modbus_client --host 127.0.0.1 --port 502 --write-coil 1001 1 --address 10
When you paste this line into a terminal and hit enter, if the PLC (Programmable Logic Controller) on the other side doesn't have any authentication mechanism—which, in the industrial world, is the case about 90% of the time—you've just opened a physical valve, stopped a motor, or bypassed the temperature limits of a furnace. When you hack a server in the IT world, you leak data; when you hack a system in the OT (Operational Technology) world, things can literally explode, burn down, or a city's water supply could be cut off. There's no joking around here; a 'blue screen' in this context means a physical catastrophe.
The Air-Gap Fairytale
For years, we've heard that famous defense mechanism from engineers in the field: "Our systems are not connected to the internet; there is an air-gap." Come on guys, let's not kid ourselves. In the modern world, that 'air-gap' is nothing more than a myth. A USB stick brought in for a software update, an external service provider connecting via VPN for maintenance, or that innocent bridge set up by a manager who just wants to see field data on a dashboard... One way or another, those IT and OT networks eventually touch. In simulations we’ve conducted at TestCompany, we've seen that even in the most 'isolated' systems, a misconfigured dual-homed machine (a computer connected to both networks) can hand us the keys to the entire factory.
Modbus/TCP: The Protocol Where Security Was Forgotten
Developed in 1979, the Modbus protocol still beats at the heart of industrial facilities today. The problem? When this protocol was designed, the concept of 'security' wasn't even in their vocabulary. No authentication, no encryption, no authorization. Anyone who captures the packet can issue commands to the PLC.
Let’s look at a sample Modbus TCP packet structure (Defanged/Pseudo):
[Transaction ID: 2 bytes][Protocol ID: 2 bytes][Length: 2 bytes][Unit ID: 1 byte][Function Code: 1 byte][Data: N bytes]
When you write 0x05 (Write Single Coil) in the Function Code section and enter the relevant register address in the Data section, the PLC won't ask you, "Who are you?" It simply executes the order. This is our favorite (and actually the most terrifying) point during Red Team operations. Once you breach an HMI (Human Machine Interface) panel on the field, you essentially gain the authority to touch the physical world.
Why the Purdue Model is Still Critical
You can't talk about OT security without mentioning the Purdue Model. It’s impossible for someone who doesn't know this model to secure an industrial network. We divide network layers from Level 0 (physical sensors) to Level 5 (enterprise network). Our goal is to erect a hard-to-cross barrier between Level 4 (IT) and Level 3 (Manufacturing Operations), which we call the 'Industrial DMZ'.
If an engineer can access port 502 of a PLC in the field directly from their office computer, there is a major architectural flaw. You absolutely need a jump-server, a hardened VPN, and deep packet inspection (DPI) capable firewalls in between to filter these Modbus commands.