Vulnerabilities of MODBUS rtu protocol?: a case study

Abs ac —SCADA, CIS, ICS and simila MODBUS based sys ems we e always he a ge o many ypes o a acks, bu du ing he las decades because o he as sp ead o he in e ne , hese sys ems become much mo e ulne able. This pape is a case s udy, which aim is o in es iga e he se iousness o he abo e desc ibed si ua ion. Keywo ds— a ack, Modbus RTU, SCADA, secu i y I. INTRODUCTION ALKING abou sma homes, sma buildings, in elligen acili ies, in e ne o hings he ollowing ques ions a isen in us. 1) Is SCADA(Supe iso y Con ol and Da a Acquisi ion) o simila sys ems secu e enough? 2) Which pa o ha sys ems is he mo e ulne able? 3) Is he e any solu ion o p o ec he communica ion channel? 4) I he e a e ulne abili ies in he communica ion, is i able o cause se ious p oblems? 5) I i can, how se ious is he damage? On he nex pages we will y o answe hese ques ions, bu he aim o his case s udy is no o analyze he SCADA o simila sys ems ulne abili ies pa by pa in de ail, bu o in es iga e one pa o i , which pa is he communica ion p o ocol, and sea ch success ul o unsuccess ul a acks agains i . In his a icle, we ocus on he MODBUS communica ion p o ocol because i is a widesp ead communica ion s anda d in he pa icula ield and 22% o he communica ion p o ocols used in hese ypes o ne wo ks is MODBUS. The pape s uc u e is he nex . Sec ion II. gi es a b ie in oduc ion abou he basic concep s. Sec ion III. desc ip s he MODBUS p o ocol i sel in de ail. Sec ion IV p esen s eal a acks agains SCADA sys ems and sec ion V. s ands o he conclusion and sec ion VI. is o he u u e wo k. II. BASIC CONCEPTS Fo he be e unde s anding in his sec ion we de ine some basic concep s. A. CIS CIS s ands o C i ical In as uc u e Sys ems. Talking abou CIS means alking abou ene gy gene a ion, chemical p oduc ion, manu ac u ing, wa e supplying, anspo a ion o any o he indus ial p ocesses. B. ICS ICS s ands o Indus ial Con ol Sys em. ICS a e command and con ol ne wo ks and sys ems designed o suppo indus ial p ocesses. Acco ding o his de ini ion, ICS is he sys em which pu pose is o ealize he p ocesses o he CIS. C. SCADA SCADA s ands o Supe iso y Con ol and Da a Acquisi ion. SCADA is a special ype o ICS. SCADA sys ems usually includes senso s, PLCs (P og ammable Logic Con olle ), RTUs (Remo e Te minal Uni ), and HMI (Human-Machine In e ace ). SCADA sys ems usually designed o make ope a ion o p ocesses be e , imp o e pe o mance, simpli y ac ua ion o educe e o comes om human in e en ion. SCADA sys ems a e he backbone o mos o ICS, i collec s, exchanges and analyze he sys em p ope ies, and o he ele an da a o help ope a e he p ocesses mo e e ec i ely, bo h in e ms o ime and ma e ials. As you can see he abo e lis ed sys ems a e essen ial pa s o well- unc ioning plan s, acili ies, owns, ci ies o coun ies, so a success ul a ack agains i a ec s no only he ac ual SCADA sys ems bu also us. D. MODBUS p o ocol The MODBUS p o ocol was designed by he MODICON in he ea ly se en ies. MODBUS is a ne wo k p o ocol, which p ima y pu pose was o build ne wo k om PLCs. Th ough he yea s i became one o he mos common communica ion p o ocol. The e is h ee ypes o he MODBUS p o ocol acco ding o he messages sending on he channel. E. MODBUS TCP The e a e se e al esea ch dealing wi h he weaknesses o his ype o he MODBUS, and al hough i is no ypical o use, bu se e al solu ion exis s o p o ec a SCADA sys em using MODBUS TCP. One o hese solu ion is o apply i ewalls, p oxy se e s o SSL. VULNERABILITIES OF MODBUS RTU PROTOCOL – A CASE STUDY Gabo JAKABOCZKI1, E a ADAMKO2 1 Uni e si y o Deb ecen, Facul y o Enginee ing, jakaboczkigabo @gmail.com 2 Uni e si y o Deb ecen, Facul y o Enginee ing, adamko.e[email p o ec ed]nideb.hu T ANNALS OF THE ORADEA UNIVERSITY Fascicle o Managemen and Technological Enginee ing ISSUE #1, MAY 2015, h p://www.im uo adea. o/auo. m e/ 203 F. MODBUS RTU The MODBUS RTU is he se ial MODBUS p o ocol, Fig. 1. SCADA sys em o he Building Mecha onics Resea ch Cen e in Uni e si y o Deb ecen secu i y, al hough he e a e se e al secu i y b eaches in i . In Sec ion III. i desc ibed in de ail. G. MODBUD ASCII Sending ASCII cha ac e s h ough a communica ion channel is no oo widely used solu ion, so his ype o MODBUS is no in e es ing o us in he espec o secu e SCADA sys ems. III. THE MODBUS SERIAL PROTOCOL A. MODBUS se ials place in he OSI/ISO model The MODBUS se ial p o ocol is a Mas e -Sla e p o ocol, aking place in he Da a link laye o he OSI/ISO model. I is a eques - eply p o ocol, ypically one node, he Mas e , eques s he ansmission o da a om he Sla e de ices. Usually he Sla e nodes do no ini ia e he communica ion wi h he Mas e o wi h o he Sla es. On he se en h laye o he OSI/ISO model he MODBUS Applica ion laye p o ides se e -clien communica ion. On he MODBUS se ial line he Mas e s ac as clien s and he Sla es as se e s. TABLE I The ISO/OSI Modell And The Modbus P o ocol B. The physical laye As one o he mos widesp ead se ial communica ion p o ocols, MODBUS se ial usually use he ANSI/TIA/EIA-485-A-1998 s anda d (also known as RS485) as he physical communica ion laye . Because he Mas e -Sla e hie a chy o he MODBUS p o ocol, he RS485 s anda d used in hal -duplex mode, mainly wi h he wo-wi e con igu a ion C. The Mas e -Sla e p inciple On he MODBUS se ial line se e al Sla es can be connec ed, bu only one Mas e a a ime. E e y Sla e mus ha e a unique add ess, only he Mas e can communica e success ully wi hou i . As he Mas e ini ia es he communica ion, he Sla e acknowledges he eques and send back he equi ed da a. The Mas e de ice can issue hese eques s in ei he unicas (one sla e) o b oadcas (all sla e nodes) modes. Upon ecei ing a b oadcas message he Sla es do no send eply. D. The a chi ec u e o he MODBUS se ial ame The P o ocol Da a Uni (PDU) o he MODBUS p o ocol is simple and independen om he unde lying laye s. I is composed o a Func ion code ha de e mines he ac ion o be aken wi h he ollowing Da a segmen . On he se ial line he PDU is encapsula ed in a ame ha con ains an add ess ield and an e o check pa . The add ess ield in he beginning o he ame is an add ess o a Sla e ( he a ge in unicas mode eques s, o he o igin i i is a eply o a sla e) and he e o check pa is a CRC o LRC by e pai . The e a e wo coding me hods o use, he ASCII whe e he da a (and he en i e ame) is sen in cha ac e s, o he RTU (Remo e Te minal Uni ) whe e he ame is composed o hexadecimal cha ac e s. The la e is he Laye ISO/OSI Model MODBUS 7 Applica ion MODBUS Applica ion p o ocol 6 P esen a ion 5 Session 4 T anspo 3 Ne wo k 2 Da a Link MODBUS Se ial Line P o ocol 1 Physical ANSI/TIA/EIA-485-A-1998 ANNALS OF THE ORADEA UNIVERSITY Fascicle o Managemen and Technological Enginee ing ISSUE #1, MAY 2015, h p://www.im uo adea. o/auo. m e/ 204 de aul , and i s da a h oughpu is g ea e han he ASCII me hod (due o cha ac e densi y). Fig. 2. Typical Mas e -Sla e con igu a ion on RS485 se ial ne wo k. No e he esis o s. Fig. 3. A chi ec u e o a MODBUS RTU F ame E. Usage o MODBUS se ial As he second bigges de ac o s anda d in indus ial applica ions (22%, P o ibus 28% as o 2010) he MODBUS se ial p o ocol is widesp ead. Coun less applica ions a e known: 1) End poin de ices: a) - In elligen ac ua o s (mo o con olle s, pumps, al es e c.) b) - Senso s (like Radio equency senso ga eways, he mome e s, M-bus in eg a o s e c.) 2) Da a acquisi ion and con ol de ices: a) PLCs b) Embedded con olle s 3) On si e con ol, moni o ing and da a p esen a ion de ices a) Indus ial compu e s b) HMIs and a ious displays 4) Se e s and da abanks F. The weaknesses o MODBUS se ial The mos ob ious weakness o he MODBUS se ial p o ocol is he lack o buil in secu i y measu es. The e is no means o iden i ying a de ice on he bus, i we do no an icipa e i s p esence. The e is no buil in command o disco e connec ed de ices o o e i y hei au hen ici y. And o emos he Mas e nodes do no ha e o ha e add ess, and can communica e o e he bus wi hou one. Ano he weakness is ha he messages ansmi o e he medium wi hou any enc yp ion, in a simple and clea ex o ma and can be ead wi hou decoding. In an imagined scena io, i an a acke success ully inse a anscei e de ice be ween wo nodes, i can moni o , dis up and modi y he communica ion o comp omise i en i ely. So, we can decla e -wi hou any de ailed analysis o he p o ocol- ha se e al se ious secu i y b eaches ound in he communica ion h ough MODBUS. Fig. 4. A comp omised MODBUS ne wo k opology IV. SUCCESSFUL ATTACKS A. A ack agains MODBUS/TCP p o ocol based sys ems 1) 1982 In 1982 a pa o he T ans-Sibe ian gas pipeline des oyed because o a T ojan i us go in o i s SCADA sys em. The explosion was equi alen wi h a h ee kilo ons o TNT. ANNALS OF THE ORADEA UNIVERSITY Fascicle o Managemen and Technological Enginee ing ISSUE #1, MAY 2015, h p://www.im uo adea. o/auo. m e/ 205 2) 2003 In 2003 a US hyd oelec ic powe plan decoy sys em los all con ol because o a hacke g oup called APT1 [1]. In 2003 se en Ame ican s a es needed he wo k p ope ly wi hou elec ici y because o a malwa e des oyed some CIS. The blackou caused many damage, among o he se ious hings, people died because o i [3]. 3) 2013 In 2013 wo Ame ican cybe secu i y expe s ook o e he con ol o an oil ig. I could ha e been cause se ious en i onmen al disas e [2]. The abo e lis ed e en s only a iny pa o he known a acks, and mos o hem happened because hese SCADA, CIS and ICS had somehow linked o he in e ne . Se e al publica ions and esea ches in es iga e he ulne abili ies o in e ne linked SCADA sys ems, o in o he wo ds MODBUS TCP based SCADA sys ems – as i men ioned be o e -, and o cou se se e al solu ion exis s. Ne e heless hese solu ion ocus on o p o ec SCADA sys ems om a acke who come om he in e ne . B. A ack agains MODBUS RTU p o ocol based sys ems 1) 2010 F om 2010 a malwa e called S uxne sys ema ically des oyed a i h o I an’s nuclea cen i uges by causing hem o spin ou o con ol. When he malwa e ins alled on a SCADA sys em i is able o access, ead, w i e, and dele e code blocks on he PLCs. I in ec s USB d i es, and hen sp ead like a common lu, ha is why he solu ions ha secu e agains MODBUS/TCP did no wo k in his pa icula case [4]. 2) 2011 In 2011 McA ee epo ed ha se e al o i s cus ome s (co po a ions in he ene gy sec o ) go hi by a se ies o a acks om Chinese o igin. The p ima y goal o he a acks was no o cause damage, bu o ga he in o ma ion on he a ec ed companies SCADA ne wo k s uc u e (and possible exploi able weaknesses) [5]. 3) 2013 In 2013 wo ICS expe comp omised mul iple indus ial acili ies h ough adio equency channel. They ook access o e empe a u e senso s, and was able o alsi y he eal da a [7]. The ICS-CERT (Indus ial Con ol Sys ems Cybe Eme gency Response Team) moni o ing epo o 2013 s a es ha in he i s hal o ha yea hey disce ned mo e han 200 a acks ha a ge ed ICS sys ems [6, 8]. In hei 2013 p esen a ion a he 30 h Chaos Communica ion Cong ess, he SCADA S angelo e eam epo ed hei indings abou he ulne abili ies o se e al indus ial p o ocols including MODBUS. They exploi ed “ze o day” bugs and ook o e en i e ne wo ks wi hin he ma e o hou s. When a iewe asked a e he p esen a ion i he eam could ake o e nuclea plan s o simila ne wo ks he p esen e s s a ed: “I would be be e o answe ha ques ion backs age, in p i a e.” V. CONCLUSION We come o he poin o answe he ques ions o he in oduc ion sec ion. The answe o he i s ques ion is clea ly no, we can say i because in he p e ious sec ion lo o success ul a acks we e p esen ed, and hese cases a e only he op o he icebe g. Answe ing o he second ques ion in he absence o a ho ough in es iga ion may seem o be guesswo k, bu i can be said ha e e y sys em – consis ing any ypes o de ices - depends on he unde lying communica ion channel. Tha is he eason, why we choose he MODBUS p o ocol as he main opic o he case s udy. As you can ead in he p e ious sec ions he e a e se e al possible solu ion o make MODBUS PLC communica ion mo e secu e, bu he e a e no any solu ion (o no c yp og aphically secu e solu ion) o MODBUS RTU. MODBUS communica ion p o ocols a e backbones o SCADA and CIS sys ems, which esponsible o c i ical asks, so uin such sys ems can cause no only eno mous ma e ial damage, bu can cos s li es. VI. FUTURE WORK A e in es iga ing hese cases we can say, ha a p ope solu ion is needed o make communica ion o e MODBUS RTU secu e, and make SCADA sys ems mo e eliable, om his poin o iew oo. In he nex mon hs we plan o design a secu e and c yp og aphically co ec communica ion p o ocol on he MODBUS RTU s anda d and implemen on AVR mic ocon olle s. REFERENCES [1] Simoni e, Tom. "Chinese Hacking Team Caugh Taking O e Decoy Wa e Plan . (2013) Online: h p://www. echnology e iew. com/news/517786/chinese-hacking eam- caugh - aking-o e -decoy-wa e -plan [2] Smi h. ”No cybe my hs: Hacking oil igs, wa e plan s, indus ial in as uc u e” (2013) Online: h p://www.ne wo kwo ld.com/a icle/2225104/mic oso - subne /no -cybe -my hs--hacking-oil- igs--wa e -plan s-- indus ial-in as uc u e.h ml [3] Acke man, Robe K. ”SCADA Sys ems Face Di e se So wa e A ack Th ea s” (July 31, 2013) Online: h p://www.a cea.o g/con en /?q=scada-sys ems- ace-di e se- so wa e-a ack- h ea s [4] Alb igh , Da id, Paul B annan, and Ch is ina Wal ond. “Did S uxne Take Ou 1,000 Cen i uges a he Na anz En ichmen Plan ?”. Ins i u e o Science and In e na ional Secu i y, 2010. [5] Keize , G egg. "‘Sloppy’Chinese hacke s sco ed da a- he coup wi h ‘Nigh D agon’." Compu e wo ld, Feb ua y 11 (2011). [6] S o m, Da lene. ” B u e- o ce cybe a acks agains c i ical in as uc u e, ene gy indus y, in ensi y” (July 2, 2013) Online: h p://www.compu e wo ld.com/a icle/2473941/cybe c ime- hacking/b u e- o ce-cybe a acks-agains -c i ical-in as uc u e-- ene gy-indus y--in ens.h ml [7] Apa, Lucas, and Ca los Ma io Penagos Hollman. "Comp omising Indus ial Facili ies om 40 Miles Away." IOAc i e Technical Whi e Pape (2013). [8] ICS-CERT Yea in Re iew, Indus ial Con ol Sys ems Cybe Eme gency Response Team, 2013 ANNALS OF THE ORADEA UNIVERSITY Fascicle o Managemen and Technological Enginee ing ISSUE #1, MAY 2015, h p://www.im uo adea. o/auo. m e/ 206