Modbus Man-In-The-Middle | SANS ICS Concepts

This SANS ICS concept overview covers conducting a Man-in-the-Middle attack to modify Modbus data between an HMI and a PLC. This attack is performed using a specially crafted Ettercap filter to identify Modbus writes and drop the packets so that they are not delivered to the endpoint. The Ettercap filter will not block or modify Modbus read traffic allowing. This situation results in a normal view of the process but implements a loss of control.
Script by Don C. Weber (@cutaway), Certified SANS Instructor and Cutaway Security, LLC
Don C. Weber is the Principal Consultant and Founder at Cutaway Security, LLC, an information security consulting company based in Texas. Don's previous experiences include large-scale incident response efforts for organizations with international assets and interests, the certification and accreditation of classified federal and military systems, assessment and penetration testing of worldwide commercial assets, and, as a Navy contractor, the management of a team of distributed security professionals responsible for the security of mission-critical Navy assets. Don has achieved his master's degree in network security, the Certified Information Systems Security Professional (CISSP) certification, and many GIAC certifications. Don was a founding member of the GIAC Ethics Council of which he was the GIAC EC Chair in 2009. Don regularly contributes to a wide variety of open source projects involving information security and incident response. Learn more about Don at www.sans.org/profiles/don-c-w...
CISA Alerts:
Alert (TA15-120A) Securing End-to-End Communications - us-cert.cisa.gov/ncas/alerts/...
Alert (TA17-075A) HTTPS Interception Weakens TLS Security - us-cert.cisa.gov/ncas/alerts/...
ICS MitM Research:
Man-In-The-Middle Attack Against Modbus TCP Illustrated with Wireshark - www.sans.org/reading-room/whi...
Man-in-the-SCADA - www.blackhat.com/docs/asia-17...
Overview of Cyber Vulnerabilities - us-cert.cisa.gov/ics/content/...
0x5 Modbus Security - Modbus and IOT MiTM - • 0x5 Modbus Security - ...
Packet Modification Attack on PLC with ARP Spoofing (MITM Attack) - / packet-modification-at...
An Analytics Framework for Heuristic Inference Attacks against Industrial Control Systems - arxiv.org/pdf/2101.11866.pdf
Towards Understanding Man-In-The-Middle Attacks on IEC 60870-5-104 SCADA Networks - www.iqpc.com/media/1001897/45...
References:
Modbus Ettercap Filter - github.com/cutaway-security/c...
Modbus - en.wikipedia.org/wiki/Modbus
rodbus-client - github.com/stepfunc/rodbus
Ettercap - www.ettercap-project.org/
etterfilter - linux.die.net/man/8/etterfilter
etterfilter Examples - github.com/Ettercap/ettercap/...
SANS ICS Training:
ICS410: ICS/SCADA Security Essentials - www.sans.org/cyber-security-c...
ICS456: Essentials for NERC Critical Infrastructure Protection - www.sans.org/cyber-security-c...
ICS515: ICS Active Defense and Incident Response - www.sans.org/cyber-security-c...
ICS612: ICS Cybersecurity In-Depth - www.sans.org/cyber-security-c...

[@imgsrcxonerrorprompt021]

Thank you Weber sir for covering this topic in details , its very resourceful. in future video can you please cover other ICS protocols like CIP , PROFINET, DNP3 and also how we can interact with these PLC in order to find Vulnerability ,like in IT Web security we use Proxy tools [Burpsuite ZAP etc], in similar way how we see the communication [if Wireshark is way then how we can use it to modify and replay the packets] between PLCs and HMI. Another Thing is How we Do Fuzzing in these ICS protocols to find vulnerability. also what are the common vulnerability exist in ICS . Cover these in future if possible. thank you :)

[@secripcord]

Thank you for the comment. I have already scheduled time with several individuals to cover additional protocols. We may not redo the MitM attack for them. But we will discuss their use, implementation, and security concerns. As to fuzzing, I will add that concept to our list. I appreciate your input.

[@imgsrcxonerrorprompt021]

@@secripcord thank you,i will wait for new video

[@abubakarmohammed6072]

Thanks for the well laid out explanations. Can you please do a video with the Emerson ROC800 series RTU using modbus being attacked? Or do you only use Siemens PLCs?

[@secripcord]

@Abubakar I used a device that I had on-hand. The actions would be similar for any type of device. The difference would be the industrial protocol being used and the behavior being modified. You should be able to leverage this to help you achieve your research and testing goals. I hope that answers your question.

[@aslannoah9835]

Nice video though I think Ettercap graphical would have been far more intuitive for beginners. It would illustrate the concept without getting bogged down by the command line instructions