Original subtitles

we know what firmware is running and

this is without even logging in you

literally just typed something in google

and you found this yeah exactly

you know i don't want to lose my channel

[Music]

hey everyone it's david bumble back with

occupy the web for those of you who

haven't watched our previous videos he's

the author of this book fantastic book

if you want to learn linux from a

hacking perspective

he's also got this book

getting started becoming a master hacker

occupy the web welcome thanks david

thanks for having me back again this

book's getting updated is all right it's

getting updated and it's going to be

republished by no starch press under a

new name it's going to be called a cyber

warrior handbook and it's going to be

totally rewritten with new tutorials and

it's going to be more targeted towards

the cyber warrior than just the beginner

uh hacker it was originally scheduled to

come out later this year but the war

kind of got in the way the war has been

taking a lot of my time that should have

been spending on updating that book but

hopefully it'll be out this winter

sometime a lot of you have given

feedback about you know the content that

you want to see and i'm really happy to

announce that occupy the web is going to

be doing a series of technical videos so

we're going to dive into like a bunch of

technical details and as part of this

series we're going to be looking at mr

robot hacks occupy the web on our

previous video you were telling me one

of the problems with youtube videos and

perhaps with mr robot and all these

movies is you know it's not realistic so

i'm hoping we can take like a mr robot

hack and you can show us like how it

actually works in the real world yeah

i'd love to do that and uh let's start

off with one of the best hacks in the

show and and one of the things i'd like

to do is to explain why i like mr robot

because

i like mr robot because he does real

hacking it's not because of the drugs

yeah it's not because of drugs right

drugs are a side benefit

[Laughter]

it's because it's real hacking it may be

a more compressed time frame than

reality that's because it's a tv show

and they can't spend hours and days just

like on youtube videos but if you watch

very carefully he's actually doing hacks

that are largely largely not all largely

realistic it's really one of my favorite

tv shows of all time not only because

it's a hacker show but you know it's got

rami malik those of you who may not be

familiar with rami rami

he's been an actor he's been around a

little while and he's the guy who got

the academy award for best actor for

playing freddie mercury in bohemian

rhapsody mr robot is really what made

him famous this is really what launched

his career was this tv show and

basically it's the story

of a

young man who

probably is on the autistic spectrum at

least that's my interpretation he

displays a lot of characteristics that

we associate with asperger's his kind of

asocial behaviors his inability to look

people in the eye he's kind of really

sensitive to touch he doesn't like to be

touched he's very you know he's very

focused on what he's doing these are all

typical traits of somebody on the

asperger's spectrum i can relate to this

i mean if it's any help to you i mean

that's probably very close to what i was

in when i was his age okay that's

amazing yeah

and uh you know

like him he struggles with this kind of

being able to relate to other human

beings and i've worked on it all my life

and i think i've done okay and trying to

be more social so not only can i relate

to him as somebody who's a hacker but i

can also relate to the kind of thing

he's suffering with the things that he's

trying to deal with in his everyday life

obviously i love this show and if you

want to if you want to know more about

my personality you can see a lot of me

in elliott and elliot is the main

character elliot alderson you know we

started off the show where he's

basically working as a cyber security

engineer for what he refers to as evil

corp an evil corp is very large

corporation who does a lot of bad stuff

they're probably responsible for both

the the death of his father and his best

friend's

mother

angela and he you know he struggles with

his idea that he's protecting this eagle

this evil corporations his job is to

protect some a company who he hates

so we see this constant struggle in his

personality of what and how he should do

this that's kind of the beginning what

we're gonna do today is we're going to

address i think it's episode six season

one episode six if i remember correctly

that's right yeah

and the reason i like this i i made sure

about that so i made sure i watched it

today to do my research so you did your

research today as well yeah my research

was

enjoying watching uh mr robot which i

could watch over and over and over again

so

i like this particular hack and

those of you who know me and who are my

students or have been to my website know

that

i think that scada

ics is probably the most important area

of hacking right now these are the

systems that run the world every

facility every refinery

manufacturing facility electrical grid

these are all run by industrial control

systems and these industrial control

systems are all run by what are called

programmable logic controllers plc's

these plcs are all very simple computers

okay that allow the operator to

basically you know open valves open

doors closed doors

it runs the

industrial world i think it's been

largely overlooked in terms of both

security cyber security and the role

that these plants will play in any kind

of cyber war which you know we're in the

middle of right now and we've seen

the russians attack repeatedly the

industrial control systems of ukraine

and you know the russians are feeling a

little bit coming back at them right now

we won't go any deeper into it than that

in this episode this is one of the most

complex hacks that elliot does and

there's a lot of reasons to like it one

because it uses different technologies

it ends up where he's trying to hack his

girlfriend out of prison and of course

the prisons are industrial control

systems so what we're going to do is

we're going to walk through what happens

is elliott tries to hack shayla shayla

has been

kidnapped by the drug dealer vera is his

name and vera is uh is an evil guy he's

taken

shayla and he's holding her hostage and

he's told elliot that he's not gonna let

shayla go

until elliot hacks him out of prison and

of course elliott says

you got to be kidding right this is

this is this is crazy i can't hack you

out of prison yeah he did in one day as

well is that right yeah exactly so one

day so tavira was in jail and uh he's uh

well shayla was hostage held hostage by

his group is all right and he had to get

vera out of jail but like tonight

tonight yeah and he tells he tells vera

i can't do that in one day

and you know that's realistic i mean

he's telling him that you know this kind

of hack will take maybe weeks months

vera's not buying it vera knows he's got

to get out of jail tonight and he

insists upon it uh and so elliot has to

come up with a solution and the first

solution he comes up with is that he has

darlene darlene's is kind of sidekick i

think that's what they used yeah the

rubber ducky well they tried yeah they

tried to

essentially a rubber ducky yep i mean

you can actually reprogram the firmware

in any thumb drive to do what the rubber

ducky does so rubber ducky is an example

of a reprogrammed

um thumb drive that when you put it you

have to show us how to do that if you

like take any thumb drive to do

something like that maybe that's for

another video that's for another video

because that's beyond what we can do

right here but yeah basically you have

to upgrade the firmware on the

thumb drive so that it appears to be a

keyboard that's all it is there's all

kinds of different thumb drives right

and so your thumb drive normally the

firmware in it tells your system that

it's a storage device you can

flash the firmware of the flash drive

and give it the information that it is a

keyboard and so now when it plugs when

it plugs into your machine it's

recognized as a keyboard and then the

rubber ducky or the flash drive can send

key strokes into the system so you can

immediately start setting keystrokes in

and do basically whatever you want with

the system so you can program keystrokes

already in there and that's the first

attack that they try okay is that

darlene put uses a exploit from

i think they refer to the company as

rapid9 which is kind of a reference to

rapid seven who owns metasploit and

elliott kind of scolds her and says hey

you know what are you doing using you

know a known exploit because it fails it

fails because the antivirus detects it

so let me back up a little bit darlene

leaves these thumb drives all over the

parking lot of the prison hoping that

somebody will pick it up and put it in a

machine inside the prison because

elliott recognizes that prison systems

are offline the problem he has is how do

i get inside the prison network most

scada systems are online prison systems

and a few others are offline like things

like dams and bridges and that type of

thing usually they're offline but the

prisons are offline so he realizes he

has to get inside the network he can't

reach it from the outside so the idea is

to drop these rubber duckies like flash

drives somebody will pick it up put it

in the machine and in the show one of

the guards does that as the commands

within the flash drive are beginning to

take over his antivirus detects it and

stops it so that attack fails and one of

the beauties okay of mr robot is it

shows somebody failing in their attack

right i mean most shows don't show that

in reality hackers spend a lot of time

on failed attacks in earlier episode we

talked about the stuxnet attack and how

that took three years and it failed many

times during that three-year period and

they kept on updating it to get it to

work it's more realistic that you see

somebody actually failing which you

don't see in most movies and tv shows

with hackers they always immediately get

into the system in 30 seconds or less so

he fails initially so he has to come up

with a new plan just to ask you the

question that rubber ducky piece was was

real world is that right or close

it's real world yeah it's the rubber

ducky you can buy as you showed you can

buy them at what hack five has i think

yeah and but you can build your own

either way there you know you can do it

it's realistic and it fails because she

used a known exploit that was detected

by the av that's realistic if you use a

known exploit it's going to get detected

by the av now one of the things that she

might have done in this at this

particular point in time is she might

have gone ahead and tried to obscure the

exploit and try to get it past the av

she complained that she said hey i

didn't have time to do this you gave me

like an hour to do it and she's right

she couldn't build an exploit in an hour

well one of the things that was also

kind of interesting at this point is

that notice that elliott is trying to

ssh into the system that seemed kind of

odd to me because if i were doing it and

most hackers will do this is that

they'll put in a reverse shell that will

call back to him so instead of him

calling in they have a reverse shell

that'll call him and connect to him i

thought that was kind of unusual that

they they did it that way so elia's got

this problem now he's got hours just

hours to be able to take down

the prison system and so he still hasn't

figured out how to get inside the

network so he goes and visits vera in

the prison and he takes his phone with

him and he uses his phone to scan for

all the wi-fi networks so he's using his

phone

and those of you who have used aircrack

are familiar with this kind of scanner

there's a number of android and iphone

applications that'll do the same thing

and what you can see here is that he's

scanning on monzero so that's the

interface and notice that he's pulling

up it says essids

these are really the ssids these are

essentially the mac addresses of all of

the aps and the channel that they're in

and their encryption and of course their

power here he sees okay he goes back to

his phone he sees oh damn they're all

wpa2 it'll take me days to be able to

crack it and that's that's accurate you

can crack wpa2's but it's a

time-consuming process can't do it in 30

seconds or three minutes unless you

watch my video where i show you to do it

in 15 seconds

right exactly

exactly with a gpu you know it's exactly

right it really depends how lucky it

depends really to be able to crack wpa2

basically what you're doing is you're

trying to take a word list and match the

word list to the password of the system

if somebody's used a very weak password

you can potentially crack it in a matter

of seconds or minutes i mean if they've

used you know a password that's the same

as the essid you might be able to do it

in a matter of minutes but elliott looks

at it and goes realistically says i

can't do this i can't do this in hours i

need to find another way into the system

so he's trying to figure this out he's

actually walking out of visiting vera at

the jail and while he's walking out he

sees on his screen that somebody is

connected to

the internal network inside the jail and

it happens to be a police car so this

gives him the idea if i can get inside

of his system then i'll be inside of the

prison's network so the question is how

does it get inside the squad cars laptop

and that's where we get to bluetooth

just before we go there can i ask you

about the wpa thing just quickly so

reality versus movies which

phone would you recommend is it android

or android's gonna be the easiest to do

this kind of stuff or do you install

linux or something on a phone you can

either install you know there's net

hunter that is basically cali on a phone

or you can just there's applications you

can just download both for the iphone

and for android that'll do the scanning

like in this picture that we just put up

here it doesn't tell us what this is

what the scanner it is but there's a

number of them just go to the iphone

store go to the at the google play store

and look for wi-fi scanners and there's

a whole slew of them that'll do this

yeah so that's just showing you the

networks available it's not showing it's

not letting you crack them as all right

or there's a specific app that you would

use on a phone to crack at all i mean

it's going to take forever so you're

going to push that off to another to a

gp or something yeah what you want to do

is you want to capture the handshake

right so he's just scanning for the

networks and then if you're using kali

you want to go ahead and use arrow dump

and arrow dump will allow you to capture

the handshake between the client and the

ap and then once you capture that

handshake inside that handshake is the

hash of the password and that's what you

try to crack with he realizes that's not

realistic he can't you can't do that so

he realizes that the police car has a

dedicated cellular connection to the

network inside the jail he sees that

when he's walking out of the jail and he

sees that that police car is connected

inside that network immediately says oh

i have a path inside the network of the

jail the path is i have to get inside

the laptop inside the police car

that's more difficult than you might

think right maybe you do think it's

difficult and it is difficult right so

here's where you know things get a

little sketchy here he's using

hci config to scan for

the bluetooth connections and let me

show you how that works all right so

what i've done is i've just downloaded

blue easy it's out of the repository at

cali

and what it does is has multiple tools

in it for bluetooth hacking okay and

bluetooth manipulation what i've done is

i've got actually an external linux

bluetooth adapter in the system so once

i have these tools embedded uh then i

can go sudo and then it's hc this is

what elliot's doing in the show hci

config is just a tool similar to

ifconfig that'll pull up all of the

bluetooth connections and

there it is it shows me that my

bluetooth adapter and yours is probably

going to say down when you start so you

have to start it and do that you go sudo

hci config just like with ipconfig go up

and now you got it up and running you

can see here's the mac address okay

let's go back to the what uh did you say

you've got a dedicated uh bluetooth

adapter connected to your laptop i did

if you can give me the device name i'll

put a link below so people can go and

buy that if they want

this one is actually

a panda you can buy them on amazon or

egghead or any of the uh

various electronics stores so look for

ones that you know have bluetooth adapt

and bluetooth drivers for some of the

windows ones won't work some of them

will tell you they'll work in both i've

tried a number of them out and usually

the windows ones simply won't work in

linux so make sure you get a linux

bluetooth adapter if you're running on a

virtual machine like i am right now of

course you have to go ahead and attach

it so you got to go up here this is

virtual box got to go up to usb

and then make sure that see it says your

cambridge silicon radio that's the

chipset it's actually this is

manufactured by

panda i believe you also want to make

sure even before you get to this part if

you want to go ls usb to make sure

what's connected to your usb and you see

i've got this is what's connected to my

usb and here's my cambridge silicon

radio of course cambridge is a british

firm you see the ltd right there and

then let's go ahead and clear our screen

and so

sudo hci config this let's look what it

tells us it tells us is on a usb bus

it's a primary type the name just like

when you do ifconfig then it gives a

name to the adapter and the name is

hci0 yours might be hci1 it might be

hci2 but usually it's going to be hci0

just like your wlan is usually wlan0

your ethernet adapter is going to be

eth0 and then it gives you the address

this is the mac address of the adapter

so this is where he you see in the i go

back to what he was showing on the show

you can see right here hci config hci

zero up he has two adapters he's going

to the second one and taking it up as

well and then he's got hci config and

he's pulling up the information just

like what we've done here what we want

to do now

is that within this group of bluetooth

tools there's a tool called hci tool

i'll just show you what it can do pull

up the help screen and so of course this

is the help screen as we're looking at

right now and it'll display the local

devices okay inquire and these remote

devices it'll scan for remote devices

and this is the next step that elliott

does is that he goes and heads and uses

this tool

to scan for bluetooth devices in the

area and there's a number of other

things you can submit arbitrary hci

commands you can do inquiries

but right now we're going to kind of

just do what eliot did and that's what

he did is he went ahead and did hci tool

scan

and it begins to scan and what it's

doing is it's looking for other

bluetooth devices it pulls up one device

and this is a these are the speaker

system in my office let's go ahead and

turn on some other bluetooth devices and

see if we can

see them as well it's really impressive

that the show is so true though and i

can see why you like it

oh i i i love this show and so i'm glad

that uh

you uh had agreed to do the hacks

because there's a lot of great hacks in

this show no we've covered them all i

think so let's just ask the audience do

you want occupy the web to do like all

of them just put in the comments below

you know the ones that you really want

to see and we can perhaps prioritize

some over others i'm going to go ahead

and try and do another scan i just

turned on another another device

this is very similar to like i said any

type of scanning tool sometimes it's

going to work sometimes it's not but you

get the idea that it there we go okay i

just turned on another another speaker

system so this is what elliot's doing

he's going out and he's scanning for

these devices what he does is he finds

the device the bluetooth device in the

laptop of the police car then he does an

hci tool inquiry let's do that sudo

hci tool inquiry and this gives us even

more information about the devices okay

so it gives us the class and this is key

if you go to the bluetooth websites the

special interest group

website so here's the devices and these

are just the numbers okay and the

classes of all the devices and this is

kind of the key to

hacking bluetooth is to understand that

bluetooth devices are basically telling

us what type of device they are here's

another there's a better one i got

another one up here for you and you can

see the classes and the ones that we

just pulled up a minute ago right were

speakers these are all peripheral

devices so when you connect to a

bluetooth device it tells the other

device that's trying to pair with it

what type of a device it is is that a

wearable headset is a joystick for

nintendo like this one is here it's a

portable game controller it communicates

to the other device what it is notice

that this one here is a keyboard its

device is class zero zero two five four

oh that means when you connect to this

bluetooth device it says i'm a keyboard

allow me to send keystrokes okay into

your system and there's really no way

for the system to check if that's real

or not so this is what elliott takes

advantage of in the show he uses a

device called multi-blue they don't

manufacture them anymore unfortunately

but basically what it is is this base

it's a bluetooth device that

communicates okay that i am a keyboard

if you have a bluetooth based keyboard

i'm working on a bluetooth keyboard

right now in this show that's what this

device does okay it says i'm a keyboard

let me send keyboard keystrokes to you

the other end of the connection elliot

uses this which used to cost i think i

bought mine for about 35 dollars but

basically once again it's a bluetooth

dongle that has been basically flashed

with a different class okay a class that

says hey i am a keyboard so elliot what

he does is that he gets darlene to kind

of flirt with the cops it's social

engineering elliot is standing is in a

car nearby okay bluetooth has the

capability of connecting up to like a

hundred meters he's within that range

and he's able to connect to the

bluetooth device in the police car he

uses a tool called spooftooth it's also

i believe spooftooth is in the

repository so let's just quickly take a

look and see if it is and let's put in

install in there there it is it's

already installed on my system just like

you can spoof an ip address so you can

spoof a mac address it allows you to

spoof

a bluetooth device so what elliott does

is that he goes and spoofs the mac

address of one of these devices in the

policeman's car does a scan like we did

here he gets the mac address off the

bluetooth in the cop car and then he

spoofs it okay here's the synopsis

bluetooth dash i device and then specify

a new bd addr right that's what we want

to do let's go ahead and create this

it's pasting in the mac address and then

it's the uh

dash n for name right here specify the

new name okay dash in and then it's

going to be car

five five three seven so what we're

doing is we're assigning a new mac

address and a new name for that device

and you see it came back and said hey

address has been changed oh

and it came back we said the address was

changed but it can't open the device no

such device it dropped the device it

looks like so let's try reconnecting it

again yeah see it's dropped the

cambridge silicon radio let's go ahead

and try that again

i think the lesson is like you've always

said it's um stuff doesn't work

perfectly the first time that's reality

versus tv yeah exactly yeah this is and

this is actually a notice here that it's

down when i want to reconnect it again

it's down

so what we have to do is go

hci config

i

zero

up

all right

okay now when i do hci config you'll see

that it's

reality and that's i'm glad to see you

doing this because it

it's reality for all of us yeah yeah so

there it is up and running all right so

we're going to try this command again to

be able to spoof this so we're going to

go ahead and run the hci tool and then

we're going to scan

one of the things that i have found is

that by using a here we go we got both

of those devices sometimes the virtual

machines will drop the devices that are

external okay and that's what we're

dealing with here but so we got both of

them up we scanned imagine that one of

these is car 57 all right and then what

we're going to do is then we're going to

try to

spoof it we're using hci 0 as our device

name this is the mac address we're

trying to spoof and we're going to name

it car 357 hopefully virtualbox doesn't

drop our adapter let's go ahead and do

it it just dropped it i could hear the

sound of it dropping it it did change

the address you can see that the device

has been changed to

7c 96d208

and if we didn't drop the adapter we it

would also rename it so that it appears

not only does it appear technically by

the mac address but it also has a name

that is recognizable human readable name

that would be recognized by the police

officer so this is the way that he goes

ahead and spoofs the bluetooth device

now this particular hack was done in oh

about 2014 and some of the early

bluetooth you could do this type of

spoofing in the more recent bluetooth

you're going to have more difficulty

doing this because they're going to be

able to spoof it you're going to have to

pair them and even though you spoofed

the device name in the mac address

you're still going to have to pair them

so there's going to be one extra step

there that they don't show in the show

so he's now got himself inside the

police car's laptop so was he spoofing

the the keyboard is that right and uh

that's what he was trying to do is that

correct he's he's taking the keyboard

that multi-blue device and he's making

the laptop believe that it's a bluetooth

device that's already connected to his

system because normally when you want to

connect a bluetooth device you have to

pair it right you have the pairing

process

what he's doing is saying okay i am the

device that's already been paired on the

laptop and then once he has that pairing

taking place now he can use this device

to inject commands into the cop car's

laptop and that's where things get

interesting and maybe a little bit

unrealistic so what he's doing now is

that now once he's inside the cop car's

laptop he's inside the network of the

detention center of the jail so now what

he has to do is he has to be able to

inject commands into the prison the jail

to be able to open up the doors this is

a little bit unrealistic normally what

you would do in a situation like this is

you would go and you would find the

wiring diagram for

that particular device and they're

almost all online there's a block

diagram of the plc these are almost all

the same the diagram is the same here's

a here's the one that's often used in

the prison system this is a siemens

cymatic s7 1500 which was actually the

same one that was used in the

stuxnet attack so that's what was used

to open and close the doors in the

prison in the movie so called yeah this

is what's open and closed the doors in

the prison right so these are just

programmable logic controllers this is

one of the most widely used in the world

here's a prison diagram this is a

typical prison diagram each one of these

are housing pods and then there's an

equipment room which usually contains

these plc's and a con central control

inside this equipment room this is where

the plc's are and they control the

opening and closing of the doors in the

prison now all of this kind of

information is available online if you

look in the right places no matter who's

making these devices they provide this

kind of detail

about their systems so that the users

can program them properly maintain them

properly this is basically a simple

diagram of the opening and closing of

the doors within this prison elliot

could do this right but it still would

have taken him days weeks months to do

this process and he does it in a matter

of hours it is possible it's out there

right if you go to the you know you go

to the manufacturer's websites and

usually this will be included in a

document that'll be like 150 pages long

a pdf document that you can go ahead and

dig through and figure out how these

systems actually work and then the next

step he has to do is that he has to go

ahead and write a ladder logic program

to control the plc's ladder logic looks

something like this here

i teach ladder logic in my scada class

and we use a trilogy which is a

training

educational software for doing ladder

logic this is simple logic to run the

various devices in a plant so you're

reading a device waiting for the

information to come then you're opening

a valve or closing a valve this

particular circuit right here is running

it and then it takes a step through and

it waits five seconds on the clock and

then it makes a manual decision okay

either open or close and it finishes

that circuit and then it goes through

another it goes through each one of this

is called ladder logic because it goes

through this circuit and then this

circuit and then this circuit so this is

really relatively simple stuff the only

issue is that you have to understand

what circuits you're actually working

with within the system and that's why

it's really unrealistic to expect that

elliott did that in a matter of hours

one of the things that could be done

okay is that you could just throw

scatter a bunch of commands into the

system and see what happens right that's

a possibility but that would probably be

detected now i will just kind of give

you a hint that you know that's

something that can be used in cyber war

is that you can just send random

commands into these systems and see what

happens and if it explodes then you know

you did the right thing

what's unrealistic about that is he's

connected via this uh bluetooth keyboard

or a fake keyboard and he's injected

he's injecting a whole bunch of stuff

with no visibility of what's on the

other side is that right right he has

the only visibility he has is that he

could pull up this schematic this would

be available to him he could pull this

up online and find the schematic and you

can see that all the circuits are

detailed here as you can see door fully

open l3 ls3 ls2 is device fully locked

ls4 is the door fully closed and then we

have speeds our

ls5 and ls6 so this is available to him

online but then he has to write the

ladder logic to be able to control each

one of these various circuits to be able

to open and close the doors and notice

that in the show he talks about well

let's open up all of the doors and that

way nobody nobody will be able to

connect this to me or you all this

information is usually available online

this is available for one particular

prison system that i found online it's

crazy that you can just find this stuff

they've got to do this for their clients

right and no matter what plc you're

talking about whether it be siemens or

schneider electric they have these these

diagrams these pdfs online that give you

a total breakdown of how the system

works let's take a look at one of the

things that one of the things i did is

use some google dorks to find some of

those cymatic plc's here's the dork i

used right here in url portal portal

mwlf mwsl these are plc's that are

connected via tcpip right that's why we

can connect to them we can go ahead and

find these things online and let's find

this one right here here it is anybody

anywhere in the world can connect to

this s7 1200 remember the one we looked

at a little little while ago was the s7

1500 it's a similar model not exactly

the same but we can go ahead and look at

its diagnostics we can get its serial

number so we know exactly

what plc this is we know its hardware

number we know what firmware is running

and this is without even logging in you

literally just typed something in google

and you found this yeah exactly just

here it is right here it's just

used when you go back and show you just

for everyone watching i've had to blur

this because of youtube rules so upload

a lot of this

but the information is there no don't

worry we'll just blur it out we didn't

hack it okay this is this is available

to anybody this is just the portal that

the plc provides to its users and so

what we're doing is just using the same

portal and notice that we haven't logged

in right this is what's into this is

what's available it's like a website

yeah it's like going to a website

exactly i haven't logged into the

anything okay you see it looks like this

is

a check system that looks like check to

me so it's it's amazing that all of this

stuff is addresses it's crazy

yeah

and here's the watch tables

user-defined pages the home page of the

application okay takes us back to the

plant so we can get more information

that looks like check to me i don't know

but i don't read check but it looks like

it in any case so here's this is just

one siemens and this is one that is has

the portal available to for the

maintenance and control of this

particular plc i don't know what plant

this is connected to but these are

available online for anybody who wants

to go ahead and read them so this puts

the here it is looks like it's farmer

custom fructo plant i guess this is all

going to get blurred out

yeah we'll have to blur it out but i

think the the point is on the previous

video where we spoke about skater we had

some comments like we don't connect our

skater systems to the internet and

you've just shown

like there there's one straight away it

took you like five seconds yeah yeah

there there are millions of them

connected to the internet now

i give the people who said that credit

that theirs are not okay so some plants

are not but most of them are online like

the prison the prison is offline for

good reason right

you know the prison so that's what made

elliot's job so much more difficult is

that he had to get inside the network

but many of them you don't have to get

inside the network not only can you see

them through their portal but you can

connect to them through their

maintenance

port and send commands in and be able to

read memory so you can pull out the

memory contents you can send commands in

to many of them and so this is why i'm

so concerned about scada is that so many

of these facilities are online and

they're not well protected and this is a

good example of one that anybody could

go ahead and just pull up online and

there's literally millions of them and

you can use showdown to find them you

can use you know google dorks to find

them and you can connect right to them

and and pull all the information you

need to be able to then go ahead and

study how they operate get the

schematics for it and then be able to

read its memory and many of them you can

read their memory and get the passwords

that are built into memory just like

mimikats so mimikatz if you're not

familiar with it folks is a tool that

allows you to pull the memory out of

windows system and once you pull out the

memory on a windows system mimikatz then

can parse out the password in memory the

same thing applies here is that once we

are able to pull the memory out of these

systems then we can pull the password we

can parse out the password from memory

so these systems are all vulnerable not

all of them let's

be clear many are vulnerable to attack

and russia is learning this at the very

moment at this very moment russia is

learning how vulnerable their systems

are to this type of attack for everyone

watching um obviously because of youtube

we can't show everything here but you

cover this in your courses don't you i

do yeah and we have this course coming

up in september so i usually teach this

course once a year it's kind of one of

the specialty courses that we offer at

hackers arise is

is one i teach you what how these plc's

work so you have a understanding of how

they function and then we look at

various ways that they can be exploited

and then also how you can make them

safer and there's many ways of

exploiting these systems and one of the

things that we haven't even talked about

is that because these systems usually

cover many acres

sometimes miles

kilometers right there has to be

communication across these vast

distances oftentimes the communication

methods whether it be wi-fi or cellular

or what have you are also vulnerable to

being hacked once again the issue that

eliot had was that he couldn't get

inside the network so even if the

system's offline okay say the system is

offline and if it's a system that has to

cover vast distances and like most of

these facilities do they're huge plants

they have to communicate and running

cable isn't real isn't realistic okay

especially running cable in a system

that has a lot of emi so what they do is

they use various communication

technologies to communicate the

different parts of the facility and

those communication technologies are all

not all

many of them are vulnerable to attack

once you're inside the communication

then you're inside the facility you're

inside the network and then you can

literally send commands inside of the

plant and wreak havoc i'd love to show

more of this on youtube but you know i

don't want to lose my channel so i would

suggest all of you go and

go look at hackers arise um you've got

occupy the web you've got a bunch of

stuff like in like blog articles and

stuff on your website where people can

see some information or they can sign up

for like your subscription is that the

37 dollars a month thing it's

32.99 a month to take the live courses

and the scada hacking course is included

in the live courses that are coming up

in september so you can sign up and

they'll get you into that course

we have metasploit coming up next month

we have web app hacking coming in july i

don't remember what we have in august

but we do have scada coming up in

september i think for everyone who's

watching please give us feedback what

would you like to see from mr robot or

other types of hacks i think one that

we've had feedback on was this the

hacking cctv one

a lot of people were saying like show us

a demo so maybe we can put up a camera

somewhere or you've got some cameras and

we can show how to how to actually do

the practical part of like cctv or ib

camera hacking rather than just um you

know talking about it

i can show you some real real cameras i

can hack

yeah the problem is i can't show that on

youtube that's that's the frustration

it's like i'd love you to do it but i

mean if you um if it's a system that we

have permission to look at or it's a

system that we own then we can then we

can demo it i know you you can do this

but i mean

we've hacked a lot of cameras in in

ukraine and

i try to put one of those up every day

on my twitter account for people to see

mostly i put it up there for the

russians to see okay the idea is is hey

look at we can we can watch you okay we

can see you if you continue your bad

behavior then we will be able to focus

on your faces and bring this to the

international criminal court it's it's

not that hard to do you know what we

need to do is maybe set up a lab so we

can do it actually for the youtube

channel i have a student who has a who

has volunteered his lab so we'll have to

make arrangements with him yeah that'd

be great if we can do that in another

video unfortunately we cannot hack

anything that we don't have permission

to attack so for our next video have you

which um which uh mr robot do you video

or show would you would you like to

cover or which technology would you like

to cover we can do some steganography

where he hides all his data in his cds

you know i thought one of the most

intriguing ones at the end of the show

when he traces the dark army so he uses

memory forensics to be able to trace the

dark army that was a good one that was

really complex you know it's not going

to necessarily be interesting to a lot

of people but i liked it you know what

people might like is using the raspberry

pi where he goes inside of the storage

facility and he connects a raspberry pi

into the uh hvac system we said what

they're like 40 hacks or something we

can go through so there's a lot vote

vote for those two

but okay everyone who's watching can

vote for something else let us know what

you want what people also like is the

is how angela stole used mimikatz to

steal her boss's

password and one of my favorites is how

elliott hacked the cell phones of the

fbi which actually is

a good one yeah i like that that's

that's not hard to do really so what he

did is that he used a device that acts

as a cell tower they put it under one of

the desks and the fbi was in there doing

their work and they connected to the

cell tower and he was able to listen

into all their conversations and

surprisingly it's not that difficult if

you have physical access near the person

that you're trying to hack and they were

able to intercept all of the phone calls

to me that the power of being able to

intercept phone calls is really

and that's a lot of power

and it's one that people don't realize

how easy it is to do i think we've got a

lot to cover we've got a lot of cover

yeah we've got a lot to cover right and

one of the things at some point in the

future i'd like to do with you is this

software-defined radio yeah i really

like that actually yeah software defined

radio be great yeah yeah and we're doing

a class in software-defined radio in uh

july yeah we can we can do like maybe a

a simple software defined like intro to

software-defined radio and real

basic stuff and then maybe do later on

do a more advanced one okay by the web

i'm going to keep you busy for a long

time really thank you for sharing your

knowledge i appreciate it i enjoy it

thank you thanks for having me so

everyone look forward to a whole bunch

of mr robots uh sort of videos coming

give us your feedback stuff that you'd

like to see i think we've got a long

list

and

hope you enjoy

[Music]

you