A SCADA MODBUS Network Scanner
ModScan
Agenda
Brief introduction to SCADA Systems ModScan Primer The MODBUS Protocol MODBUS/TCP ModScan Demonstration ModScan Project Information Q&A
Disclaimer
The material in this presentation is to be
used for authorized security scanning/ auditing
If you do something stupid with the
from me and we never met
information I present here, dont blame me
If you get caught, you didnt get the idea
What is SCADA?
Supervisory Control And Data Acquisition
is a system that centrally gathers data in real time from local and remote locations in order to control equipment and conditions. Control Systems (ICS), which is not accurate but close
Commonly also referred to as Industrial
Where is SCADA?
Power Generation/Transmission Water Treatment/Distribution Pipelines Trafc Control Systems Manufacturing Facilities National Infrastructure
SCADA Architecture
What is ModScan?
ModScan is a tool to detect open
MODBUS/TCP ports and identify device Slave IDs associated with IP addresses
ModScan is designed for an administrator
or security auditor to be able to accurately reconnoiter a MODBUS/TCP network
The MODBUS Protocol
About the Protocol Developed in 1979 by Modicon Free and Open Source The most common protocol found in
SCADA and ICS networks
Flavors Modbus RTU - Compact Binary Modbus ASCII - Human readable
Registered TCP port is 502
MODBUS Packet Construction
256 byte max ADU Slave ID Fn Code 1 byte 1 byte
ADU: Application Data Unit
Data 252 byte max PDU
Error Chk 2 bytes
PDU: Protocol Data Unit
Valid Function codes are 1-127 256 byte maximum packet size Big-Endian encoding Error Check is CRC/LRC
Function Codes
Function Code 01 02 03 04 05 06 07 08 0B 0C 0F 10 11 14 15 16 17 18 Description Read Coils Read Discretes Read Holding Registers Read Input Registers Write Coil Write Register Read Exception Status Diagnostics Get Comm Event Counter Get Comm Event Log Write Multiple Coils Write Multiple Registers Report Slave ID Read File Record Write File Record Mask Write Register Read/Write Multiple Registers Read FIFO Que
Diagnostic Codes
Function Code 00 01 02 03 04 05-09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 16+ Description Return Query Data Restart Communication Return Diagnostic Register Change ASCII Input Delimiter Force Listen Only Mode Reserved Clear Counters and Diagnostic Reg. Return Bus Message Count Return Bus Communication Error Count Return Bus Exception Error Count Return Slave Message Count Return Slave No Response Count Return Slave NAK Count Return Slave Busy Count Return Bus Character Overrun Count Reserved Clear Overrun Counter and Flag Reserved
Typical Communication
Master Slave Initiate Request
SID Fn Data Ec
Execute Command Initiate Response
SID Fn Data Ec
Receive Response
Modbus is a Master/Slave Serial Protocol Only Masters can initiate conversation
Error Communication
Master Slave Initiate Request
SID Fn Data Ec
Error Detected Report Error
SID EFn Error Code Ec
Receive Error
Error Function = 0x80 + Function Code Error Codes dened in specication
Addressing Valid Slave IDs 1-247 Slave ID must be unique per bus Masters do not have to have an address Slaves will error when improperly addressed Communication One request on the line at a time Masters must wait for responses
Modbus Notes
ModBus/TCP
ModBus protocol wrapped in TCP
Goodness
Checksum dropped Introduction of Gateways Port 502 is reserved for Modbus/TCP Basic protocol is unchanged
ModBus/TCP Architecture
ModBus/TCP Packet
MBAP Tran ID Proto ID Length SID Fn 2 2 2 1 1 PDU Data 252
Bytes
MBAP: MODBUS Application Protocol Header PDU remains the same from the MODBUS spec Protocol ID is always 0x0000 Big-Endian encoding
Example Request
Tran ID Proto ID Len SID FN Diag Code Data
Request sent by Master Request is to Slave 01 Fn 8 Diagnostics Diagnostic code 00 for Return Query Data
Example Response
Tran ID Proto ID Len SID FN Diag Code Data
Response sent by slave Request is to Slave 01 Fn 8 Diagnostics Diagnostic code 00 for Return Query Data Identical to Request
Error Request
Tran ID Proto ID Len SID FN Bad Diag Code
Request is to Slave 01 Fn 8 Diagnostics Diagnostic code FF sent
Error Response
Tran ID Proto ID Len SID FN Error Code (data)
Function code is 0x88 or 0x08 + 0x80 Specic Error codes are returned in data eld Error 0x03 is Illegal data value
Errors are the Key
When an improper SID is sent The slave will not respond The slave will respond with FN+0x80 When a proper SID is sent The slave will respond with a valid
response
This forms the basis for mapping
ModScan
Modscan Scans the IP range provided for
open TCP 502
When an open port is found it nds the
SID via brute force
By default it stops after rst discovered SID Output in IP:Port\tSID format
Options
-p PORT (502) -t TIMEOUT socket timeout (100 mills) -a --aggressive Aggressive Mode -f FUNCTION MODBUS Function Code (17) --data Data for use with -f -v, -d Verbose, Debug
ModScan Demonstration
Scanning our sample network A look at a pcap Demo of additional Options
ModScan Project
http://modscan.googlecode.com Uses Network Enumeration IDS/Network Monitoring Test Asset Management Bulk Commands
Known Issues
Really, Really Noisy Port Scanning bits are not efcient Brute forcing SIDs is noisy Does not interpret Error Codes or
responses
Can generate false negatives
Planned Enhancements
Interpret Error Codes Implement with SCAPY Additional Protocol Support Device Fingerprinting Anything cool someone suggests....
References & Thanks
http://en.wikipedia.org/wiki/SCADA http://www.modbus.org/specs.php http://www.wingpath.co.uk Kathleen Whalen Jim Kelly Doug Wilson
Contact Information
Mark Bristow [email protected] modscan.googlecode.com onelittlewindow.org
Questions?
