Abs ac —SCADA, CIS, ICS and simila MODBUS based
sys ems we e always he a ge o many ypes o a acks, bu
du ing he las decades because o he as sp ead o he
in e ne , hese sys ems become much mo e ulne able. This
pape is a case s udy, which aim is o in es iga e he
se iousness o he abo e desc ibed si ua ion.
Keywo ds— a ack, Modbus RTU, SCADA, secu i y
I. INTRODUCTION
ALKING abou sma homes, sma buildings,
in elligen acili ies, in e ne o hings he ollowing
ques ions a isen in us.
1) Is SCADA(Supe iso y Con ol and Da a Acquisi ion)
o simila sys ems secu e enough?
2) Which pa o ha sys ems is he mo e ulne able?
3) Is he e any solu ion o p o ec he communica ion
channel?
4) I he e a e ulne abili ies in he communica ion, is i
able o cause se ious p oblems?
5) I i can, how se ious is he damage?
On he nex pages we will y o answe hese
ques ions, bu he aim o his case s udy is no o analyze
he SCADA o simila sys ems ulne abili ies pa by
pa in de ail, bu o in es iga e one pa o i , which pa
is he communica ion p o ocol, and sea ch success ul o
unsuccess ul a acks agains i . In his a icle, we ocus
on he MODBUS communica ion p o ocol because i is a
widesp ead communica ion s anda d in he pa icula
ield and 22% o he communica ion p o ocols used in
hese ypes o ne wo ks is MODBUS. The pape
s uc u e is he nex . Sec ion II. gi es a b ie in oduc ion
abou he basic concep s. Sec ion III. desc ip s he
MODBUS p o ocol i sel in de ail. Sec ion IV p esen s
eal a acks agains SCADA sys ems and sec ion V.
s ands o he conclusion and sec ion VI. is o he u u e
wo k.
II. BASIC CONCEPTS
Fo he be e unde s anding in his sec ion we de ine
some basic concep s.
A. CIS
CIS s ands o C i ical In as uc u e Sys ems. Talking
abou CIS means alking abou ene gy gene a ion,
chemical p oduc ion, manu ac u ing, wa e supplying,
anspo a ion o any o he indus ial p ocesses.
B. ICS
ICS s ands o Indus ial Con ol Sys em. ICS a e
command and con ol ne wo ks and sys ems designed o
suppo indus ial p ocesses. Acco ding o his de ini ion,
ICS is he sys em which pu pose is o ealize he
p ocesses o he CIS.
C. SCADA
SCADA s ands o Supe iso y Con ol and Da a
Acquisi ion. SCADA is a special ype o ICS. SCADA
sys ems usually includes senso s, PLCs (P og ammable
Logic Con olle ), RTUs (Remo e Te minal Uni ), and
HMI (Human-Machine In e ace ). SCADA sys ems
usually designed o make ope a ion o p ocesses be e ,
imp o e pe o mance, simpli y ac ua ion o educe e o
comes om human in e en ion. SCADA sys ems a e he
backbone o mos o ICS, i collec s, exchanges and
analyze he sys em p ope ies, and o he ele an da a o
help ope a e he p ocesses mo e e ec i ely, bo h in e ms
o ime and ma e ials.
As you can see he abo e lis ed sys ems a e essen ial
pa s o well- unc ioning plan s, acili ies, owns, ci ies
o coun ies, so a success ul a ack agains i a ec s no
only he ac ual SCADA sys ems bu also us.
D. MODBUS p o ocol
The MODBUS p o ocol was designed by he
MODICON in he ea ly se en ies. MODBUS is a
ne wo k p o ocol, which p ima y pu pose was o build
ne wo k om PLCs. Th ough he yea s i became one o
he mos common communica ion p o ocol. The e is
h ee ypes o he MODBUS p o ocol acco ding o he
messages sending on he channel.
E. MODBUS TCP
The e a e se e al esea ch dealing wi h he weaknesses
o his ype o he MODBUS, and al hough i is no
ypical o use, bu se e al solu ion exis s o p o ec a
SCADA sys em using MODBUS TCP. One o hese
solu ion is o apply i ewalls, p oxy se e s o SSL.
VULNERABILITIES OF MODBUS RTU
PROTOCOL – A CASE STUDY
Gabo JAKABOCZKI1, E a ADAMKO2
1 Uni e si y o Deb ecen, Facul y o Enginee ing, jakaboczkigabo @gmail.com
2 Uni e si y o Deb ecen, Facul y o Enginee ing, adamko.e[email p o ec ed]nideb.hu
T
ANNALS OF THE ORADEA UNIVERSITY
Fascicle o Managemen and Technological Enginee ing
ISSUE #1, MAY 2015, h p://www.im uo adea. o/auo. m e/
203
F. MODBUS RTU
The MODBUS RTU is he se ial MODBUS p o ocol,
Fig. 1. SCADA sys em o he Building Mecha onics Resea ch Cen e in Uni e si y o Deb ecen
secu i y, al hough he e a e se e al secu i y b eaches in
i . In Sec ion III. i desc ibed in de ail.
G. MODBUD ASCII
Sending ASCII cha ac e s h ough a communica ion
channel is no oo widely used solu ion, so his ype o
MODBUS is no in e es ing o us in he espec o
secu e SCADA sys ems.
III. THE MODBUS SERIAL PROTOCOL
A. MODBUS se ials place in he OSI/ISO model
The MODBUS se ial p o ocol is a Mas e -Sla e
p o ocol, aking place in he Da a link laye o he
OSI/ISO model. I is a eques - eply p o ocol, ypically
one node, he Mas e , eques s he ansmission o da a
om he Sla e de ices. Usually he Sla e nodes do no
ini ia e he communica ion wi h he Mas e o wi h o he
Sla es.
On he se en h laye o he OSI/ISO model he
MODBUS Applica ion laye p o ides se e -clien
communica ion.
On he MODBUS se ial line he Mas e s ac as clien s
and he Sla es as se e s.
TABLE I
The ISO/OSI Modell And The Modbus P o ocol
B. The physical laye
As one o he mos widesp ead se ial communica ion
p o ocols, MODBUS se ial usually use he
ANSI/TIA/EIA-485-A-1998 s anda d (also known as
RS485) as he physical communica ion laye . Because
he Mas e -Sla e hie a chy o he MODBUS p o ocol,
he RS485 s anda d used in hal -duplex mode, mainly
wi h he wo-wi e con igu a ion
C. The Mas e -Sla e p inciple
On he MODBUS se ial line se e al Sla es can be
connec ed, bu only one Mas e a a ime. E e y Sla e
mus ha e a unique add ess, only he Mas e can
communica e success ully wi hou i . As he Mas e
ini ia es he communica ion, he Sla e acknowledges he
eques and send back he equi ed da a. The Mas e
de ice can issue hese eques s in ei he unicas (one
sla e) o b oadcas (all sla e nodes) modes. Upon
ecei ing a b oadcas message he Sla es do no send
eply.
D. The a chi ec u e o he MODBUS se ial ame
The P o ocol Da a Uni (PDU) o he MODBUS
p o ocol is simple and independen om he unde lying
laye s. I is composed o a Func ion code ha de e mines
he ac ion o be aken wi h he ollowing Da a segmen .
On he se ial line he PDU is encapsula ed in a ame ha
con ains an add ess ield and an e o check pa . The
add ess ield in he beginning o he ame is an add ess
o a Sla e ( he a ge in unicas mode eques s, o he
o igin i i is a eply o a sla e) and he e o check pa is
a CRC o LRC by e pai .
The e a e wo coding me hods o use, he ASCII whe e
he da a (and he en i e ame) is sen in cha ac e s, o he
RTU (Remo e Te minal Uni ) whe e he ame is
composed o hexadecimal cha ac e s. The la e is he
Laye
ISO/OSI Model
MODBUS
7
Applica ion
MODBUS Applica ion
p o ocol
6
P esen a ion
5
Session
4
T anspo
3
Ne wo k
2
Da a Link
MODBUS Se ial Line
P o ocol
1
Physical
ANSI/TIA/EIA-485-A-1998
ANNALS OF THE ORADEA UNIVERSITY
Fascicle o Managemen and Technological Enginee ing
ISSUE #1, MAY 2015, h p://www.im uo adea. o/auo. m e/
204
de aul , and i s da a h oughpu is g ea e han he ASCII
me hod (due o cha ac e densi y).
Fig. 2. Typical Mas e -Sla e con igu a ion on RS485 se ial ne wo k. No e he esis o s.
Fig. 3. A chi ec u e o a MODBUS RTU F ame
E. Usage o MODBUS se ial
As he second bigges de ac o s anda d in indus ial
applica ions (22%, P o ibus 28% as o 2010) he
MODBUS se ial p o ocol is widesp ead.
Coun less applica ions a e known:
1) End poin de ices:
a) - In elligen ac ua o s (mo o con olle s,
pumps, al es e c.)
b) - Senso s (like Radio equency senso
ga eways, he mome e s, M-bus in eg a o s
e c.)
2) Da a acquisi ion and con ol de ices:
a) PLCs
b) Embedded con olle s
3) On si e con ol, moni o ing and da a p esen a ion
de ices
a) Indus ial compu e s
b) HMIs and a ious displays
4) Se e s and da abanks
F. The weaknesses o MODBUS se ial
The mos ob ious weakness o he MODBUS se ial
p o ocol is he lack o buil in secu i y measu es. The e is
no means o iden i ying a de ice on he bus, i we do no
an icipa e i s p esence. The e is no buil in command o
disco e connec ed de ices o o e i y hei au hen ici y.
And o emos he Mas e nodes do no ha e o ha e
add ess, and can communica e o e he bus wi hou one.
Ano he weakness is ha he messages ansmi o e
he medium wi hou any enc yp ion, in a simple and clea
ex o ma and can be ead wi hou decoding.
In an imagined scena io, i an a acke success ully
inse a anscei e de ice be ween wo nodes, i can
moni o , dis up and modi y he communica ion o
comp omise i en i ely.
So, we can decla e -wi hou any de ailed analysis o
he p o ocol- ha se e al se ious secu i y b eaches ound
in he communica ion h ough MODBUS.
Fig. 4. A comp omised MODBUS ne wo k opology
IV. SUCCESSFUL ATTACKS
A. A ack agains MODBUS/TCP p o ocol based
sys ems
1) 1982
In 1982 a pa o he T ans-Sibe ian gas pipeline
des oyed because o a T ojan i us go in o i s SCADA
sys em. The explosion was equi alen wi h a h ee
kilo ons o TNT.
ANNALS OF THE ORADEA UNIVERSITY
Fascicle o Managemen and Technological Enginee ing
ISSUE #1, MAY 2015, h p://www.im uo adea. o/auo. m e/
205
2) 2003
In 2003 a US hyd oelec ic powe plan decoy sys em
los all con ol because o a hacke g oup called APT1
[1].
In 2003 se en Ame ican s a es needed he wo k
p ope ly wi hou elec ici y because o a malwa e
des oyed some CIS. The blackou caused many damage,
among o he se ious hings, people died because o i [3].
3) 2013
In 2013 wo Ame ican cybe secu i y expe s ook
o e he con ol o an oil ig. I could ha e been cause
se ious en i onmen al disas e [2].
The abo e lis ed e en s only a iny pa o he known
a acks, and mos o hem happened because hese
SCADA, CIS and ICS had somehow linked o he
in e ne . Se e al publica ions and esea ches in es iga e
he ulne abili ies o in e ne linked SCADA sys ems, o
in o he wo ds MODBUS TCP based SCADA sys ems –
as i men ioned be o e -, and o cou se se e al solu ion
exis s. Ne e heless hese solu ion ocus on o p o ec
SCADA sys ems om a acke who come om he
in e ne .
B. A ack agains MODBUS RTU p o ocol based
sys ems
1) 2010
F om 2010 a malwa e called S uxne sys ema ically
des oyed a i h o I an’s nuclea cen i uges by causing
hem o spin ou o con ol. When he malwa e ins alled
on a SCADA sys em i is able o access, ead, w i e, and
dele e code blocks on he PLCs. I in ec s USB d i es,
and hen sp ead like a common lu, ha is why he
solu ions ha secu e agains MODBUS/TCP did no
wo k in his pa icula case [4].
2) 2011
In 2011 McA ee epo ed ha se e al o i s cus ome s
(co po a ions in he ene gy sec o ) go hi by a se ies o
a acks om Chinese o igin. The p ima y goal o he
a acks was no o cause damage, bu o ga he
in o ma ion on he a ec ed companies SCADA ne wo k
s uc u e (and possible exploi able weaknesses) [5].
3) 2013
In 2013 wo ICS expe comp omised mul iple
indus ial acili ies h ough adio equency channel.
They ook access o e empe a u e senso s, and was able
o alsi y he eal da a [7].
The ICS-CERT (Indus ial Con ol Sys ems Cybe
Eme gency Response Team) moni o ing epo o 2013
s a es ha in he i s hal o ha yea hey disce ned
mo e han 200 a acks ha a ge ed ICS sys ems [6, 8].
In hei 2013 p esen a ion a he 30 h Chaos
Communica ion Cong ess, he SCADA S angelo e eam
epo ed hei indings abou he ulne abili ies o se e al
indus ial p o ocols including MODBUS. They exploi ed
“ze o day” bugs and ook o e en i e ne wo ks wi hin he
ma e o hou s. When a iewe asked a e he
p esen a ion i he eam could ake o e nuclea plan s o
simila ne wo ks he p esen e s s a ed: “I would be be e
o answe ha ques ion backs age, in p i a e.”
V. CONCLUSION
We come o he poin o answe he ques ions o he
in oduc ion sec ion. The answe o he i s ques ion is
clea ly no, we can say i because in he p e ious sec ion
lo o success ul a acks we e p esen ed, and hese cases
a e only he op o he icebe g. Answe ing o he second
ques ion in he absence o a ho ough in es iga ion may
seem o be guesswo k, bu i can be said ha e e y
sys em – consis ing any ypes o de ices - depends on he
unde lying communica ion channel. Tha is he eason,
why we choose he MODBUS p o ocol as he main opic
o he case s udy. As you can ead in he p e ious
sec ions he e a e se e al possible solu ion o make
MODBUS PLC communica ion mo e secu e, bu he e
a e no any solu ion (o no c yp og aphically secu e
solu ion) o MODBUS RTU. MODBUS communica ion
p o ocols a e backbones o SCADA and CIS sys ems,
which esponsible o c i ical asks, so uin such sys ems
can cause no only eno mous ma e ial damage, bu can
cos s li es.
VI. FUTURE WORK
A e in es iga ing hese cases we can say, ha a
p ope solu ion is needed o make communica ion o e
MODBUS RTU secu e, and make SCADA sys ems mo e
eliable, om his poin o iew oo. In he nex mon hs
we plan o design a secu e and c yp og aphically co ec
communica ion p o ocol on he MODBUS RTU s anda d
and implemen on AVR mic ocon olle s.
REFERENCES
[1] Simoni e, Tom. "Chinese Hacking Team Caugh Taking O e
Decoy Wa e Plan . (2013) Online: h p://www.
echnology e iew. com/news/517786/chinese-hacking eam-
caugh - aking-o e -decoy-wa e -plan
[2] Smi h. ”No cybe my hs: Hacking oil igs, wa e plan s,
indus ial in as uc u e” (2013) Online:
h p://www.ne wo kwo ld.com/a icle/2225104/mic oso -
subne /no -cybe -my hs--hacking-oil- igs--wa e -plan s--
indus ial-in as uc u e.h ml
[3] Acke man, Robe K. ”SCADA Sys ems Face Di e se So wa e
A ack Th ea s” (July 31, 2013) Online:
h p://www.a cea.o g/con en /?q=scada-sys ems- ace-di e se-
so wa e-a ack- h ea s
[4] Alb igh , Da id, Paul B annan, and Ch is ina Wal ond. “Did
S uxne Take Ou 1,000 Cen i uges a he Na anz En ichmen
Plan ?”. Ins i u e o Science and In e na ional Secu i y, 2010.
[5] Keize , G egg. "‘Sloppy’Chinese hacke s sco ed da a- he coup
wi h ‘Nigh D agon’." Compu e wo ld, Feb ua y 11 (2011).
[6] S o m, Da lene. ” B u e- o ce cybe a acks agains c i ical
in as uc u e, ene gy indus y, in ensi y” (July 2, 2013) Online:
h p://www.compu e wo ld.com/a icle/2473941/cybe c ime-
hacking/b u e- o ce-cybe a acks-agains -c i ical-in as uc u e--
ene gy-indus y--in ens.h ml
[7] Apa, Lucas, and Ca los Ma io Penagos Hollman. "Comp omising
Indus ial Facili ies om 40 Miles Away." IOAc i e Technical
Whi e Pape (2013).
[8] ICS-CERT Yea in Re iew, Indus ial Con ol Sys ems Cybe
Eme gency Response Team, 2013
ANNALS OF THE ORADEA UNIVERSITY
Fascicle o Managemen and Technological Enginee ing
ISSUE #1, MAY 2015, h p://www.im uo adea. o/auo. m e/
206