runZero Hour: Episode 3

Episode 3 of the runZero Hour webcast gave us a flavor of what it’s like to fingerprint OT protocols that aren’t as accessible if you aren’t part of that industry. On the IT side, protocols (e.g., SMTP, DNS, SSH) are widely adopted and industry-agnostic. With OT, you find a lot more protocols that are industry-specific. For example, Distributed Network Protocol 3 (DNP3) is a set of communications protocols used primarily by utilities such as electric and water companies. Automated Tank Gauging (ATG) is used almost exclusively with gas or petrol stations. Factory Interface Network Service, a protocol used exclusively for Omron PLCs, is most frequently found in Japanese factories.

The fit-for-purpose nature of these protocols has ramifications for fingerprinting: Since DNP3 supports unsolicited messaging, where stations initiate communications with a controller, fingerprinting is potentially easier as stations divulge information about themselves.

ATG is surprisingly easy to fingerprint despite its age. Payloads are often in well-formed human-readable formats, no decoding required for identification. FINS is difficult to fingerprint without first parsing its documentation, which is mostly written in Japanese. But with Google Translate and perseverance, fingerprinting is possible.

If you’ve read this far, you’re probably interested in OT, and if you happen to be going to the S4 conference, we would love to see you there!

runZero will have a booth at #s4x24 and be part of the ICS village along with other vendors, where our platform will be tested against a mock manufacturing environment. Come check it out!

Meet Our Speakers

HD Moore

CEO and Co-Founder

Huxley Barbee

Former Security Evangelist

Rob King

Director of Security Research

Tom Sellers

Principal Research Engineer

Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.

Related Resources

runZero Hour: Episode 8
The latest insights (and opinions!) on the impending US ban of Kaspersky products, the FBI's warning for threats against the renewable energy...
runZero Hour: Episode 9
Join the runZero research team for a special episode of runZero Hour featuring our deep dive research on the SSH protocol and SSHamble, an open...
Unknown Assets are the Achilles Heel of Effective Cyber Defense — And Zero Trust
Achieving complete visibility across complex environments is a core tenet of zero trust. See how to achieve your goals with tips form our experts.

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved