scada-vulnerabilities

name	SCADA Vulnerabilities
description	Industrial control system security — Modbus, DNP3, IEC 104, Ethernet/IP, PLC exploitation, control logic manipulation, sensor/actuator attacks, ICS protocol analysis
tags	["scada","ics","industrial","control-system","modbus","dnp3","plcs","security","critical-infrastructure","OT","operatortechnology","hmi","plc","rtu"]
author	Spectra Security Research
version	1

SCADA Vulnerability Analysis

Overview

This skill analyzes industrial control systems (ICS) and SCADA environments for vulnerabilities in protocols, PLC logic, sensor/actuator controls, and critical infrastructure components.

---

⚠️ Authorized Use Only

Permitted Contexts:

• Authorized ICS security assessments
• CTF competitions (ICS-themed)
• Educational research in isolated environments
• Red team exercises with explicit permission

Prohibited:

• Unauthorized access to critical infrastructure
• Production ICS system testing without permission
• Any testing that could affect safety systems

---

Analysis Phases

Phase 1: Protocol Analysis

1.1 Modbus TCP/RTU

# Modbus TCP default port: 502
nmap -p 502 --script modbus-discover <target>

# Modbus function codes to probe:
# 01: Read Coils
# 03: Read Holding Registers
# 05: Write Single Coil
# 06: Write Single Register
# 15: Write Multiple Coils
# 16: Write Multiple Registers

# Python Modbus probe
from pymodbus.client import ModbusTcpClient
client = ModbusTcpClient('target')
client.connect()
# Read registers (address 0, count 10)
result = client.read_holding_registers(0, 10)
print(result.registers)

Vulnerability Indicators:

• No authentication (default)
• Plain TCP (no encryption)
• Write operations enabled
• Critical registers writable

1.2 DNP3 (DNP3.0)

# DNP3 default port: 20000
nmap -p 20000 --script dnp3 <target>

# DNP3 structure analysis
# Function codes:
# 0x01: READ
# 0x02: WRITE
# 0x03: SELECT
# 0x04: OPERATE
# 0x0B: AUTHENTICATE

# Check for authentication bypass
# DNP3 supports challenge-response but often not enforced

Vulnerability Indicators:

• No link-layer authentication
• Secure Authentication (SA) not enabled
• Write operations allowed
• Master station impersonation possible

1.3 IEC 60870-5-104 (IEC 104)

# IEC 104 default port: 2404
nmap -p 2404 <target>

# IEC 104 structure:
# Application layer: ASDU (Application Service Data Unit)
# Control field: balanced or unbalanced

# Common vulnerable functions:
# 45: Single command
# 46: Double command
# 49: Setpoint command
# 58: Measured values, normalized

1.4 Ethernet/IP (CIP)

# Ethernet/IP default port: 44818
nmap -p 44818 --script enip-enumerate <target>

# Common Logix (Rockwell/Allen-Bradley)
# CIP Identity, CIP Read, CIP Write

# Check for exposed tags/registers

---

Phase 2: PLC Memory Exploitation

2.1 Memory Layout Analysis

# PLC memory types (Modbus model):
# Coils (0x): 1-bit read/write
# Discrete Inputs (1x): 1-bit read-only
# Input Registers (3x): 16-bit read-only
# Holding Registers (4x): 16-bit read/write

# Memory exploitation examples:

# 1. Coil manipulation (0x01/0x05)
# Can turn on/off actuators, start/stop processes

# 2. Register manipulation (0x06)
# Can change setpoints, thresholds, calibration values

# 3. Boundary testing
# Write beyond declared memory (if validation weak)

2.2 Logic Injection

# If PLC logic upload/download is enabled:

# Check for Modbus function 0x10 (Write Multiple Registers)
# Could potentially write to program memory (if no protection)

# Some PLCs allow:
# - Logic download (90/91 in some protocols)
# - Configuration upload/download
# - Firmware updates without authentication

---

Phase 3: Control Logic Manipulation

3.1 HMI/SCADA Server Vulnerabilities

# Common SCADA/HMI software vulnerabilities:
# - Ignition, Induction Automation
# - WinCC (Siemens)
# - FactoryTalk View (Rockwell)
# - Cimplicity (GE)
# - LabVIEW (NI)

# Check for:
# - Exposed HTTP/HTTPS interfaces
# - Default credentials
# - SQL injection in HMI tags
# - XSS in HMI web interfaces
# - Unauthenticated tag access

# Example: HMI web interface test
curl -k https://scada-server/hmi
curl -X POST https://scada-server/api/tags -d '{"action":"read","tag":"System.Status"}'

3.2 Historian Database Exploitation

# SCADA historians (SQL-based):
# - SQL Server, PostgreSQL, MySQL
# - Custom historian formats

# Check for:
# - Direct database access
# - Injection vulnerabilities in tag queries
# - Exposed ODBC/JDBC interfaces

# Example historian query injection:
# Original: SELECT value FROM tags WHERE tagname = 'Tank1.Level'
# Injected: SELECT value FROM tags WHERE tagname = '1' OR 1=1--'

---

Phase 4: Sensor/Actuator Attacks

4.1 Sensor Spoofing

# Sensor data manipulation attacks:

# 1. Direct protocol manipulation
# Modify sensor readings in transit (if no integrity check)

# 2. Replay attacks
# Capture and replay sensor data (if no timestamp/nonce)

# 3. Man-in-the-middle
# Intercept and modify sensor values

# Example Modbus sensor spoofing:
# Original reading: temperature = 75.5 (register 40001 = 755)
# Spoofed: temperature = 125.0 (register 40001 = 1250)

4.2 Actuator Manipulation

# Actuator control vulnerabilities:

# 1. Unauthenticated write operations
# Most PLCs allow write by default

# 2. Calibration bypass
# Modify calibration registers to gain advantage

# 3. Safety interlock bypass
# Disable safety coils/registers

# Example dangerous manipulations:
# - Start/stop critical motors (coil writes)
# - Open/close valves (coil writes)
# - Change setpoints (register writes)
# - Modify PID parameters (register writes)

---

Phase 5: Protocol-Specific Vulnerabilities

5.1 Modbus Variants

Modbus TCP:

# No security by design
# All operations unauthenticated
# Writes enabled by default

# Novelty: Look for:
# - Custom authentication implementations
# - Encrypted Modbus (rare but exists)
# - Non-standard function codes

Modbus RTU over TCP:

# RTU encapsulated in TCP
# Check for CRC validation bypass
# Timing-dependent vulnerabilities

5.2 DNP3 Secure Authentication

# DNP3 SA (Secure Authentication) analysis:

# Check if SA is enabled:
# - Challenge-response required
# - Key management implemented
# - Session keys rotated

# Common SA bypasses:
# - Key reuse (static keys)
# - Weak challenge generation
# - Replay window too large

# Testing for SA bypass:
# 1. Send request without challenge
# 2. Reuse previous session
# 3. Guess weak keys

5.3 IEC 104 Vulnerabilities

# IEC 104 specific issues:

# 1. Unbalanced mode vs Balanced mode
# Unbalanced: Master controls, no slave-initiated
# Balanced: Slave can send spontaneous messages

# 2. Common Address (CA) attacks
# CA = 0xFF affects all stations

# 3. Information Object Address (IOA) manipulation
# IOA = 0xFFFF could be wildcard

# 4. Test Command (COT) bits
# COT = 6 (activation) + 7 (confirmation)
# Look for bypassing confirmation requirements

---

Novelty Indicators (PURSUE)

✓ Recent ICS CVEs (2023-2024):

• CVE-2024-23631: DNP3 out-of-bounds
• CVE-2023-4680: CODESYS buffer overflow
• CVE-2024-23620: OPC UA UaBinary

✓ Custom protocol implementations:

• Non-standard Modbus variants
• Custom IEC 104 extensions
• Proprietary SCADA protocols

✓ Integration bugs:

• Gateway/RTU boundary issues
• Protocol translation vulnerabilities
• Multi-protocol gateway flaws

✓ Safety system interaction:

• Safety instrumented systems (SIS) integration
• Emergency shutdown (ESD) bypass
• Fire/gas system manipulation

---

Known Patterns (AVOID)

✗ Default Modbus write (no auth by design) ✗ Unauthenticated DNP3 (known issue) ✗ IEC 104 replay (well-documented) ✗ Standard PLC logic upload (documented procedure)

---

Analysis Checklist

Protocol Analysis

• Protocol identified (Modbus, DNP3, IEC 104, Ethernet/IP)
• Protocol version determined
• Authentication mechanism checked
• Encryption/integrity verified
• Write operations enabled/disabled

Memory/Logic Analysis

• Memory layout mapped
• Critical registers identified
• Logic upload/download tested
• Safety interlocks located
• Calibration mechanisms checked

Sensor/Actuator Analysis

• Sensor data access confirmed
• Actuator control verified
• Spoofing possibilities tested
• Replay attacks evaluated
• Direct physical effects assessed

---

Safety Considerations

⚠️ CRITICAL: Never test on live production systems

• Use isolated test environments
• Never manipulate safety-critical systems
• Always document potential physical effects
• Follow responsible disclosure for critical infrastructure

---

Quick Reference

Protocol	Port	Novelty Focus
Modbus TCP	502	Custom auth, encryption
Modbus RTU	Varies	CRC bypass, timing
DNP3	20000	SA bypass, custom extensions
IEC 104	2404	CA attacks, IOA manipulation
Ethernet/IP	44818	CIP tag injection
OPC UA	4840	Certificate bypass, encryption flaws
PROFINET	Varies	Real-time latency abuse

---

Notes

• Focus on novel vectors: Custom protocols, recent CVEs, integration bugs
• Physical consequences: ICS vulns can have real-world impact
• Legacy systems: Older protocols have no security by design
• Verification: Document protocol, exploit, safety considerations
• Responsible disclosure: Critical infrastructure requires coordination