There and Back Again: Discovering OT Devices Across Protocol Gateways
summary
Claims specific methods to enumerate OT gear across protocol gateways, demonstrating working parsers and live scans that find roughly 10,000 internet‑exposed devices. Shows reliable techniques: Modbus report device identity over TCP, using DNP3 unsolicited responses to learn 16‑bit addresses (avoids 65k×65k brute force), and abusing the EtherNet/IP connection manager to build route paths into hidden backplanes. Presents heatmaps of ATG/PLC exposure and live protocol parsing that successfully reaches devices behind legacy gateways.
AI-written summary · about
chapters (10)
- 0:00Introduction and welcome
- 1:03Defining operational technology
- 10:29Convergence of IT and OT
- 12:37Discovering OT devices on networks
- 16:27Modbus TCP device discovery
- 17:28Challenges with DNP3 discovery
- 20:58Ethernet IP and SIP complexity
- 23:25Protocol gateways and hidden networks
- 28:16Standards and reverse engineering
- 29:38Q&A on OT device authenticity
related talks
48mYou Too Can Secure OT
29mHow Protocol Gateways May Introduce More Problems than They Solve
39mImproving OT Network and Host Baselines to Secure Critical Infrastructure
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
40mUncovering Covert Channels in Your IoT Networks
49mLet's See What's Out There - Mapping the Wireless IOT
45mNavigating Third-Party Risk in OT Environments
46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OT