When a Modbus TCP 0x05 (Write Single Coil) command starts flying across the network in plain text, you've already lost control of that valve; at that point, you’re just a spectator watching how the physical world reacts to digital chaos.
Hey everyone, today we’re getting our boots on the ground. But I’m not talking about the cold, sterile air of data center corridors. I’m talking about the noisy, dusty, 'old school' atmosphere of factories that smell like PLCs (Programmable Logic Controllers). When people think of OT (Operational Technology) security, they usually imagine incredibly complex, impossible-to-pull-off attacks. The reality? The 'security by design' (or lack of it) mistakes we left behind in the IT world during the 90s are still enjoying their golden age in the OT world.
OT and IT: Two Different Planets
In the IT world, 'Confidentiality' sits at the top of the CIA triad (Confidentiality, Integrity, Availability). Just don't let the data get stolen. In OT, this hierarchy is flipped upside down. At the very top, you have 'Availability' and, even more importantly, 'Safety.' You can't just shut down a system to patch a PLC. That system might have been running for 20 years, and if you turn it off, there’s no guarantee it’ll ever start back up.
As a Red Teamer at testCompany, my field studies have shown one thing: penetrating industrial networks is often much less of a hassle than taking over a Windows domain. Why? Because in 90% of industrial protocols, the concept of authentication simply doesn't exist. Who sent the packet? Is the source IP trustworthy? What’s inside the payload? The PLC doesn't care about any of that. Its motto is simple: 'Execute the incoming command.'
The Dark World of Protocols: The Modbus Example
Modbus is like the 'English' of the industrial world; everyone knows it, everyone uses it, but nobody encrypts it. This traffic, flowing through port 502, is an open buffet for an attacker. You don't need complex exploits to write to a PLC's registers. You just need to send the right packet to the right register address.
Look, below is a 'defanged' Python script written with Scapy, designed to change the state of a PLC coil (switch/relay). This code represents the fundamental logic behind attacks you might see in the field:
# MOCK CODE FOR EDUCATIONAL PURPOSES - DEFANGED
from scapy.all import IP, TCP, send
# Target PLC IP (Defanged)
target_ip = "127.0.0.1"
target_port = 502
# Modbus TCP Header Structure
# Transaction ID: 0x0001, Protocol ID: 0x0000, Length: 0x0006, Unit ID: 0x01
# Function Code: 0x05 (Write Single Coil), Reference Address: 0x0001, Data: 0xff00 (ON)
modbus_payload = b"\x00\x01\x00\x00\x00\x06\x01\x05\x00\x01\xff\x00"
packet = IP(dst=target_ip)/TCP(dport=target_port)/modbus_payload
# When this packet is sent, the PLC activates switch number 1.
# send(packet)
print("Defanged Modbus packet prepared but not sent.")
The core problem here is this: If an attacker can reach this port from anywhere in the network—perhaps from a compromised engineering station or a misconfigured Wi-Fi access point—they effectively own the physical process.
To protect these systems, we need to stop thinking like IT admins and start thinking like plant managers. Network segmentation (Purdue Model) isn't just a suggestion; it's a lifeline. If your PLC is talking to the same VLAN as your office printer, you're not just looking at a data breach—you're looking at a potential physical catastrophe.