LetsDefend: Compromised ICS Device — a PLC, a water pump and Modbus

A water treatment plant with a compromised PLC. Learning Modbus from scratch, tracing the brute force, and the one-space filter mistake that cost me an hour.

A water treatment plant. The PLC running the pumps and filtration is behaving strangely, and we've been called in to work out why.

That is not a detour. That is the job.

Careful

Learn from me. Open every file you're given before you start.

The alternative route, in Wireshark:

Note that down — it comes back later.

There were several login attempts, so I went with the obvious:

Same response, same packet. The successful login has the username and password in it — the account is the PLC operator account, and the password is a Breaking Bad reference.

(I've never watched the show. Apparently it's good.)

I scrolled a long way to find it. I could have saved myself the time with:

I didn't know. So — Google.

When you don't know: google it. Always, always, always.

Two questions here: when was the pump first turned on, and what state was it left in.

Which meant what I actually wanted was the opposite:

Careful

Open that up and the timestamp is right there.

I did a lot of research on this one that wasn't strictly required to answer any question. I'd do it again — it's the difference between answering a question and understanding a system.

To solve any challenge you don't understand, do what a good researcher does and google it relentlessly. You don't have to be a developer. You have to be curious about how the thing works.

And when your brain really hurts — that's how you know you're getting better.

I'm quite proud of this one!

Contents

Skills covered