In this course, we learned to understand what adversaries
targeting operational technology and industrial control systems
want and how they go about achieving it.
We began our journey with the first step of the cybersecurity kill chain.
Tools such as Shodan and Censys are incredibly powerful for gathering
information about internet‑connected technologies, including industrial
control systems. Searching by IP address, vendor, or protocol, and applying
filters to narrow down the search,
we were able to identify a number of internet‑connected technologies that
revealed information about internal network configurations,
firmware versions, operating systems, and other devices connected to the network.
Gaining access to ICS networks is outside the scope of this course,
but we reviewed a number of other Pluralsight courses that show you
how to do that, so we applied an assumed access model. Once inside, we
used nmap to enumerate devices,
search for running services, and identify operating systems.
We also used the nmap scripting engine to search for connected Modbus devices.
Having identified a number of web servers running on internal devices,
we searched for and attempted to use default logging credentials
for a PLC and a SCADA system with some success.
Finally, we used Wireshark to monitor Modbus communications on the network.
Modbus is an unencrypted protocol that doesn't require authentication
between endpoints, so we were able to inspect individual packets
identifying the transaction ID, as well as the function codes and data
fields that made up the protocol data unit.
Next, we moved on to learning about creating our own network
packets using the Python program, Scapy. Scapy is a packet
crafting tool that can forge, capture, and decode packets,
send them on the wire, and match requests and replies.
It can be used for scanning, tracerouting,
probing, network discovery, and much more.
We took all the information we'd gathered and techniques we'd learned
about and applied them in our target OT environment.
By monitoring the Modbus traffic,
we were able to sniff an ACK packet to use as a seed to predict the
TCP sequence values. We were then able to generate and inject our
own Modbus packet that correctly followed the TCP sequence expected
by the operational technology,
but with a malicious payload contained in the data field.
Finally,
we reflected on the importance of establishing a cybersecurity strategy to
form the basis of implementing effective and proportionate cybersecurity
controls in an industrial control systems environment.
I hope you've enjoyed watching this course as much as I've
enjoyed creating it. I'll see you next time for more great
security content here on Pluralsight.