SANS explains hands-on hacking industrial control system protocol Modbus/TCP and its use with traffic lights as part of a hands-on lab experiment during the Kinetic Cyber Range class:
Part of our goals in writing the SEC562 course is to provide hands-on experience understanding the security of ICS protocols such as Modbus/TCP, CIP, PROFINET, DNP3 and others. This is done through the completion of several missions, where the team of analysts has a defined goal, and has to use offensive or defensive skills to achieve the stated goal. In the case of the traffic light mission, the team has to hack their way into the CyberCity Department of Transportation (DoT) network, pivot from publicly accessible systems to restricted access systems, and use the compromised host to deliver custom a Modbus/TCP exploit that manipulates the traffic light patterns.
I’m biased, but I think these missions are SUPER FUN. Challenging, for sure, but a great opportunity to learn about a whole new realm of interesting protocols (ICS and related technology) that allow you to use hacking to interact with the kinetic world, manipulating systems that move or control things that move (like…traffic lights!). The class itself is 80% hands-on, 20% lecture, so you spend much more time DOING than listening…and falling asleep after eating too much lunch (been there).
In this article, we’ll take a peek at the Traffic Control CyberCity mission. I’m not going to give away everything, but we’ll take a look at how we can combine useful reconnaissance and information gathering, web attacks, privilege escalation, pivoting, and Modbus/TCP exploits effectively.
A very exciting article eloquently explaining the process so just about anyone can understand what is happening. This should be useful for both IT and OT personnel.