how's it going ? Alright . We're here
for another talk , uh doing insights to
foreign skaters bots probing us ot
assets with Phil trainer . Right , this
is gonna be a great talk , see you guys
in there . Okay , all set
to start . Good to go .
Fantastic . Well , thank you very much
everyone for having me here . I think
this is gonna be fun . What are we
gonna talk about ? We're gonna be
talking about operational technologies ,
threat , intelligence and attribution .
I mean in a nutshell , we're gonna be
looking at some research that I did on
actual foreign bots that are talking to
us assets , us industrial control
systems , assets . And before I start ,
just to alleviate everyone's concerns .
Yes , I work at Nozomi networks and I
do uh routinely see network traffic
that is reaching government assets .
None of the data I'm showing you is
from government assets is the data I
collected . So it's completely um
copasetic to show this in a wide
audience and I think it will be , it
will be very interesting . And what
will I be showing you ? I'll be showing
you who the Attackers were . I'll be
showing real I . P addresses . I'm not
masking anything . Uh , these are very
recent attacks from as recent as a
couple of days ago , um , what their
intentions were , what they did , how
they used obfuscating techniques , how
they use pivot points in general . I
think it'll be , it'll be interesting .
But another thing that I'm gonna do ,
which people always appreciate , I
started doing this a while ago is since
these slides and the content will be
posted , I'm gonna have all my control
c control V . Stuff in there . So if
you're like oh how did they do that
thing to scrape that or how did they
set that up and docker or whatnot ? I
do everything in command line . So
throughout the presentation of people
say okay let's just copy those things
and some people be like yeah I know how
to do that but some people be like oh
this is a real time saver to have this .
So okay without further to do let's
talk about the data set . So industrial
control systems are not cloudy . I mean
there's no industrial control systems
like up in the cloud their physical so
if I were to be collecting data it
certainly could not be in a cloud
network has to be in a physical address
has to be a physical network . So um I
had a stun in a building that was not
just any building is a building about
half a click from the U . S . Capitol .
So it'll definitely be interesting from
that perspective and it's an I . P .
Address is a business I . P . Address .
And this is what exposed the internet
probably about three months ago in
order to collect a large amount of data .
What did I expose ? I exposed a bunch
of services but the meat of the data
I'll be showing is uh foreign Attackers
that were very very interested in mod
bus seamen's I . P . M . I . Bac nets
and all those different operational
technologies that really are in the
news quite a bit
scrapers . This was a huge huge
huge problem to doing this kind of
research because I had so much data and
so much of the data was from lots and
lots of normal scrapers going through
and trying to see what was on the
internet . Um here are some of the some
of the scrapers that were just all over
my logs when I was trying to do all of
my analytics on this . I mean rapid
seven's project sonar almost daily was
on their shadow servers on their lots
was kind of weird was arbors scraper
came up as malicious on a bunch of
stuff . So I don't know what else Arbor
is doing the same thing with there's
the Net Systems Research project but I
had tons and tons and tons of any
person who's looking at a Splunk inside
industrial control system or any sock
in an operational technologies network .
You are going to see a ton of this . So
you've seen this before . But if O . T .
Is not really something you've looked
at a lot . This is one of the uh states
of reality . The biggest one though by
far the biggest scraper I found to be
census . Um you see here this is this
is what I mean by some of the uh
stealthily posting about uh like
different strings . But these folks ,
these folks scrapes me multiple times
multiple servers all day every day . So
I had a ton of their data in my system .
So attacker , high level stats ,
let's talk about which network , which
countries um , we're attacking the
system that I put forward about a click
from the U . S . Capitol off the bat .
It seems like the U . S . Was the
biggest attacker of it . But that's not
really the case because I'll talk about
in a moment . But looking through here ,
what I don't see a lot of like china
was only a small amount and and Russia .
Why ? So little Russia and same thing
Ukraine different ones . It seems to me
that Japan was one of the bigger ones .
That was kind of strange to me . But
once I started digging into the data ,
then I was able to really piece
together the puzzles and I mean , not
to steal my own thunder , but pivot
points are one of the biggest things
being used and we'll talk about that in
a minute . But okay , let's um , take a
look at different protocols by
different regions . You can see that
there was a lot of interest coming from
western europe , especially for Siemens
protocols , but there was still a
decent amount in the ASia area
and different spots like this . And
essentially this is also I scraped just
those I . P addresses and to look up .
This is a very important thing , a
quick note on ipad attribution . I mean
when you're doing this , I . P .
Attribution is not an exact science .
It's almost more voodoo and guessing .
But you get the breadcrumbs of what's
going on . You can find out a lot about
obfuscation techniques and seeing if
someone trying to hide what they're
doing by making a pivot point . But at
the end of the day what the attacker is
doing is always going to be so much
more important . And initially I
started going down that road with this
talk . But the problem was I would just
be showing you screenshot after
screenshot Nozomi and I really didn't
want to do that . I wanted to keep this
completely agnostic . So I'm gonna lean
more towards the I . P . Attribution .
But I mean you can't scrape a ton of
information from this and I have some
of this for you and I think it'll be
very interesting . Most of the first
things I did was I took all of my data
and I dumped it into a really cool
service called max mind . I know if
anyone's seen max mind before , it's
incredibly cheap . It's like fractions
of a penny for a couple of 100 lookups
and basically give you the information
on just about anything that is going on
for a particular I . P . Address . And
and to be honest the information is
very very current and relevant and
pretty good . But at the end of the day
what you really want to do to get more
information on this is you're gonna
want to start going into the registries
and putting the I . P . S in there in
order to really pick apart who
registered what's how long they've had
it and start peeling back from there .
But in a nutshell that's really where I
started things off . So let's take a
look at what I found once I started
digging into the registries and
comparing this to the Attackers . So
remember when I showed you the previous
pie charts and it was almost all us ,
Well it was all us because it was so
many hits from scrapers there really
aren't a lot of foreign purely
informational scrapers . They seem to
be more leading towards the the
exploitation side of it where they're
looking for targets . What these
companies do with rapid seven and also
the company are doing with this
information is essentially they're
making a part of their threat
intelligence package that they're
selling to their customers and making
available for better socket decisions .
Um That's not the case with some of the
Attackers . The Attackers are mostly
looking for vulnerable targets to do
what they want to do . So I can look
through this you see that actually
bubbling more towards the top was
Singapore , Japan china and a little
bit more towards the bottom was all
those european nations . So on a few
slides back just jump back here really
quick to these . You can see that there
were more hits from them but they
weren't as um as consistently pinging
and as aggressive as some of the single
I . P . Addresses that were in ASIA .
So let's go back over to this and let's
do one of the investigations and I'm
gonna start with one of the more
interesting investigations that I had
more fun with . Also mostly because it
was it was a bit near and dear to my
heart . So this is an I . P . Address
that on you see right here october 18th
was going after one of my assets went
after quite a bit . Um For those who
don't know the S . Seven communications
protocol , it's it's a seaman's
proprietary protocol and it's used for
PLC programmable logic controllers and
the Siemens S 7 to 304 100 family . I
mean it's it's data between skate A .
And diagnostic systems and it's it's
pretty pretty common . So as you can
see here that it was an S7 connection
and this is the date that it happened .
So let's let's a little bit of uh
attribution . Let's see let's see some
more about this . Okay so right off the
bat you can see that this is owned by a
leased out at least by a company called
ace ville P . T . E . L . T . D .
Anyone who's done any business in
Singapore . You see that P . T . E . L .
T . D . After almost everything . And
what's kind of interesting is this
company is based at income at raffles
in Singapore and actually go over
one slide to this . Um anyone here who
spent any time and in Singapore knows
that income at raffles is right
right in marina Bay . And it's also
it's very close to all the big
financial centers . Singapore has a
whole bunch of skyscrapers are
dedicated to companies like I mean
Citigroup and Jpmorgan Chase and they
have this other huge complex called M .
V . F . S . Which is the Marina Bay
Financial Center . Then income at
raffles is right there . But income at
raffles also income at raffles has a
huge gym in it and other stuff . I used
to live in a building called the sale
at marina Bay . And I could see income
at raffles right from there . So then
very small presence in this very big
building which is not cheap . It's
actually very expensive to be there to
rent anything in there and you
know , nobody works there . Which is
kind of funny to me because
linkedin is a very big thing to people
especially in Singapore , especially in
the security community . People love
listing all of their certifications and
places they worked and things of that
sort . So it's kind of interesting that
not a single security researchers says
they work there or anything which is a
bit odd I thought . So what does a
spill ? P . T . E . L . T . D . Do . I
mean they're they're little I . S . P .
They host a bunch of websites and they
host a bunch of websites mostly with a .
Dot C . And top level domain . But
looking back a little bit . The I . P .
Address that we had had no registered
website to it at all .
So there was nothing nothing for 1 51 9
14 or 15 . There was no website . And
security trails is kind of a good site .
What security is really good for is it
allows you to go back in time a little
bit for a while . People are using
security trails in order to see um
the mast I . P . Addresses of
companies like Cloudflare . What
Cloudflare would do is they hide
everything behind a reverse proxy . And
you couldn't figure out what the
underlying I . P . Address was . But
one of the ways people are getting
around that was by going to security
trails and seeing historically if they
left behind a piece of information from
six months ago a year ago whatever .
But I like going to it just to see like
what's the history that I . P . Address
has been least other companies know
it's really never had that much of a
domain presence which is kind of
strange . So um a spill P . T . L .
T . D . They're actually Tencent so
that I . P . Address . That whole
string is owned by Tencent . Um As I'm
sure most people uh conference no
Tencent is a chinese company that is
centered around security . They're
actually one of the sponsors of def con
Beijing when they had that back in
2018 actually I went to that uh that
def con in Beijing in 2018 and Tencent
had a very huge presence there . They
were one of the main sponsors but they
are the actual owners of that I . P .
Address which is kind of interesting .
So you know , there's nothing wrong .
They scanned me , they attempt to do a
whole bunch of different things onto a
system that I was hosting . So I
thought it was perfectly fine to scan
them as well and take a look at their
hosting and it seems like they're
hosting ssh service , http and https
and like , okay , let's take a quick
look at it . So I did that and and tour
and did a few other things and they're
just hosting this basic Apache page
that has a whole bunch of very serious
vulnerabilities attached to it . And
that struck me a bit odd . My first
thought was , I don't believe you ,
this is more likely a honeypot or
something else . But regardless this
right here is a machine that sad ,
extreme amounts of interest in what was
going on in my server in Washington D .
C . On capitol hill . Um I
analyzed the attack content of it ,
what they sent what they did . Um I did
a whole bunch of stuff . Look at packet
level rules , I was looking at the
traffic they sent through the CVS that
I grabbed were pretty interesting . Um
I was able to look at some other things
through our rules and see different
malware that they were sending through
and also from stuff with my sticks ,
I'm really not gonna go too much into
this because like I said , I don't want
this to be a giant Nozomi screenshot
but it was very interesting the stuff
they sent . So in conclusion this I . P
address is almost certainly a pivot
point or a bought for scraping data
about targets . The command control is
almost certainly in china . They are
very interesting US assets and they are
very interested in industrial control
protocol assets , especially Siemens .
Programmable logic control is so this
was this was kind of an interesting one
that I liked a lot after looking a lot
of data , but I've got a bunch more so
on to our next attacker . Um This
one was kind of fun . Um I definitely
wanted to start with china and then do
one with Russia . So he went on to
Russia after china . Um There was
definitely a ton of other pivot points
that I traced back to Russia , but this
one was kind of interesting because I
had a little aha moment on this which
was fun . So this I . P address based
in Russia was doing a hodgepodge of
things . He was doing both mod bus and
Seamen's protocols but also I kept
getting this odd error on S seven
and when I investigated there a little
bit , it became very
clear very quickly that this is a bug ,
this is a bug in a program called PLC
scan That it was doing something
slightly correct incorrectly . And it's
always interesting to completely unmask
your attacker in the first five seconds
and being like , I know exactly what
code you're running to scrape my asset
from Russia . So that was kind of cool .
So it was 100% this tool being used
from Russia very much target in the
world , but also not uh not skipping
over our nation's capital .
Okay . Uh , next attacker . So
I decided to pivot back over to china
on this one . Um because I had a lot of
traffic from this particular one . And
what's more about this particular one
is I had a lot of different types of
attacks coming from it . Um that was
one of the things that really interests
me is when an I . P . Address , when an
attacker or when any different campaign
does lots of different things . What it
says to me is this is typically better
financed or there's more people behind
it and what I'm really looking for is a
group that has more resources . I mean
this one right here from Russia , I
mean someone could set this up in their
dorms and it wasn't very interesting .
The previous one from Singapore . That
was more interesting . It was all
coming from like a shell company that's
hosting the chinese websites that was
in one of the most expensive buildings
in the world and that was there was a
lot going on in that one . But this one
right here as multiple different
protocols . It did . And a little bit
of investigation into this right here
is it was coming from essentially the
amazon web services uh I . P . Address
group inside of china . So um this is
interesting from a historical
standpoint . So everyone knows that AWS
had a large presence in china . But
what happened was the chinese
government , the PRC came back and said
that you can't foreign companies can't
host data on china . So they
essentially had to surrender all their
data centers . And it's still N . W . C .
D . Is still an operator of A W . S .
But it's AWS is no longer really in
possession of that data . It's N . W .
C . D . So I took a look at this uh
site a little bit of interest because
it's coming from that particular data
center and I actually scanned them . I
want to see what they were . And mostly
I wanted to prove that they were Ec two
instance in AWS that was now inside of
china . I had so much
traffic from that same cloud
carrier that AWS provider in china .
And here's another one that was very
pervasive that was scanning all the
time on this particular uh on my
particular I . P address . And it was
just very interesting to me that they
were just very focused on it . I mean
it's I mean there's 4.3 billion I . P
addresses in the world to hit me 50 60
70 times a day from like 100 and
5200 different I . P . Addresses all
inside this network . It's a it's a
very concerted efforts to look for
industrial control systems inside the
United States . Coming from this
particular group , particularly from
this I . P address was very interesting .
And so is this one and they're both
they're both definitely easy to . In
fact , I was able to take a look at the
exact um passive DNS replication of it
to see it . But then I went on to some
other different sites of threat
intelligence to see who else is seeing
this . And I went to abuse I P . D D V
and I went to virus total and a whole
bunch of other places just in search of
what was going on with this one . And I
found just dozens and dozens of
examples of targeting , you see right
here , the TCP port 502 . That right
there is mud bus and it was this system
right here targeting someone else also
kind of the same timeframe and the
person's uh moniker was S N Y
D R . So I'm like , oh it's probably
either someone who works at Snyder or
someone who is actually a user of it .
Um iris flower . I couldn't really get
anything out of out of that name . It
was interesting Snyder and I can't
quite guess the flag . I play a lot of
chess on my chest dot com on my phone .
So I usually look at the flag and say
oh that's this country or that country
but either way they had a whole bunch
of interest from them from another um
Industrial control systems support .
But in a nutshell The conclusion
of that is these are all e . c . two
bots that are scraping targeted
information especially from us based
physical businesses that may or may not
contain industrial control systems .
The whole thing was hosted control from
china and it was it was very it was
very loud and noisy . They were almost
like carpet bombing looking for
different resources the volume of
traffic that was doing it . Um
So if I could summarize the research
that I have and found during this this
time frame , one of the main things I
saw was just the incredible amount of
different scrapers from inside the U .
S . That were really intent on
gathering all the information that they
could and to deliver to their customers .
Once I paired off all of that
information . And my first campaign
just going back a little bit sorry I
went back too far
that there's a lot of a lot of bots
either in china or they are using pivot
points in other parts of Asia like in
Singapore in in order to scan the U . S .
For industrial control systems . And
these pivot points are really good way
to mask what they're doing but they
didn't do that great of a job of
masking it . But another one is a lot
of people just setting up easy to use
out of the box tools in order to gather
this data . And
lastly there is really almost no shame .
And just using a public cloud Bayside
china to use hundreds of I . P .
Addresses in order to map the entire
industrial control systems available
network inside the U . S . On an hourly
by the minute basis .
So here are some of the copy paste that
I had thought this was just useful for
someone if they wanted to replicate
some of my stuff for here . You can see
that I used pot for this composite was
called a low interaction honeypot . Um
I use some other stuff in order to get
a little bit higher level interaction
on that to get some other files and
things of that sort . But what's cool
about this is you can set this up
incredibly fast . Um These are the
commands to do so and these aren't I
didn't copy this from the the read me
file , this is my I did history for
this . These the ones that worked for
me specifically for me a lot of times
you can read me , I'm like oh it didn't
work , it didn't work . But this worked
perfectly for me on a fresh install of
of a bun to and say this is my scraping ,
here's your docker inspect format log
path , it'll dump you out the exact
container . And this is really
important cause a lot of people um if
you work with docker containers and you
would understand that um they don't
really not meant to be like long lived ,
you're supposed to docker container and
use the first thing they need destroyed ,
but what's left behind the logs and a
lot of times it gets a little bit messy
unless you're cataloging and keeping
track of things all the time and a
network . Like I was creating a kind of
pop up network to observe these these
observables . It really became a bit of
a pain to to grab everything . So once
I was creating a a new Docker
image , I was making certain to grab
the log path of it . And when I
destroyed it every 24 hours I would
scrape it and dump it and be able to
say , okay first on the I . P .
Addresses . Then I'd be like okay I
want the errors on it and I want to
grab just the mod bus or just the seven
com or just the I . P . M . I just the
back debts . And here's some of my
scraping things for that . So um
I wanted to leave five minutes for this
to jump on the other channel for
questions but in a nutshell , it is a
constant stream of bots coming from
mostly , uh , Asia , that are very
interested in scraping us physical
assets for the presence of Operation
Technologies , industrial control
systems and Scada systems in order to
gather that data and then to use very
current exploits and different
techniques in order to take them over .
I'll be jumping over to
the Discord channel a minute answering
questions people have , but thank you
so much for having me . Was really ,
really pleased to be selected to be one
of the speakers at Adventure Con , and
I'm looking forward to hearing some of
the other tracks from some other
presenters . Thank you so much .