Intro to Common Industrial Protocol Exploitation

The talk opens with the history of the Common Industrial Protocol, tracing it from DeviceNet in 1994 through ControlNet to EtherNet/IP, which carries the protocol over standard Ethernet. The speaker explains how explicit request-response messages run over TCP, how implicit data streams run over UDP, and how a message is addressed by service, class, instance and attribute. He also covers the three connection types and routed paths that let a single message hop across several networks, which can make traffic hard for intrusion detection systems to follow.

The middle of the talk covers security. CIP Security adds device identity, integrity hashing and encryption, but most plants enable only the identity check because older controllers lack the processing power for the rest. The speaker then describes a fuzzing method: probing class and service IDs with GetAttributeList, using the class-level instance to map what exists on a device, and checking which instances respond. He explains that a crash, which he calls a major non-recoverable fault, usually points to a memory boundary error.

He closes with practical advice. Testing should happen only on lab gear or cyber ranges, never on live plants, and any crash should go to the vendor's security team rather than to public posts. He points beginners to a free vendor configuration tool, an ICS Village GitHub fuzzing project, and cheap used controllers on eBay.