Rodríguez, Ricardo J.; Marrone, Stefano; Marcos, Ibai; Porzio, Giuseppe
MOSTO: A Toolkit to Facilitate Security Auditing of ICS Devices using Modbus/TCP Journal Article
In: Computers & Security, vol. 132, pp. 103373, 2023.
Abstract | Links | BibTeX | Tags: Industrial Control Systems, Modbus, Penetration Testing, Security Auditing
@article{RMMP-COSE-23,
title = {MOSTO: A Toolkit to Facilitate Security Auditing of ICS Devices using Modbus/TCP},
author = {Ricardo J. Rodríguez and Stefano Marrone and Ibai Marcos and Giuseppe Porzio},
url = {http://webdiis.unizar.es/~ricardo/files/papers/RMMP-COSE-23.pdf},
doi = {10.1016/j.cose.2023.103373},
year = {2023},
date = {2023-01-01},
urldate = {2023-01-01},
journal = {Computers & Security},
volume = {132},
pages = {103373},
abstract = {The integration of the Internet into industrial plants has connected Industrial Control Systems (ICS) worldwide, resulting in an increase in the number of attack surfaces and the exposure of software and devices not originally intended for networking. In addition, the heterogeneity and technical obsolescence of ICS architectures, legacy hardware, and outdated software pose significant challenges. Since these systems control essential infrastructure such as power grids, water treatment plants, and transportation networks, security is of the utmost importance. Unfortunately, current methods for evaluating the security of ICS are often ad-hoc and difficult to formalize into a systematic evaluation methodology with predictable results. In this paper, we propose a practical method supported by a concrete toolkit for performing penetration testing in an industrial setting. The primary focus is on the Modbus/TCP protocol as the field control protocol. Our approach relies on a toolkit, named MOSTO, which is licensed under GNU GPL and enables auditors to assess the security of existing industrial control settings without interfering with ICS workflows. Furthermore, we present a model-driven framework that combines formal methods, testing techniques, and simulation to (formally) test security properties in ICS networks.},
keywords = {Industrial Control Systems, Modbus, Penetration Testing, Security Auditing},
pubstate = {published},
tppubtype = {article}
}
The integration of the Internet into industrial plants has connected Industrial Control Systems (ICS) worldwide, resulting in an increase in the number of attack surfaces and the exposure of software and devices not originally intended for networking. In addition, the heterogeneity and technical obsolescence of ICS architectures, legacy hardware, and outdated software pose significant challenges. Since these systems control essential infrastructure such as power grids, water treatment plants, and transportation networks, security is of the utmost importance. Unfortunately, current methods for evaluating the security of ICS are often ad-hoc and difficult to formalize into a systematic evaluation methodology with predictable results. In this paper, we propose a practical method supported by a concrete toolkit for performing penetration testing in an industrial setting. The primary focus is on the Modbus/TCP protocol as the field control protocol. Our approach relies on a toolkit, named MOSTO, which is licensed under GNU GPL and enables auditors to assess the security of existing industrial control settings without interfering with ICS workflows. Furthermore, we present a model-driven framework that combines formal methods, testing techniques, and simulation to (formally) test security properties in ICS networks.