Let’s be real; everyone in the industry is treating 'IT/OT Convergence' like a buzzword they can't stop chewing on. Security firms are riding this wave, trying to push 'next-gen' EDRs and aggressive vulnerability scanners—originally designed to protect Windows laptops in a cozy office—into the heart of factories, right into the networks where the PLCs (Programmable Logic Controllers) live.
Let me be crystal clear: If someone walks up to you and says, 'Let’s scan the factory with Nessus, we'll find all the vulnerabilities,' escort them out of the server room—politely (or not). Why? Because when that 'modern' and 'smart' scanner sends a single malformed packet to a Schneider or Siemens PLC from 1995 that’s barely hanging on, you aren't just testing security; you’re shutting down the entire production line and causing millions of dollars in losses. In the OT (Operational Technology) world, 'availability' is king. The 'confidentiality' we’re used to in IT takes a back seat here.
The Air-Gap is an Urban Legend
One of the most common lies I hear in the field is: 'Sedat, our systems aren't connected to the internet; we have an air-gap.'
Look, folks, it’s 2024. That 'air-gap' you’re talking about is usually just a 'clean' USB stick a maintenance engineer plugs in to update a PLC, or a third-party vendor’s laptop connecting via TeamViewer through some 'forgotten' jump box. Stuxnet taught us one thing: physical isolation is an illusion. If data can enter a system, that system can be hacked.
In OT security, the real issue isn't how isolated the system is, but how much 'noise' an attacker makes once they're inside. The tools used for lateral movement in IT networks usually end up completely locking down OT systems.
Technical Deep Dive: Why Modbus is a Headache
Most industrial protocols (Modbus, Profinet, EtherNet/IP) weren't designed with security in mind. Modbus/TCP runs on port 502 and, basically, has zero authentication. This means anyone who gets onto the network can tell a PLC to 'stop' or change its register values.
Let’s look at a (defanged) sample Modbus packet structure:
# Pseudo-code: Write request to a PLC register
# This action could open or close a critical valve in an OT environment.
from scapy.all import *
# Defanged IP and port
target_plc = "127.0.0.1"
target_port = 502
# Modbus ADU (Application Data Unit)
# Transaction ID: 0x0001, Protocol: 0x0000, Length: 0x0006, Unit ID: 0x01
# Function Code: 0x06 (Write Single Register), Reference: 0x0001, Value: 0xff00
modbus_payload = "\x00\x01\x00\x00\x00\x06\x01\x06\x00\x01\xff\x00"
# When you send this packet, you're telling the PLC 'change this setting.'
# Authentication? None. Encryption? Forget about it.
As a Red Teamer, when we examine these types of systems at Payten, we never use aggressive scanning. Instead, we...