Cyber Threat Investigation of SCADA Modbus Activities

The use of inter-connectivity of Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) networks in smart technologies have exposed them to a large variety of security threats. Furthermore, very few investigations are done in this field from the Internet (cyber) perspective. Therefore, this paper investigates unauthorized, malicious and suspicious SCADA activities by leveraging the darknet address space. In particular, this work investigates Modbus service, which is a de facto standard protocol for communication and it is the most available and used to connect electronic devices in critical and industrial infrastructures. This study is based on real Internet data collected throughout a one-month period. Among the 8 various inferred scanning activities, we find that TCP distributed portscan is the only non-typical Modbus scan. Furthermore, our analyses fingerprint a large variety of Modbus scanners and uncover 6 other services that tag along with Modbus 74% of the time. Finally, we list case studies related to synchronized and automated SCADA scanning campaigns originated from unknown sources.