ModScan: a SCADA MODBUS Network Scanner
Mark Bristow details dEF CON 16 - Mark Bristow: ModScan: A SCADA MODBUS Network Scanner ModScan is a new tool designed to map a SCADA MODBUS TCP based network.
Summary
Architecture and Background
DEF CON 16 - Mark Bristow: ModScan: A SCADA MODBUS Network Scanner ModScan is a new tool designed to map a SCADA MODBUS TCP based network. The tool is written in python for portability and can be used on virtually any system with few required libraries.
Vulnerability Analysis
The presentation includes a demonstration of the ModScan scanner as well as a rundown of the various features and modes available. I will also be covering the MODBUS and MODBUS TCP protocols including packet construction and communication flows.
Exploitation and Demonstrations
A brief SCADA primer is also included for the education of the audience. Mark is a Certified SCADA Security Architect with three years experience in the information assurance business.
Remediation and Defensive Strategies
He has done research and analysis of the SCADA MODBUS and MODBUS TCP protocol leading to the development of his ModScan tool. In addition to his SCADA work, Mark is a Web Application Security penetration tester and consultant. He regularly speaks at local events in DC and VA and frequently conducts training on the subject. Mark received his bachelors degree in Computer Engineering from The Pennsylvania State University. For copies of the slides and additional materials please see the DEF CON 16 Archive here:
Related talks
Main Stage·1 hr 54 min
Workshop
Workshop details workshop: Davix Workshop Need help understanding your gigabytes of application logs or network captures.
Main Stage·41 min
Weasel
Weasel details weasel: Compliance: The Enterprise Vulnerability Roadmap Compliance is no longer new.
Main Stage·48 min
Valsmith · Colin Ames
Valsmith and Colin Ames explores metapost-exploitation at DEF CON 16, examining emergency-systems and practical defenses.