Quantitatively Assessing and Visualising Industrial System Attack Surfaces

CHAPTER 5. CONCLUSION 45
systems via Shodan, and recommended a list of sensible countermeasures, from firewalls
and VPNs to strong passwords and removal of default accounts. We agree with those
recommendations, and in particular with the basic remediation of placing the devices
behind a properly configured firewall. Where an external connection is necessary, in
addition to the use of default authentication, we recommend IP address white-listing. It
is quite unlikely that these systems need to accept connections from absolutely any IP
address, and limiting to a small subset of relevant IP addresses would reduce the exposure
greatly. Perhaps these systems already have this capability and we are witnessing cases
of misconfiguration of the firewall or the device itself. In either case, some exposure of
industrial systems is evident regardless of the mode of failure. By logging and mapping
that exposure over time we aim to provide an open source dataset for future researchers.
Overly focussing on the vulnerability of the device is a red herring though, because we
know from ICS-Cert that many of these devices should not be facing the Internet at
all. Disclosing the existence of these devices is enough information in itself, without
resorting to exploitability of the device. Indeed some of them offer readings of meter
data or configuration data, without any authentication being presented to the viewer.
This information disclosure may be business critical or disclose personally identifiable
information both of which carry separate operational security concerns.
5.2 Extensions and improvements
5.2.1 Crowdsource more banners
The approach we have taken is dependent on banners we can search Shodan with. Ban-
ners are product dependent and sometimes version dependant, and without them we know
very little about ICS connectivity. When presented with an individual banner, we can
determine if it is unique enough, or on the right ports to be found by Shodan. Addition-
ally, industrial system components are bespoke and not commonly encountered, so new
examples are very helpful to academic researchers.
If we were to crowdsource banners through a webpage or email campaign, we might very
well find a great deal more industrial system components. In one case during our research
one new query resulted in approximately 3000 new data points. This isn’t just valuable in
reducing the exposure of these systems. It is also useful to identifying critical components
upstream in the supply chain, that can be given increased security review when we know
our industrial infrastructures rely on them.