internet accessible ics in japan (english)
DESCRIPTION
Dale Peterson of Digital Bond gathered reports and examples from Shodan researchers to quantify and describe ICS devices that are connected to the Internet in Japan. It is not a small number and some of the examples are compelling.TRANSCRIPT
![Page 2: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/2.jpg)
Is Internet Accessible ICS A Problem?
• To critical infrastructure and society in general?– In the US, no– In other countries, some yes and some no
• Hydroelectric Dam in France– In Japan, needs further investigation, but likely
no• To individual companies
– Yes, clearly YES– In the US, in Japan and everywhere in the world– Insecure by design ICS connected to the
Internet can be exploited. Only limit is the input/output.
![Page 3: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/3.jpg)
Scanning the Internet for ICS
• You can use or build your own scanner– Example: Project Redpoint discussed yesterday
• You can use a search engine for Internet connected devices … Shodan– http://www.irongeek.com/i.php?page=videos/
showmecon2014/1-10-inside-the-worlds-most-dangerous-search-engine-john-matherly
– HD Moore’s Project Sonar– Project Shine– Private efforts
![Page 4: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/4.jpg)
Shodan
“I crawl the Internet every month”
“Modeled the output after Google Maps”
“Tracking 550 million devices”John Matherly
http://www.irongeek.com/i.php?page=videos/showmecon2014/1-10-inside-the-worlds-most-
dangerous-search-engine-john-matherly
![Page 5: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/5.jpg)
https://ics-radar.shodan.io/
![Page 6: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/6.jpg)
![Page 7: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/7.jpg)
https://www.shodan.io/report/wKyGlXWq
![Page 8: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/8.jpg)
![Page 9: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/9.jpg)
![Page 10: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/10.jpg)
![Page 11: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/11.jpg)
![Page 12: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/12.jpg)
Searching Banners
• Many ICS devices have web, ftp, ssh, snmp and other IT protocols that Shodan searches
• Create a search string and find devices
![Page 13: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/13.jpg)
![Page 14: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/14.jpg)
![Page 15: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/15.jpg)
![Page 16: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/16.jpg)
Combining Search Techniques
• EtherNet/IP search identified a device in Japan– But no useful information came back
• A secondary search of the IP address found an FTP server and banner– It’s a Yokogawa device, Data Management
Device for a paperless recorder• The FTP server allowed anonymous FTP
– PERL Data Language file (PDL)– Data Display File (DAD)
![Page 17: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/17.jpg)
Further Analysis
• PDL files has names/email addresses– Belongs to major energy and mining company– Could use these emails in spear-phishing attack
• Tags / Points– ST1, 沈砂池川側水位 – ST2, 沈砂池山側水位 – ST3, 三号開渠水位– ST4, 川側 電流レーキ
![Page 18: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/18.jpg)
Let’s Find Some CC-Link
• CC-Link originally developed by Mitsubishi and is widely deployed in Japan– Now a standard run by the CC-Link Partner
Association• CC-Link IE does not use IP (or even Ethernet)• So you can’t use Shodan to search directly
for it
![Page 19: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/19.jpg)
Maybe There Is A CC-Link Gateway
Anybus
![Page 20: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/20.jpg)
https://www.shodan.io/search?query=Anybus+country%3Ajp
![Page 21: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/21.jpg)
What Should You Do?
• Asset Owners– Search Shodan for your IP address space
• Vendors– Search Shodan for your products– A nice service for your customer
• Industry Group(s) / CERTS / Others– Find ICS assets on the Internet and notify
owners
![Page 22: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/22.jpg)
Thanks
• John Matherly and Shodan• Eireann Leverett
– http://www.digitalbond.com/blog/2012/02/09/s4-video-denial-of-surface-ics-on-the-internet/
• Stephen Hilt • A number of anonymous researchers
![Page 23: Internet Accessible ICS in Japan (English)](https://reader035.vdocuments.net/reader035/viewer/2022062313/55762267d8b42a4e1c8b4d8c/html5/thumbnails/23.jpg)
Questions