3 ms·

I would like to see some authentication and encryption in the communications protocols like modbus and ethernet IP. Could be as simple as entering the same pha

I would like to see some authentication and encryption in the communications protocols like modbus and ethernet IP. Could be as simple as entering the same phassphrase on the client and the server. If you don't have the passphrase your requests are dropped or you can't decrypt any packets you might get your hands on. I can't see why that wouldn't be achievable. Yes it would take some extra processing power on the PLCs and would generate a bit more heat. It would have to be implemented by Schneider and Rockwell, who have been pushing all responsibility for security to the network level. At least the latest schneider PLC, the m580, allows for requiring a password to connect using the programming software[0], and also some ability to restrict what client IPs can connect[1]. The m580 was released in the last two years, so everything prior to 2016 doesn't have those features and comes set up to allow anonymous upload of new firmware by TFTP. [0]: https://www.schneider-electric.ca/en/faqs/FA238215/ https://www.schneider-electric.ca/en/faqs/FA238215/ [1]: https://www.schneider-electric.com/en/faqs/FA282558/ https://www.schneider-electric.com/en/faqs/FA282558/

jdblair 9y ago
The problem with requiring a plaintext password is that it may slow down attacks when a device is simply connected to the open internet, but it is trivial to defeat in all other cases. Modbus RTU is broadcast, so you would just listen for the password. Modbus TCP can be defeated with ARP stuffing and man-in-the-middle attack (I've seen this automated for taking over SCADA systems). A better solution would be a shared symmetric key that is manually programmed into all devices. However, this complicates install and maintenance. Its a hard sell when your controls are installed by contractors paid by the hour. Pretty soon everyone is setting their 128-bit key to 0x12345678 so nobody forgets it during emergency maintenance.
- snowwindwaves 9y ago
  Substitute passphrase in my post with shared symmetric key. It is still a string you have to enter on both ends. if the underlying mechanisms just work in every case except for key mismatch and give you a good error message in that case, requiring your contractors to enter the same string in two devices that they already have to program is going to be hard for them to justify as a great additional expense.

jdblair 9y ago

The problem with requiring a plaintext password is that it may slow down attacks when a device is simply connected to the open internet, but it is trivial to defeat in all other cases. Modbus RTU is broadcast, so you would just listen for the password. Modbus TCP can be defeated with ARP stuffing and man-in-the-middle attack (I've seen this automated for taking over SCADA systems). A better solution would be a shared symmetric key that is manually programmed into all devices. However, this complicates install and maintenance. Its a hard sell when your controls are installed by contractors paid by the hour. Pretty soon everyone is setting their 128-bit key to 0x12345678 so nobody forgets it during emergency maintenance.

snowwindwaves 9y ago
Substitute passphrase in my post with shared symmetric key. It is still a string you have to enter on both ends. if the underlying mechanisms just work in every case except for key mismatch and give you a good error message in that case, requiring your contractors to enter the same string in two devices that they already have to program is going to be hard for them to justify as a great additional expense.