Operational Technology (OT) refers to systems used to monitor and control industrial operations. Industrial Control Systems (ICS) includes systems used to monitor and control industrial processes.

If IT operators have dozens of years of experience securing networks, systems and applications, OT operators are pretty new to this topic. Moreover in OT/ICS development availability is always preferred over integrity and confidentiality. In other words ICS softwares are designed to be fast but, often, insecure.

Supervisory Control and Data Acquisition (SCADA) systems are used to control and automate industrial processes. SCADA systems includes:

• Supervisory computers: the servers used to manage the process gathering data on the process and communicating with filed devices (PLC/RTU). In smaller deployments HMI is embedded in a single computer, in larger deploy HMI is installed into a dedicated computer.

• Programmable Logic Controllers (PLC): digital computers used mainly for automating industrial processes. They are used to continuously monitor sensors (input) and make decisions controlling devices (output).

• Remote Terminal Units (RTU): nowadays RTUs and PLCs functionalities overlap with each other. RTUs are usually preferred for wider geographical telemetry whereas PLCs are better with local controls.

• Communication network: the network connecting all SCADA components (Ethernet, Serial, telephones, radio, cellular...). Network failures do not necessarily impact negatively on the plant process.  Both RTU's and PLC's should be designed to operate autonomously, using the last instruction given from the supervisory system.

• Human Machine Interface (HMI): displays a digitalized representation of the plant. Operators can interact with the plant issuing commands using mouse, keyboards or touch screens. Operators can make supervisory decisions adjusting or overriding the normal plant behaviour.

In short and simple words:

• industries are managed by sophisticated, mission critical computers (SCADA systems);

• security is not the first priority in OT/ICS;

• operators can manually override the behaviour of the plant via mouse/keyboard/touchscreen, locally or remotely;

• a malicious software can override the behaviour of the plant like HMI does.

For more information see Guide to Industrial Control Systems (ICS) Security (NIST 800-82).

Modbus is an industrial protocol developed by Modicon, acquired by Schneider Electric. Modbus is widely used to connect industrial devices; protocol specification is available and royalty-free.

Modbus protocol is a master/slave protocol: the master reads and writes slaves' registers.

Modbus RTU is usually used via RS-485 (serial network): one master is present with one or more slaves. Each slave has an unique 8-bit address. 

Modbus data is used to read and write "registers" which are 16-bit long. The most common register is called "holding register" which is readable and writable; registry type "input register" is readable only. The registers "coil" and "discrete input" are 1-bit long: coils are readable and writable, discrete inputs are readable only.

Modbus register types:

• Discrete Input (Status Input): 1bit, RO

• Coil (Discrete Output): 1bit, R/W

• Input Register: 16bit, RO

• Holding Register: 16bit R/W

Most commonly Modbus function:

Modbus TCP encapsulates Modbus RTU request and response data packets in a TCP packet transmitted over standard Ethernet networks. The TCP Modbus standard port is 502.

For more information see Modbus 101 - Introduction to Modbus.

Before starting, download the attached script package and install the Modbus TCP library for Python with the following command:

pip3 install pymodbus==1.5.2

Connect to the plant using the browser (http://MACHINE_IP) and learn how the bottle-filling plant works.

We have three phases:

1. Initialization: the plant is starting from the beginning. The roller moves the first bottle under the nozzle.

2. Filling: once a bottle is under the nozzle, the nozzle opens and the water flows in the bottle.

3. Moving: once the bottle is filled, the roller starts again moving the next empty bottle under the nozzle.

When the phase 3 ends, the plant starts again with phase 2.

From the three phases described above, we can observe:

• Sensors: used to read a state of the plant.

• Actuators: used to alter the state of the plant.

Example: a sensor can detect if a bottle is under the nozzle, while an actuator can open or close the nozzle.

Mind we can press the ESC button to start the plant from the beginning.

VirtuaPlant can be downloaded from GitHub.

On the previous task, we learned a lot about registries:

• Bottle-filling plant exposes 16 registries, but only 5 are used.
• Registry 16 is associated with the start/stop button: 1 means plant is on, 0 means plant is off.
• Registries 1 and 3 usually have the same value, except in the initialization phase.
• Registries 2 and 4 always have the same value.

We observed three phases, and the associated registries are:

• Initialization: [0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]
• Filling: once a bottle is under the nozzle, the nozzle opens and the water flows in the bottle.
• Moving: once the bottle is filled, the roller starts again moving the next empty bottle under the nozzle.

We also assumed the plant has two sensors and three actuators. Actuators:

• Start/stop button: registry 16.
• Roller engine: registry 3.
• Nozzle: registry 2 or 4. We need to spend additional time on that.

Sensors:

• Water level: 1 (red sensor)
• Bottle position: 2 or 4 (green sensor). We need to spend additional time on that.

Now play with set_registry.py script and find out which registries are associated with the nozzle.

On the previous tasks, we figured out how registries work:

• Registry 1: associated with the bottle sensor. Value is 1 if the bottle is under the nozzle.

• Registry 2: associated with the water level sensor. Value is 1 if the bottle is filled.

• Registry 3: associated with the roller actuators. Value 1 turns the roller on.

• Registry 4: associated with the nozzle. Value 1 opens the nozzle.

• Registry 16: associated with the plant. Value 1 starts the plant

We can abuse the registries forcing a custom value to the above registries. We can do that in many ways.

Mind that the plant manager will shut down the plant if an abnormal condition is detected.