Study On Modbus/DNP3 Protocol: Topics Covered

Study on Modbus/DNP3 Protocol
Topics Covered:
 How does Modbus/DNP3 protocol work?
 What are the possible attacks to Modbus/DNP3 protocol?
 What are the possible security solutions (prevent/detect/mitigate) against those attacks in the literature?
 What are the challenges to address those security issues in legacy CPS?
 What are the relevant commercial products that can be deployed to defend against those attacks?
 What have you learnt from this study (a summary)?
1 How Modbus/DNP3 works?
2 Vulnerabilities & Possible Attacks on Modbus/DNP3
3 Prevention/Detection/Mitigation
4 Legacy CPS Security Issues & Challenges
5 Products that help defending
6 Learnings from this exercise

DNP3 - Distributed Network v3 Protocol
 An pen-source serial communication protocol, widely used in implementing SCADA networks.
 Contains Application and Data Link Layers, with a pseudo-transport layer.
 Widely used by major utilities in water and electric companies.
DNP3 Basic Design Objectives

DNP3 is designed to optimize the transmission of data and control commands from a master to one or more remote devices
or outstations with below objectives:
 Remote communications
 Limited bandwidth
 Possible use with Modems: more time for handshaking
 Interrupted communications
 Radio interference; Terrain, Trees, Buildings
 Outstation stores event data until retrieved / acknowledged by Master
 Event Time-stamping
 Outstation time-stamps, not the Master
 Permits coherent sequencing of events at the Master
MODBUS Protocol
 An pen-source serial communication protocol, industry standard for connecting various industrial devices.
 Contains Application Layer Protocol
 Widely used in industrial plants for integrating and using it with PLCs (Programmable Logic Controller)
MODBUS Basic Design Objectives

Modbus is a master-slave communication protocol which is capable of supporting up to 247 slaves for
communications with supervisory computers in SCADA systems, designed with below design objectives:
 Dedicated Wire or Fibre connection between stations
 Short distances
 Controlled environment and communication dynamics
 Robust, dedicated physical connection expected
 Tolerable Sequence of Events timing incoherency as acquired by Master.
DNP3 - Known Security Vulnerabilities and Possible Attacks
NDP3 Security Issues
Major security flaws in DNP3 are:
 Lack of Confidentiality: As the messages are transmitted in clear text across the transmission media due to lack of
message confidentiality due to unavailability of any encryption
 Lack of Integrity: No protocol intrinsic robust integrity checks like message checksum for checking errors and garbled
messages on communications at higher layers
 Lack of Authentication: All the messages get communicated without standardized authentication
 NDP3 messages are prone to Man-in-the-middle attack
Attacks on DNP3 systems

 Attacks that exploit the DNP3 specifications
 Attacks that exploit vendor implementations of DNP3, typically by exploiting configuration errors or code flaws (e.g., via
buffer overflows).
 Attacks that exploit weaknesses in the underlying infrastructure like information technology, network and
telecommunications assets, or weak security policies setup on network.
DNP3 - Attack Categories – Scenarios
Man in the Middle Attack (MITM) Blackhole Attack (Packets Drop Attack)
Is considered to be a type of denial-of service attack
Sniffing Generated Traffic from the Slave and Master
in which all packets passed through the attacker are
nodes Sniffing or capturing the traffic passing between
discarded instead of passing through to reach their
the master and the slave nodes is handled by using
destination. In packets dropping attack, packets get
man-in-the-middle attacker node.
routinely and selectively dropped making it harder
to detect and to prevent.
Packets Modification & Injection Attacks Denial of Service (DoS) Attack
Involves altering the content of a specific DNP3 In Denial of Service (DoS) attack is an attempt to make
payload using predefined filters. DNP3 packets get a network resource unavailable to its intended users,
captured and are modified by imposing changes to by temporarily or indefinitely interrupting or
the exchanged packets. Injection of a totally new suspending the services of a host connected to the
packet is also a possibility in this category. network.
DNP3 – Detection, Prevention and Mitigation of Attacks
Host based intrusion detection tools to provide

protection at the host level.
Intrusion Detection (ID)

Network based intrusion detection that monitors all
Intrusion detection systems traffic on the network.
continue to be the primary

tool for protecting DNP3 Pattern recognition based on traffic analysis
based implementations between the legitimate devices and the
from malicious attacks. attacker.
Log mining by utilize logs using machine

learning techniques such as statistical
analysis.
CPS Security Issues & Challenges
Cyber-physical systems (CPS) are at the core of critical infrastructures and industrial control systems and are
highly vulnerable to computer attacks.
Cyber-physical systems (CPS) are high value targets for adversaries due
to the critical role they play in the enterprises today. The gains Cybercriminals compromise
associated with being able to compromise such system is huge. computers anywhere they can find
them causing negative side effects.
 Hence the attackers are highly motivated to breach systems;
 Legacy system though used for very critical functions but still have Disgruntled employees are major source of
old security protection mechanism. targeted computer attacks against control systems.
Terrorists, activists, & organized criminal groups are another

threat to control systems. Attacking systems for extortion is new
Major trend.
Issues & Many nations and state sponsored actors are a possible threat to control systems
with most military powers are looking into future attack technologies, including
Challenges cyber-attacks against the infrastructure of other nations.
Lack of security protection, or the corresponding security protocols deployed in legacy systems are
not corresponding with their criticality.
Some of the Products that help defending from Attacks
1 2 3 4 5
IOC
Network Traffic System Reverse
Anomaly
Log Review
Detection Artifact Engineering
Detection Tools
Review Analysis
ABB Cyber
CyberX Elastic CHIPSEC Binary
Security
XSense Stack Ninja
Benchmark
FireEye IOC Darktrace Graylog CodeDNA Centrifuge
Editor/Finder ICS
Fortinet- Hopper
Radiflow Splunk® Volatility
Nozomi Disassembler
Framework
Networks

Study On Modbus/DNP3 Protocol: Topics Covered

Uploaded by

Copyright:

Available Formats

Study On Modbus/DNP3 Protocol: Topics Covered

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Study On Modbus/DNP3 Protocol: Topics Covered

Uploaded by

Copyright:

Available Formats

Study on Modbus/DNP3 Protocol

2 Vulnerabilities & Possible Attacks on Modbus/DNP3

4 Legacy CPS Security Issues & Challenges

5 Products that help defending

6 Learnings from this exercise

DNP3 Basic Design Objectives

MODBUS Basic Design Objectives

Attacks on DNP3 systems

Packets Modification & Injection Attacks Denial of Service (DoS) Attack

Host based intrusion detection tools to provide

Intrusion Detection (ID)

continue to be the primary

Log mining by utilize logs using machine

Terrorists, activists, & organized criminal groups are another

You might also like