full-disclosure - Re: scada/plc gear

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4784CFDD.8070500@rogers.com>
Date: Wed, 09 Jan 2008 08:45:01 -0500
From: gmaggro <gmaggro@...ers.com>
To: Full Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: scada/plc gear

> That is certainly
> some rather odd behaviour...  The fact that the other ports remained
> makes it likely an application (modbus) problem.

Yes, I thought it was interesting. I really wish I didn't fry the thing 
as I'd like to have eliminated the possibility it was something funny on 
my end.

So far, not a great record - these things seems about as robust as 
network printers, which is to say, not very.

> Was it an ethernet
> to rs232 converter?  (I obviously didn't look up the part number).

RS-485 to Ethernet.

> Did you happen to catalogue the 'crud' which you sent prior to
> failure?

I wish I had; but it was nothing unusual. I like to start out by 
scanning and hammering these devices with common tools, so I used nmap, 
nessus and amap. If I had to pick something, it would be setting amap on 
502/tcp overnight that did it.

> I know particular header options have unexpected results a
> great deal of control systems.  I also know particular vendor's ip
> stack implementations have been known to be produced some very things,
> eg, odd ip options (off the top of my head the AB series of PLCs).

Yes indeed, I can not wait to get my hands on some real PLCs, and not 
just these little converters or more modern pieces.

> Now I'm curious, what other devices are you testing?

2 more devices arrived yesterday:

- i.Board i.CanDoIt embedded webserver 
(http://www.csimn.com/CSI_pages/iboard.html) which is built similar to 
the Kohler in that it uses an embedded ethernet module, but this time 
from Digi (http://www.digi.com/products/embeddedsolutions/digiconnectme.jsp)

- ADAM-4572 (http://www.ucs.co.uk/index.php?pid=948)

- Lantronix MSS485-T 
(http://www.lantronix.com/device-networking/external-device-servers/mss485-t.html)

- Phoenix Contact FL IL 24 BK-PAC (http://tinyurl.com/2c6x96)

- DLI Ethernet DIN Relay (http://www.digital-loggers.com/din.html)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/