Mobile Platform, IoT, and OT Hacking · Topic 4 of 4
OT Hacking
Learn OT and ICS concepts, SCADA, PLCs, the Purdue model, industrial protocols, OT attacks such as Stuxnet and TRITON, the methodology and countermeasures.
- 5 min
- Includes a diagram
- OT puts safety and availability ahead of confidentiality.
- SCADA supervises, PLCs and RTUs control, and the HMI is the operator display.
- Modbus has no authentication or encryption.
What it is
Operational technology (OT) is hardware and software that monitors and controls physical processes: power grids, water plants, factories and building systems. Industrial control systems (ICS) are the main OT family.
This page covers OT concepts, attacks, the hacking methodology and countermeasures. The exam tests component names, protocols, the difference between IT and OT, and the main defenses.
How it works
OT concepts
| Component | Role |
|---|---|
| PLC (programmable logic controller) | A rugged computer that runs control logic for machines |
| RTU (remote terminal unit) | A field device that collects data at remote sites and sends it to a control center |
| HMI (human machine interface) | The screen where operators view and control the process |
| SCADA (supervisory control and data acquisition) | A system that supervises geographically spread processes |
| DCS (distributed control system) | Control spread across a single site, such as a refinery |
| IED (intelligent electronic device) | A device in a power system that senses and controls, such as a protective relay |
| Historian | A database that stores process data over time |
| Safety instrumented system | A system that brings a process to a safe state when limits are exceeded |
IT versus OT: IT usually puts confidentiality first. OT puts availability and safety first, because a stopped process can damage equipment or endanger people. OT systems also run for decades, use proprietary protocols and are hard to patch.
The Purdue model
The Purdue model organizes an industrial network into levels. Lower levels sit closest to the process.
| Level | Content |
|---|---|
| 0 | Physical process, sensors and actuators |
| 1 | Basic control, such as PLCs and RTUs |
| 2 | Supervisory control, HMI and SCADA |
| 3 | Site operations, such as the historian and manufacturing systems |
| 3.5 | Industrial demilitarized zone (DMZ) between IT and OT |
| 4 and 5 | Business and enterprise IT |
Industrial protocols
| Protocol | Notes |
|---|---|
| Modbus | A simple, old protocol with no authentication or encryption. TCP port 502. |
| DNP3 | Used in utilities, TCP port 20000 |
| EtherNet/IP | Common in factories, TCP port 44818 |
| Siemens S7 | S7 communication on TCP port 102 |
| BACnet | Building automation, UDP port 47808 |
| OPC | A standard for data exchange between control applications |
| Profinet and IEC 61850 | Industrial Ethernet and substation communication |
Most were designed when OT was isolated and so trust every message. That design choice is why an attacker with network access can send commands.
OT attacks
| Attack | Description |
|---|---|
| Malware aimed at control systems | Stuxnet damaged industrial centrifuges by altering controller logic. Industroyer (CrashOverride) attacked power grid systems. |
| Safety system attack | TRITON (also called TRISIS) targeted safety instrumented systems |
| Reconnaissance malware | Havex collected information from industrial systems |
| Denial of service | Flooding or crashing controllers and HMIs |
| Replay and command injection | Resending or forging unauthenticated commands such as Modbus writes |
| Rogue devices | An unauthorized controller or engineering laptop joins the network |
| Ransomware | Locks IT systems that support production, and may halt plants |
| HMI exploitation | Flaws in operator screens lead to control of the process |
| Insider and supply chain | Malicious updates or removable media bring malware in |
OT hacking methodology
- Information gathering: find exposed devices with Shodan and Censys, and identify vendors and protocols.
- Scanning: identify hosts and services. OT devices are fragile, so scanning is gentle and often passive, using captured traffic.
- Vulnerability analysis: match versions to known vulnerabilities, such as those published in ICS advisories.
- Launching attacks: for example sending unauthorized commands or exploiting an HMI.
- Maintaining access and assessing impact: only in an authorized test, and preferably on a safe lab or test system.
Aggressive scans can crash a PLC, so testers pick passive methods and a test environment. Wireshark with protocol dissectors, Nmap with careful settings and ICS focused scripts, and Shodan are typical tools.
Countermeasures
- Segment OT from IT with a DMZ and firewalls following the Purdue model.
- Use unidirectional gateways (data diodes) where data should flow out only.
- Remove direct internet exposure, and require a VPN with multi-factor authentication for remote access.
- Patch in controlled windows after vendor testing, and use compensating controls when patching is impossible.
- Apply application allowlisting, and restrict removable media.
- Use passive monitoring that understands industrial protocols.
- Follow standards such as the IEC 62443 series and NIST SP 800-82.
- Keep backups of controller programs and test incident response.
A worked example
A water utility finds that a PLC's setpoints changed overnight. The plant network has a remote access path from the business network, and the PLC speaks Modbus without authentication.
An attacker with a foothold on the business network reached the PLC and sent write commands. Segmentation, a DMZ at level 3.5, multi-factor remote access and passive monitoring would each have limited or exposed it.
How the exam asks about this
- "Which malware damaged industrial centrifuges?" → Stuxnet.
- "Which protocol has no built in authentication and uses TCP 502?" → Modbus.
- "Which device runs control logic for machines on the plant floor?" → A PLC.
What to remember for the exam
- OT puts safety and availability ahead of confidentiality.
- SCADA supervises, PLCs and RTUs control, and the HMI is the operator display.
- Modbus has no authentication or encryption.
- The Purdue model places an industrial DMZ between IT and OT.
- Stuxnet, Industroyer and TRITON are the classic OT attack examples.
Active scanning of a live OT network can disrupt a process. If the question asks for the safest discovery method, passive monitoring is the usual answer.
Common mistakes
Applying IT patching habits. OT patches need vendor testing and downtime planning.
Believing air gaps are absolute. Removable media, laptops and remote links bridge them.
Mixing SCADA and DCS. SCADA spans wide areas, and a DCS controls a single site.
Check yourself
Which security goal comes first in OT?
Availability and safety.
What is a data diode used for?
Allowing data to flow in one direction only, for example out of OT.
Which Purdue level holds PLCs?
Level 1, basic control.
Topic 4 of 4 in Mobile Platform, IoT, and OT Hacking
Test yourself on Mobile Platform, IoT, and OT Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.