Seek out new protocols, and boldly go where no one has gone before

The talk argues that proprietary protocols get too little scrutiny from both attackers and defenders, especially in critical infrastructure and medical devices, where protocols are often decades old and hard to patch. Douglas McKee lays out an eight-step process for dissecting such protocols and covers four of the steps: simplifying scope, embedded networking, enumerating patterns, and application reverse engineering.

Working through a capture from a medical monitoring protocol, he groups a few hundred packets by payload length and destination port, which reduces them to a handful of representative packet types, and checks that the grouping holds across several captures. He points out that IP addresses and port numbers are often repeated inside payloads, and shows a field that increments by fixed steps and decodes to a timestamp. He then inspects the server side in a disassembler, where leftover debug strings helped reveal a reporting interval. On the offensive side, he shows that padding bytes can carry hidden data and that replaying modified packets can falsify readings. On the defensive side, he uses an AI-assisted STRIDE tool and attack trees to find choke points, and converts a Scapy layer into a Spicy parser so Zeek can log the decoded fields.

The main takeaway is to document findings in reusable code, since the same parser can serve testing, logging and baselining. He also notes that vendor fixes in regulated industries can be slow because changes may require recertification and replacing deployed devices.