraying. If I'm standing 10 feet away from a meter and shooting IR at it, because I know the timing now, if I do that and I never touch the meter, did I do anything to the meter? So, you know, thinking about that, making people understand that. The wireless sniffers that we talked about putting in the aggregation points and putting... They could probably detect the ones that are in the meters, but the aggregation points are my concern for the sniffers that you just put in and leave them in place to send data back to you. And then obviously the frequency hopping. You know, that's probably the next big concern. Being able to do this type of stuff and get that radio information to understand so that you can do all of this stuff wirelessly via the radio. That's something that I'm really interested in and we're working towards. I mentioned that the vendors helped us. Ed Barrisette from Elster, you know, he actually contributed to the code to make sure that, you know, I'm working with more meters than I had actually worked with. Robert Former from Itron is a constant, constantly encouraging me, and he actually worked very hard to make sure that our toolkit is being used by their research team, that their developers understand it and they know to talk about this stuff as well. And then we're getting great positive feedback from a lot of the vendors except for one or two. I couldn't have done this without support from a lot of people. I listed some people on here. I obviously miss people. Once again, my name's Cutaway. Thank you everybody for coming. There is going to be a Q&A afterwards. I really appreciate it. Thank you very much.


Hey, this is Brett, and this 2014 Ram 1500 Crew Cab 5'7'' Short Box Express Package is stock number 12579ZA. I'm here at some automotive in Fond du Lac, Wisconsin, you're new and used light-duty truck and Ram headquarters. This 2014 Ram 1500 has the 5.7-liter V8 Hemi engine. This truck has been fully-safetyed and inspected by our service shop, has a fresh oil and filter change. All the fluids have been checked and topped off, and it is 100% ready to go. I'm going to go all the way around in this video inside underneath, start it up, and take a look under the hood to give you the most accurate representation of the truck possible. Deep cherry red metallic is the color, and I shoot all my videos in 4K, so if you have HD capabilities, turn them on right now, because it is your best way to check out the quality, condition, options, and cleanliness of the truck before seeing it in person.  I didn't see any major dents or dings on there, looks really good. Front fender is in excellent condition as well, and if you like the video, you can subscribe to my YouTube channel, which is youtube.com slash Summit Auto. Click the bell notifications and you'll get updates on the videos I do each and every day here at Summit Automotive. This one comes with the 20-inch painted alloy wheels, and it has Nitto Ridge Grappler, 33 by 11.5 R20 LT tires. These tires have right around half the tread left on them. Frame and underbody is in really nice condition for being a 2014. Coming around the front, you get the painted bumpers with the express package, factory fog lights, no major dents, dings, or cracks on that front bumper. The grille is in nice shape, and the hood is in pretty nice condition as well. It does come with a nice bug shield on there. Only thing I saw is just a little bit of corrosion from the aluminum hood right there, but nothing too bad. Passengers side front fender is in nice shape as well, and the passengers side front wheel, no major scuffs or scrapes on there. Now as you go down this side of this 2014 Ram 1500, take note of how clean that body is, how reflective and mirror-like that paint is. Keep in mind that this truck is nine years old, and I take these HD videos so if you are far away or even if you're close by, just cannot make the trip down, but you're still interested in purchasing the vehicle, you can see the truck, hear the truck, and of confidence in the vehicle that you're looking at before you even get here. So when you do get here, there's no surprises, and you can make a smart and informed buying decision from wherever you're at. If this video helps you make that buying decision, let your salesman know that you saw the video that was helpful and that Brett sent you. Back wheels in nice shape as well, and the back tires have just as much tread as the front tires. It does come with the nice plastic wheel well liners. The wheel wells themselves are in nice shape, but I didn't see any corrosion on them. And the frame and underbody is in really nice shape as well. Looks really good, lower rockers and cab corners, I didn't see any corrosion on them. And that's where you want to look on these older Rams, as well as the box hides, of course. Coming around to the back, rear bumper is in pretty nice condition, does have a couple little dings on it. You get the chrome tipped dual rear exhaust full towing package, which includes the receiver hitch four pin and seven pin wiring. There's one of those little dings on there. The tailgate is in nice condition as well, does have a little ding there. Locking tailgate has a spray and bed liner. This is a Line X spray and bed liner, and that is in really nice condition as well. That bed liner goes onto the tailgate, which is a nice feature to have, and it locks and shuts nicely. For full disclosure, this back wheel is in nice condition as well, no major scuffs or scrapes on there. And down the rest of the side once again, doors and cab all look really good. You do get the heated power mirrors. Inside the express package gives you the gray cloth interior. There are no rips or tears on the seats. You get 40, 20, 40 split bench seating in the front. Smells very clean inside this truck. Comes with the factory formats, auto headlamps, power windows, locks and mirrors. We'll take a quick look at the back seats. They are just as clean as the front seats, no major rips or tears back here. You do get the latch child safety system for any child car seats you may have. And the seats are in really nice shape. Factory formats back here. You get storage under the back seats as well. And you get in-floor storage back here with removable bins for easy cleaning. You can put ice and drinks in there.  Child safety locks on the back doors and the bottoms and inside of the doors all look really good. Once again, no corrosion back here. Take a quick look at the VIN sticker here. We'll take a look at the tire and loading information sticker. Everybody always wants me to show these. We'll hop inside, check out the miles, the radio and everything that this truck has to offer on the interior. You can see that this one has 80,917 miles. You do get a digital speedometer and outside temperature display. Instrument cluster is very nice and clean. Comes with the information center controls on the left, gear selector and cruise controls on the right. This one comes with the eight speed automatic transmission, the push button four-wheel drive, including four-wheel drive lock. You get AM, FM and Sirius XM radio capabilities on this radio. You get climate controls down here, stability control and tow haul. Carpeting and passenger side format are in nice condition as well. No rips or tears on the passenger seat and the headliner is in really nice shape too. We'll start it up and take a look under the hood. Starts right up, no check engine lights or anything like that. We will be putting some fuel in this truck right after this video. And I would personally like to thank you for checking out the video today and hopefully from this HD video. You've been able to verify the quality condition options and of course, cleanliness of this truck all the way around inside and out under the hood. We have the 5.7 liter V8 Hemi engine. Engine bay is very clean, runs very smooth. Once again, this truck has been fully safety and inspected by our service shop as a fresh oil and filter change. All the fluids have been checked and topped off and it is 100% ready to go. There is the emissions sticker. And for the age and miles on this truck, I would highly recommend it from a quality and condition standpoint. I think it's a pretty good value here. And to see more pictures of this truck or one of our other 550 new and used cars, trucks, SUVs, minivans, Wranglers, halftones, three-quarter tons, one-tons, you name it. We've got to go to that website right there, summitauto.com. Full pictures and descriptions of every single vehicle from two locations all at summitauto.com. And if you'd like to check out more HD videos, you can go to youtube.com slash summitauto. Remember to like, subscribe, and share on this video and all the videos that you see there. Click the bell notification to get updates on the videos I do each and every day here at Summit Automotive. In fact, in a second you will see a link to subscribe to my YouTube channel on the upper left. Link to more Ram 1500 truck videos I've done in the upper right, a link to this vehicle on our website on the lower left. And a link to one of our latest YouTube videos on the lower right. Click those, check us out. We're super excited to help you with this Ultra Clean 2014 Ram 1500 Crew Cab Short Box Express in Deep Cherry Pearl. Thanks again for checking out the video. Remember to like, subscribe, and share on the YouTube channel. I really appreciate it. Thanks again.