Jeff Melrose CISSP-ISSEP, CEH, GICSP
Sr Principal Tech Specialist
Yokogawa USA

Graphic by Scott Schober

Co-innovating the future ofIndustrial Controls, Sensorsand Networks
Photo by Jeff Melrose

Jeff is the Principal Technology Strategist for Cybersecurity at Yokogawa aleading Industrial Control Vendor. Before Yokogawa, Jeff was a Principal
Security Engineer at both Lockheed and Raytheon designing secure unmannedsystems for the US Military and US Intelligence Community.
Mr. Melrose has over 20 years of experience in Computer Security. He has anMS in Mathematics and holds the Certified Ethical Hacker (CEH), Certified
Information Systems Security Professional (CISSP), Information Systems
Security Engineering Professional (ISSEP) and Global Industrial Control Security
Professional (GICSP) certifications.
Jeff is also a member of AFPM, ISA99, IEC Cyber Security Task Force andISC(2).

-BlackHat 2016 -Page 2BlackHat 2016

Motivational Video Introduction to Cyber Physical Electronic Threats Electronic Warfare Overview
 Recent Electronic Jamming incidents
 Distance as a Weapon for Drones Drone Threat Scenarios Practical Drone EW-Cyber Defensive Strategies
-BlackHat 2016 -Page 3

BlackHat 2016

Source: excerpt fromhttps://www.youtube.com/watch?v=6Viwwetf0gU-BlackHat 2016 -Page 4

BlackHat 2016

Illustration by Jeff Melrose-BlackHat 2016 -Page 5BlackHat 2016

U.S. NIST Defines - Cyber Physical systems are“smart” systems that are co-engineered interacting
networks of physical and computer components.

Example: Industrial Control Systems and Networks

Graphic by NIST

-BlackHat 2016 -Page 6

BlackHat 2016

You don’t worry
about a chainsaw
100 ft away
But 1 foot away?

Security Assumption

Drone Reality
Drones can allow an adversary tomanipulate at long distance -An Adversary needs to bewithin physical proximity to now a hobby drone can travel 3
do major harm
miles
Physical security can be
minimized inside the plantboundary-BlackHat 2016 -Drones can tailgate workers aseasy as people now –many drones can now navigate
easily inside buildings

Page 7

BlackHat 2016

-BlackHat 2016 -Page 8BlackHat 2016

Illustration by Jeff Melrose-BlackHat 2016 -Page 9BlackHat 2016 Electronic warfare (EW) is any action involving

the use of the electromagnetic (EM) spectrum
or directed energy to control the spectrum,attack an enemy, or impede adversaryoperations.
 Useseither◦ Electromagnetic Spectrum◦ Directed Energy

EW Chainsaw

Illustration by Jeff Melrose-BlackHat 2016 -Page 10

BlackHat 2016

The electromagnetic (EM) spectrum is the range of all possible
frequencies of electromagnetic radiation.
The electromagnetic spectrum extends from modern radio
communication to gamma radiation.
◦ So it includes radio, microwave and visible light -and LASERS
Visible light

Source Wikipedia
https://en.wikipedia.org/wiki/Light#/media/
File:EM_spectrum.svg-BlackHat 2016 -Source Wikipedia
https://en.wikipedia.org/wiki/File:Light_sp
ectrum.svg

Page 11

BlackHat 2016

Electronic Attack

Source Wikipedia
https://en.wikipedia.org/wiki/Laser#/media/File:LASER.jpg

Electronic Protection

Source Wikipedia
https://en.wikipedia.org/wiki/Faraday_cag
e#/media/File:Heimbach__power_plant_07_ies.jpg

And The other EW Vulnerable System- GPS◦satellites use frequencies, 1.57542 GHz (L1signal) and 1.2276 GHz (L2 signal).

Electronic Support

Source Wikipedia
https://en.wikipedia.org/wiki/Scanner_%28radio%29#/media/File:Uniden_BCT-15_deck_in_bracket-left.jpeg

ElectronicWarfareCyberSome would
Say Cyber and EW
Are merging
Source Wikipedia
https://en.wikipedia.org/wiki/
Global_Positioning_System#/
media/File:GPS_Satellite_NA
SA_art-iif.jpg-BlackHat 2016 -Page 12BlackHat 2016

Illustration by Jeff Melrose-BlackHat 2016 -Page 13

BlackHat 2016

San Diego Harbor 1999 —A U.S. Navy radar test created EMI which affected 928.5 MHz
wireless communication from SCADA systems and connected valves controlling San Diego
Water Authority and San Diego Gas and Electric.
A similar incident in 2007 led to GPS and other wireless services were significantly disruptedthroughout San Diego, Emergency pagers stopped working, Harbor traffic-management system
guiding ships failed, Cell phones failed, ATMs failed. Found to be two Navy ships in the harbordoing a jamming training exercise

Newark Airport 2013 —The FCC fined a Readington, NJ, man nearly $32,000 after it traced aproblem with Newark Liberty International Airport’s satellite-based tracking system to his truck.
The man had purchased an illegal GPS jamming device for about $100 and installed it in hiscompany-owned pickup truck so his boss could not monitor his movements. Disrupted groundbased augmentation system (GBAS) which uses GPS (1.2276 / 1.57542 GHz).

Den Helder, Netherlands, late 1980s —A gas pipeline control system located near a naval
base found a 36 inch valve was opening and closing with the same frequency as the scanningof an D/L-band radar (1.215-1.4 GHz) system in the harbor. Shock waves induced by the rapid
valve movements caused a pipeline rupture.

-BlackHat 2016 -Page 14

Illustration by Jeff Melrose BlackHat 2016

-BlackHat 2016 -Page 15

BlackHat 2016Physics students should be familiar withthis equation◦ Radio propagation and signal strength: distance is a factor.
 The closer a “Transmitter” can be to the target
network, the more effective it isIllustration by Jeff Melrose◦ Hence the possible use of a DRONE to move theTransmitter/Disrupter close to the target.
X-BlackHat 2016 -Page 16

BlackHat 2016



Drone Logistics◦ Typically flight time is 25 min◦ Camera default payload◦ But can carry small
computers like RasberyPI /cell phones ~1.5 lbs
In just 3 MONTHS this data
◦ Range is around 1000 yardsbecame obsolete !!!
But could be farther***◦ Speed avg 30 mph


In March 2016 DJI released the
But could be FASTER***
Phantom 4 Drone• ~3 mile control limit• can24-28 minute flying time
Most models• 45 mile per hour top speed
Traverse range• TARGET TRACKING CAPABILITY

limit in 1 minuteDrone capabilities evolving rapidly-BlackHat 2016 -Page 17Source The Remote Control project is a
project of the Network forSocial Change hosted by Oxford
Research Group.

BlackHat 2016

It’s aDisrupter-BlackHat 2016 -A disrupterhelps us testfailure modes
at closer
distancesPage 18

BlackHat 2016

Photo by Jeff Melrose-BlackHat 2016 -Page 19

BlackHat 2016 Hmmm…. It’s lame but…

And – It was pretty EASY to hover thedrone and drop on a disrupter
Hobby Drones are able to hover and
do Fine Control movements inmoderate wind conditions!
Photo by Jeff Melrose-BlackHat 2016 -Page 20

BlackHat 2016



Yes they can follow autonomously…
 And now can Image Target Track MOVING TARGETS-BlackHat 2016 -Page 21

BlackHat 2016

Given the EW Incidents mentioned previously (San Diego andDen Helder).
 Equivalent ASR/EW System Power of approximately
1 gW (I so want to say 1.21 Jigga Watt here) Range Effect - San Diego Harbor was impacted at a defined
distance (Assuming Naval Base San Diego was origin)
 An example “Yammers from Dhina” unit states that their
Effective Radiated Power is 3 Watts with a range of 50 feet

It rhymes with
“Yammers fromDhina” folks!

Photo by Jeff Melrose-BlackHat 2016 -Page 22

BlackHat 2016

0.015

Drone Power

Navy Power

0.01

0.004
0.003
0.002

0.005
0Watts0.001
0Watts5152535 45 55 65
Distance in meters

7585

95
Distance in meters
Navy Power

Drone PowerAnd the answer is a “transmitter” has to get withabout 8.66 meters to be able to cause anequivalent effective range of EW system◦ * and this corroborates effects we have seen at ~10 Meters◦ * ~100 meters+ is problematic-BlackHat 2016 -Page 23

BlackHat 2016

-BlackHat 2016 -Page 24

BlackHat 2016 'MouseJack' Attacks Hack Wireless Keyboards And

Mice From 100 Meters (Forbes Feb 23, 2016)◦ Researchers have exploited a range of vulnerabilities
in wireless keyboards and mice, taking control ofthem from up to 100 meters away. The researchers,from Internet of Things security start-up Bastille,
focused on a range of dongle-linked devices fromLogitech, Dell , Gigabyte, HP, Lenovo , Microsoft andAmazon Basics.
But with a DRONE RELAY…
this attack could be mademiles away
-BlackHat 2016 -Source https://theparallax.com/2016/02/23/mousejackexploit-affects-billions-of-wirelesskeyboards-mice/

Page 25

BlackHat 2016 Yes!… but there is a problem -Observation – Modern hobby drones utilize the 2.4 Ghz spectrum as
does WiFi, 802.15.4 etc. So any disruption needs to be away from thedrone and controller due to possible loss of control.
◦ Hack for this is to utilize a Tethered Electromagnetic Transmitter.

XX-BlackHat 2016 -CrashFly!

Page 26

BlackHat 2016



Yes! – Field Wireless Transmitter test

-BlackHat 2016 -Page 27

BlackHat 2016 Yes! – Field Wireless Gateway test***Note – Results were 5-10% packet loss due to weak commercial transmitter,concept demonstrated
Interesting Observation – This attack is not limited to 2.4 Ghz it could
also be used in the 1.57542 GHz (L1 signal) and 1.2276 GHz (L2 signal)
For GPS!!! Thus potentially impacting
Telematics and Autonomous Vehicle navigation systems !!!
-BlackHat 2016 -Page 28

BlackHat 2016

Photo by Jeff Melrose-BlackHat 2016 -Page 29

BlackHat 2016

Graphic http://www.qualitymag.com/articles/91465wireless-measurementdata-acquisition

The 2.4-2.835 GHz Spectrum is VERY crowded. It is used by◦ WiFi/WLAN◦ Bluetooth◦ 802.15.4 (Industrial Wireless – ISA100, WirelessHART, ZigBee)

Since WiFi 802.11 is the major wireless target jammers will
leave GAPS in EMI between WiFi channels 1,6,11
 Therefore 802.15.4 users should channelize to 802.15.4
Channels 15, 25,26 (14*, 20** - note 802.15.4 channel numbers)◦ But unfortunately there will be no gaps with a Bluetooth interference***-BlackHat 2016 -Page 30

BlackHat 2016 Multiple redundant telemetry

and sensor routes need to besupported

But this will most likely Impact
BATTERY Life of field devices due torepeating overhead
Graphic by Yokogawa

Graphic by Yokogawa-BlackHat 2016 -Page 31

BlackHat 2016

EMI effects like RF reflection
around metallic structures liketanks and vessel reactors
should be utilized for multi-pathsupport
 Use of Repeaters needs to beconsidered from high vantagepoints
 EM and Spectrum surveys
should be incorporated intoplant security procedures.


Yokogawa has excellent guidance on this guidance is named “An Excellent
Method to Lay Out ISA100.11a Field Wireless Devices” and is located at

https://www.yokogawa.com/rd/pdf/TR/rd-te-r05502-009.pdf-BlackHat 2016 -Page 32

Graphic by Yokogawa

Graphic by Yokogawa

BlackHat 2016



Police your Fresnel Zones!
◦ A Fresnel zone (fray-NEL), is a seriesof concentric ellipsoidal regions
indicating wave strength between twoantennas.

Graphic by Yokogawa

Drones can interfere with Fresnel
zones so like fences and doors
physical security should notethese… because could land inFresnel Zones and performpersistent interference.

-BlackHat 2016 -Page 33

BlackHat 2016

THE END-BlackHat 2016 -Page 34

BlackHat 2016