An Internet-wide view of ICS devices

Industrial control systems have become ubiquitous, enabling the remote, electronic control of physical equipment and sensors. Originally designed to operate on closed networks, the protocols used by these devices have no built-in security. However, despite this, an alarming number of systems are connected to the public Internet and an attacker who finds a device often can cause catastrophic damage to physical infrastructure. We consider two aspects of ICS security in this work: (1) what devices have been inadvertently exposed on the public Internet, and (2) who is searching for vulnerable systems. First, we implement five common SCADA protocols in ZMap and conduct a survey of the public IPv4 address space finding more than 60K publicly accessible systems. Second, we use a large network telescope and high-interaction honeypots to find and profile actors searching for devices. We hope that our findings can both motivate and inform future work on securing industrial control systems.

I. Introduction

Industrial control systems (ICS) are pervasive and control critical infrastructure ranging from power grids and chemical manufacturing plants to the environmental monitoring and fire suppression controls in commercial buildings. These systems communicate over a myriad of domain and manufacturer specific protocols that have grown organically over the past 40 years, including Modbus, BACnet, DNP3, and Siemens S7. Originally designed to operate in a closed environment, these protocols have no built-in security. However, despite this, protocols were layered on Ethernet and TCP/IP, and inevitably devices have been connected to the public Internet to support remote monitoring and management. In this paper, we investigate the devices exposed on the Internet and the malicious actors searching for them.