Finding Industrial Control Systems (ICS/SCADA) on the Internet

Industrial Control Systems (ICS) and SCADA systems are routinely discoverable on the internet by leveraging specialized search engines like Zondex, which meticulously index public-facing devices by scanning IP addresses, ports, and identifying banner information, protocols, and known vulnerabilities. Unlike general-purpose search, platforms like Zondex specifically map the attack surface of operational technology (OT), enabling security researchers to pinpoint exposed controllers, Human Machine Interfaces (HMIs), and other critical infrastructure components, often revealed through common industrial control systems shodan style queries that expose direct port access or weak authentication.

The Pervasive Exposure of ICS/SCADA

Many assume that critical infrastructure elements like ICS and SCADA systems operate in air-gapped or entirely isolated networks. This is frequently not the case. The push for remote management, data analytics, and integration with enterprise IT networks has led to an increasing number of OT systems gaining direct or indirect internet connectivity. While often facilitated through VPNs or firewalls, misconfigurations, default credentials, and unpatched vulnerabilities can inadvertently expose these systems directly to the public internet.

This exposure presents significant risks. A compromised ICS could lead to physical damage, environmental incidents, production outages, or even endanger human life. Recent incidents, such as the Colonial Pipeline ransomware attack, highlight the cascading effects of cyberattacks on critical infrastructure, underscoring the urgent need for robust security postures and proactive discovery of exposed systems.

Why ICS/SCADA Systems End Up Online

Several factors contribute to the online presence of ICS/SCADA components:

• Remote Access Requirements: Operators and vendors need remote access for monitoring, maintenance, and troubleshooting, often leading to direct internet exposure without proper security controls.
• Legacy Systems: Many older ICS components were not designed with modern cybersecurity in mind. Updating or replacing them can be costly and disruptive, leading to prolonged use of vulnerable systems.
• Misconfigurations: Incorrect firewall rules, open ports, default passwords, or lack of segmentation can inadvertently expose systems.
• IT/OT Convergence: The integration of operational technology with information technology (IT) networks for data collection and analysis can create new pathways for exposure if not managed securely.
• Vendor Requirements: Some vendors require specific ports to be open for updates or support, which can be misconfigured to be globally accessible.

Identifying Common ICS Protocols and Ports

Finding ICS/SCADA devices requires knowledge of the unique protocols and ports they typically use. Zondex, like other internet scanning platforms, indexes services running on these well-known ports, making it possible to identify potential ICS components. Here are some of the most common protocols and their default ports:

This table represents a critical starting point for any industrial control systems shodan or Zondex search targeting OT devices. Identifying services on these ports often indicates the presence of an ICS component.

Discovering ICS/SCADA with Zondex

Zondex provides a powerful and intuitive interface to search for internet-connected devices, including those within critical infrastructure. Similar to traditional industrial control systems shodan queries, Zondex allows you to combine filters to narrow down your results, focusing on specific ports, protocols, products, organizations, or countries. Zondex serves as a robust Shodan alternative with its extensive indexing capabilities and advanced query language.

Basic Zondex Queries for ICS/SCADA

To begin, you can search for common ICS ports. For example, to find devices exposing Modbus/TCP:

port:502

This query will return all hosts with port 502 open. To refine this, you can look for specific protocols or banners that indicate Modbus:

port:502 product:modbus

Or, for Siemens S7 controllers:

port:102 protocol:s7comm

Combining these with geographic filters can help target specific regions:

port:102 protocol:s7comm country:US

If you're interested in building automation systems (BACnet), you might query:

port:47808 protocol:bacnet

Advanced Zondex Queries for Deeper Insights

Zondex's query language allows for complex searches, enabling security professionals to pinpoint specific vulnerabilities or vendor devices. You can chain filters, use logical operators, and search for specific string patterns in banners.

To find Rockwell Automation (Allen-Bradley) Ethernet/IP devices:

port:44818 product:"Rockwell Automation" OR product:"Allen-Bradley"

Searching for specific Common Vulnerabilities and Exposures (CVEs) relevant to ICS can be highly effective. For instance, while not strictly ICS-specific, if a Log4j vulnerability (CVE-2021-44228) was found in an HMI or SCADA application, you could quickly identify exposed instances:

vuln:CVE-2021-44228 product:hmi OR product:scada

Similarly, you can look for specific product versions known to be vulnerable. For example, older versions of a popular PLC vendor's web interface:

product:Siemens version:"<x.y.z" port:80 OR port:443 tag:webui

To discover potentially misconfigured SCADA web interfaces, you might search for common administrative panel keywords combined with relevant ports:

port:8000 OR port:8080 OR port:443 http.html:"SCADA Admin" OR http.html:"control panel"

Zondex also allows filtering by organization, which can be useful for targeting specific companies or sectors. For instance, identifying all devices belonging to a particular utility company's Autonomous System (AS):

as:"Example Power Utility" port:502 OR port:102

Leveraging Zondex's capabilities for Automating Vulnerability Discovery and Mastering CVE Exposure Tracking empowers security teams to proactively identify and address risks within their or their clients' OT environments. For comparison, identifying similar exposures in other critical systems like Exposed MongoDB Databases uses analogous techniques.

Interpreting Results and Responsible Disclosure

Discovering an exposed ICS/SCADA system requires a responsible approach. Directly interacting with these systems without explicit authorization can have severe consequences, including legal repercussions and system disruption. The primary goal of such discovery should be to inform asset owners of their exposure so they can secure their critical infrastructure.

Ethical Considerations and Best Practices:

1. Do Not Interact: Avoid sending commands, attempting logins, or performing any actions that could impact the stability or security of the discovered system.
2. Verify, Do Not Test: Confirm the system is indeed an ICS/SCADA component through passive reconnaissance (banner grabbing, port analysis) rather than active penetration testing.
3. Responsible Disclosure: If you identify an exposed system, attempt to contact the asset owner or the relevant Computer Emergency Response Team (CERT) through official channels. Many countries have specific CERTs for critical infrastructure.
4. Documentation: Keep detailed, accurate records of your findings, including IP addresses, ports, detected protocols, and any relevant banner information.

These responsible practices are crucial for security professionals and align with the principles governing the use of security team tools for threat intelligence and attack surface management.

Mitigating ICS/SCADA Internet Exposure

Identifying exposed ICS/SCADA systems is the first step; securing them is the ultimate objective. Organizations operating critical infrastructure must implement a multi-layered security strategy.

Essential Mitigation Strategies:

1. Network Segmentation: Implement strict network segmentation to isolate OT networks from IT networks and the public internet. Use demilitarized zones (DMZs) for any necessary interfaces.
2. Firewall Rules: Configure firewalls with the principle of least privilege, allowing only essential traffic to and from ICS components. Block all inbound connections from the internet by default.
3. Secure Remote Access: If remote access is required, enforce strong authentication (e.g., multi-factor authentication), use secure VPNs, and ensure remote access points are regularly audited and hardened. Technologies like GProxy can aid in secure and anonymous browsing for initial reconnaissance if necessary, but direct management should use established secure channels.
4. Patch Management: Regularly patch and update ICS software, firmware, and operating systems. While challenging due to uptime requirements, a robust patch management program is vital for addressing known vulnerabilities.
5. Default Credential Removal: Change all default passwords immediately upon deployment and enforce strong, unique passwords for all accounts.
6. Intrusion Detection/Prevention Systems (IDPS): Deploy IDPS specifically designed for OT environments to monitor for suspicious activity and known attack patterns.
7. Regular Audits and Scans: Conduct regular security audits, vulnerability assessments, and penetration tests on both IT and OT networks. Tools like Zondex can facilitate continuous monitoring of external exposure, and services like WebTrackly can help monitor web-facing applications for changes or unauthorized access.
8. Employee Training: Train personnel on cybersecurity best practices, social engineering awareness, and incident response procedures.

Key Takeaways

• ICS/SCADA systems are often exposed to the internet due to remote access needs and misconfigurations, contrary to common assumptions.
• Specialized search engines like Zondex, similar to industrial control systems shodan, are essential tools for discovering these exposed critical infrastructure components.
• Knowledge of common ICS protocols (Modbus/TCP, Siemens S7, DNP3, Ethernet/IP) and their default ports is crucial for effective discovery.
• Zondex offers powerful query capabilities, enabling targeted searches by port, product, protocol, and even specific CVEs affecting OT systems.
• Responsible disclosure and ethical conduct are paramount when identifying exposed critical infrastructure; direct interaction with systems without authorization is prohibited.
• Robust mitigation strategies, including network segmentation, strong firewalls, secure remote access, and regular patching, are vital to protect ICS/SCADA environments.

Actionable Next Steps with Zondex

Proactively identifying and understanding your organization's internet-facing attack surface is a critical first step in securing industrial control systems. Zondex provides the platform to conduct these vital investigations. Begin by exploring common ICS ports and protocols today:

• Find Modbus/TCP devices: port:502 product:modbus
• Identify Siemens S7 controllers: port:102 protocol:s7comm
• Search for DNP3 on the internet: port:20000 protocol:dnp3
• Discover BACnet/IP building automation: port:47808 protocol:bacnet
• Locate exposed HMI web interfaces: port:8080 http.html:HMI

Leverage Zondex to continuously monitor for exposures and ensure your critical infrastructure remains secure. Your organization's resilience depends on it.