MOSTO: A toolkit to facilitate security auditing of ICS devices using Modbus/TCP

Rodríguez, Ricardo J. (Universidad de Zaragoza) ; Marrone, Stefano ; Marcos, Ibai ; Porzio, Giuseppe

Resumen: The integration of the Internet into industrial plants has connected Industrial Control Systems (ICS) worldwide, resulting in an increase in the number of attack surfaces and the exposure of software and devices not originally intended for networking. In addition, the heterogeneity and technical obsolescence of ICS architectures, legacy hardware, and outdated software pose significant challenges. Since these systems control essential infrastructure such as power grids, water treatment plants, and transportation networks, security is of the utmost importance. Unfortunately, current methods for evaluating the security of ICS are often ad-hoc and difficult to formalize into a systematic evaluation methodology with predictable results. In this paper, we propose a practical method supported by a concrete toolkit for performing penetration testing in an industrial setting. The primary focus is on the Modbus/TCP protocol as the field control protocol. Our approach relies on a toolkit, named MOSTO, which is licensed under GNU GPL and enables auditors to assess the security of existing industrial control settings without interfering with ICS workflows. Furthermore, we present a model-driven framework that combines formal methods, testing techniques, and simulation to (formally) test security properties in ICS networks.

Idioma: Inglés

DOI: 10.1016/j.cose.2023.103373

Año: 2023

Publicado en: COMPUTERS & SECURITY 132 (2023), 103373 [12 pp.]
ISSN: 0167-4048

Factor impacto SCIMAGO: 1.566 - Law (Q1) - Computer Science (miscellaneous) (Q1)

Financiación: info:eu-repo/grantAgreement/ES/DGA/T21-23R
Financiación: info:eu-repo/grantAgreement/EUR/MICINN/TED2021-131115A-I00

Tipo y forma: Artículo (Versión definitiva)

Área (Departamento): Área Lenguajes y Sistemas Inf. (Dpto. Informát.Ingenie.Sistms.)