runZero Hour: Episode 3

Episode 3 of the runZero Hour webcast gave us a flavor of what it’s like to fingerprint OT protocols that aren’t as accessible if you aren’t part of that industry. On the IT side, protocols (e.g., SMTP, DNS, SSH) are widely adopted and industry-agnostic. With OT, you find a lot more protocols that are industry-specific. For example, Distributed Network Protocol 3 (DNP3) is a set of communications protocols used primarily by utilities such as electric and water companies. Automated Tank Gauging (ATG) is used almost exclusively with gas or petrol stations. Factory Interface Network Service, a protocol used exclusively for Omron PLCs, is most frequently found in Japanese factories.

The fit-for-purpose nature of these protocols has ramifications for fingerprinting: Since DNP3 supports unsolicited messaging, where stations initiate communications with a controller, fingerprinting is potentially easier as stations divulge information about themselves.

ATG is surprisingly easy to fingerprint despite its age. Payloads are often in well-formed human-readable formats, no decoding required for identification. FINS is difficult to fingerprint without first parsing its documentation, which is mostly written in Japanese. But with Google Translate and perseverance, fingerprinting is possible.

If you’ve read this far, you’re probably interested in OT, and if you happen to be going to the S4 conference, we would love to see you there!

runZero will have a booth at #s4x24 and be part of the ICS village along with other vendors, where our platform will be tested against a mock manufacturing environment. Come check it out!

Meet Our Speakers

HD Moore

CEO and Co-Founder

Huxley Barbee

Former Security Evangelist

Rob King

Director of Security Research

Tom Sellers

Principal Research Engineer

Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.

Related Resources

runZero Hour: Episode 5
On this episode, the runZero Research team dives into some hot topics including the XZ Utils Backdoor (CVE-2024-3094) and expert analysis of the...
Securing OT/ICS Environments: Lessons from the Field
Watch this lively discussion on the latest OT and ICS security challenges and how they are being addressed in the field by OT security experts.
runZero Hour: Episode 4
The fourth episode of runZero Hour, featuring the latest insights, anecdotes, and observations from the runZero Research team.
runZero Hour: Episode 2
Episode 2 of the runZero Hour webcast took a quick survey of new IoT devices that showed up on the network over the holidays at the end of 2023....

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved