Flow-Through
Client loginLogin

Labs

Control networks, built to be attacked and defended.

Each lab is an isolated, running model of a real control network on loopback, with a fictional plant and a fictional vendor, so a demonstration runs end to end and everything it touches belongs to the lab.

01Water treatment plant · EtherNet/IP and CIP

A small works on one controller, with a replayable attack.

The plant is a small conventional works, from intake through coagulation and filtration to chlorination and distribution, on an open-source EtherNet/IP stack standing in for a CompactLogix-class programmable logic controller, scanning remote I/O in each treatment area.

The protocol is EtherNet/IP carrying CIP. Explicit messaging runs on TCP 44818 and cyclic I/O on UDP 2222. The controller exposes its data as numbered assemblies. Assembly 100 carries the true sensor readings and assembly 150 the writable setpoints and commands. Assembly 154 is the HMI table the operator’s screen reads. CIP grants read and write to any host that reaches port 44818, and that trust model is the ground every attack class in the report stands on.

The console is the operator’s screen over the running plant: a tag list, graphics, trends and alarms, with a Simulate attack control that replays the captured run and an evidence dock that opens the packet behind each attacker event, down to its frame in the capture.

The water plant console: the process tree at the left and the tag list over the running plant, with the replay transport and the Simulate attack control above it.
Fig. 01The water plant console, on the tag list.Open the console

Two readings from the captured run.

  • 11.14 mg/LTrue chlorine residual, captured run
  • 1.02 mg/LResidual on the operator’s screen, same moment
  • 380 kPaDistribution pressure, before
  • 54 kPaDistribution pressure, after; the global alarm fires
The report: attacking and defending an EtherNet/IP water controller

02Data-centre building management · BACnet/IP

A chilled-water hall, from the head end to the vendor remote-access paths into it.

The building lab is a running BACnet model of a chilled-water data-centre hall, served over BACnet/IP on loopback under neutral branding: 30 devices and 819 points, of which the console’s own metadata marks 127 writable.

The fleet runs from the chillers through the cooling-tower and pump drives to the CRAH units in the hall, with the electrical plant behind them and the vendor remote-access paths into it, each device built from its vendor’s published integration documents.

An unauthenticated enumeration runs a directed Who-Is sweep, fingerprints each device by vendor and model, and returns the full readable point set. Every setpoint and command is reachable by any host on the segment, since the protocol answers every host alike.

Where a building’s control systems meet the outside, and who can reach each one.

A building from the footpathA seven-storey commercial building seen from the footpath, drawn in line, with plant on the roof, a lift motor room, a mast, and the entry at street level. Some windows are lit, following the time of day in Canberra.the internetcontractors and vendors1BMS controller2Access control panel3Fire indicator panel4Lift controller5Unmanaged camera6Vendor remote access
Fig. 02Six points where a building’s control systems can be reached, and the path each one opens: to the internet, or to the contractors and vendors who service it.

One setpoint change, travelling from the operator’s screen to a controller on the roof. Switch between the two ways the network can be built and watch who can read the message, and who can send one.

Operator’s screenThe head-end in the facilities officeSends on behalf of whoever is at the keyboard.Sends with its own key, so the controller knows which screen spoke.
Set the cooling setpoint to 30.0 °CwriteProperty · 22.5 → 30.0
Someone else on the networkReads the message in full, and could send one of their own.Sees a sealed stream, and the controller keeps its answers for screens it knows.
Roof controllerThe air handling unit in the plant roomAccepts the change from any device that asks.Accepts the change from a screen that has proven who it is.

The protocol was written for a network with one trusted tenant. A building’s network has many.

Secured, each device proves who it is before it speaks, and the message travels sealed.

Fig. 03One message, two networksBMS security in plain English

The console is a site explorer over the model: the device tree at the left, grouped from the head end through the chilled-water plant and the data hall to the electrical plant, and for whatever is selected its point list, graphics, trends, alarms and schedule.

The building console: the geographic device tree at the left and the point list for the head-end supervisor, with the site's replay transport above it.
Fig. 04The building console, on the point list.Open the console

03The method both share

The real protocol on the wire, and every packet kept.

  1. iReal controllers, on loopback.Each lab runs a real protocol server on the machine’s own loopback interface, so the target answers the way a controller answers and the traffic stays inside the machine.
  2. iiThe real protocol, captured.A driver performs each move over the actual protocol, and every packet is captured and kept as the evidence. A demonstration ships only from a run that landed.
  3. iiiFindings mapped to the standards.Each attack class is mapped to MITRE ATT&CK for ICS techniques and to IEC 62443 zones and conduits, so a finding reads in the language a plant’s own risk register uses.
  4. ivRemediation written as detections.Each finding closes with the network and process detections that catch it, written so a defender can run them.