What IRONMAP Found When It Scanned the Whole Internet

Matt Caldwell presents IRONMAP, a platform his team built to find and profile operational technology reachable from the public internet. The system relies on a distributed scanner, PLCDISCO, that probes industrial ports, grabs banners, and pulls vendor identity and tag data using read-only requests. The talk frames this as an ongoing research project, with millions of hosts probed so far and hundreds of protocol probes implemented.

The middle of the talk covers the results. EtherNet/IP and Modbus make up much of what was found, many devices answer without authentication, and Siemens S7 on port 102 appears widely. The speaker describes the safety controls: one thread per host, skipping hosts that show network trouble, adaptive backoff, and excluding government and hospital networks. He also explains how honeypots were filtered out using mixed protocol sets and default serial numbers, and how ownership was attributed through WHOIS data, BGP paths and reverse DNS.

The final section covers automatic tank gauges. The team found 149 internet-facing units, mostly Veeder-Root TLS-350 and TLS-450 systems on TCP port 10001, which exposed fuel volumes, product types, alarm states and delivery history. The speaker argues this reveals physical security and supply chain details about a facility. His recommendations were to restrict exposure behind a firewall or authentication, and to follow CISA advisories.