Organizer
Partner Company
Techniques of Attacking Real SCADA & ICS Systems
SCADA StrangeLove
Abstract
This talk will share SCADA StrangeLove team experience in penetration testing in ICS environment. From network level to application and from 0-day hunting to project management. Toolkit/tip and tricks/real world examples. What you should do and what you do not ever have to do. SCADA StrangeLove hopes this talk will help you to win Choo Choo Pwn prize.
- Tilting at windmills: ICS pentest project management
- ICS security assessment projects goals: declarations and reality
- Thread modelling: traditional vs ICS
- Between Security, ICS team and Vendor
- Choosing the right approach: from hardcore hacking to paparazzi-style audit
- Playing with networks
- ICS protocol overview
- Toolkit
- Cases
- Rooting the PLC: don't even try
- OS/DB/Application
- Why you don't need Magic SCADA Exploit Pack
- How to find SCADA 0day
- Toolkit
- I'm the Lord of the SCADA
- Ok, I god it. What can I do?
- Owning ICS stuff
- Hunting the operator: ICS network "forensic"
- Jumping to business level
- Knockin 'on management team
- BUZZness case: fraud, shmaud and figaud
- Pentest to regulatory compliance mapping
- Ashes and Hopelessness
Speaker Info
SCADA StrangeLove
SCADA StrageLove is a group of security researchers focused on ICS/SCADA security to save Humanity from industrial disaster and to keep Purity Of Essence. In spare time. During working hours we works for research/security assessment in Positive Technologies.