Sniffing SCADA: Industrial Protocol Analysis & Security Auditing
UCSD researcher Karl Koscher breaks down industrial SCADA protocol sniffing, analyzing Modbus, DNP3, and proprietary control communications.
Summary
The Vulnerable Architecture of Legacy ICS/SCADA Networks
Industrial Control Systems (ICS) historically relied on physical isolation, resulting in unencrypted, unauthenticated communication protocols operating over serial and IP buses.
Dissecting Modbus TCP, DNP3, and EtherNet/IP
Karl Koscher analyzes standard SCADA protocol frame formats, demonstrating how attackers inspect register read/write commands and spoof control telemetry.
Passive Sniffing and Active Injection Tools
Koscher demonstrates deploying software tools and hardware taps to capture PLC communication streams and inject rogue actuator setpoints.
Hardening Industrial Network Perimeters
The presentation reviews deep packet inspection firewalls, protocol anomaly detection, and cryptographic modernization for critical infrastructure.
Related talks
Village Presentations·39 min
K. Reid Wightman
K. Reid Wightman investigates vulnerability inheritance in industrial PLCs, demonstrating how shared third-party network stacks propagate critical zero-days.
Village Presentations·38 min
Kenneth Shaw
Kenneth Shaw introduces 'The Grid', an interactive multiplayer physical simulation modeling cyberattacks, substation failures, and cascading power blackouts.
Black Hat·47 min
Presenters detail vulnerability discovery and exploitation in Exfiltrating Reconnaissance Data from Air-Gapped ICS/SCADA Networks.