工控安全

对欧姆龙设备的一次全球统计报告(Omron fins protocol Global Census Report)

概述

欧姆龙是来自日本的知名电子和自控设备制造商,其中小型PLC在国内市场有较高的市场占有量,有CJ、CM等系列,PLC可以支持Fins,Host link等协议进行通信。

关于扫描识别

支持以太网的欧姆龙PLC CPU、以太网通信模块根据型号的不同,一般都会支持fins协议,一些模块也会支持EtherNet/IP协议,Omron fins协议使用TCP/UDP的9600端口进行通信,fins协议封装在TCP/UDP上进行通信,需要注意的是TCP模式下组包和UDP模式下在头部上有所差异。具体协议包的构造可以参考欧姆龙官方的协议文档。如下图可以使用fins命令中0501命令去请求PLC当前CPU的信息:
Omron_fins_Command
实现的基于NMAP的nse插件如下图:
fins_enumerate

扫描情况简介

针对欧姆龙fins协议的第一次扫描探测完成于1月30号,探测范围为全网IPv4地址,首轮发现有923套欧姆龙各种型号的PLC接入了公网。

全网扫描统计 Top20(2015/1/30)

图形化统计分布如下图:
Omron_fins_ICSMAP_2015_01_30

后记

1、欧姆龙作为日本领先的自控设备生产企业,而从得到的数据来看日本暴露的数量都不算太多,不知道这背后是不是还有其他深层次的原因?
2、还有一点值得提的是此类型PLC通讯端口一旦暴露在公网就意味是可以通过协议、软件等直接操作该PLC的所有功能(如果他没有设置等级存取密码),如果PLC需要跨地域进行远程通讯,在配置路由的端口映射时,建议同时还是给PLC设置权限密码,或者在防火墙添加可信的基于源地址的过滤,用来消减暴露在互联网的安全风险。
3、本博客用于进行工控设备安全风险态势统计和研究的扫描器目前已经设置了DNS反解标注(Reverse DNS record),使用域名为icsresearch1.plcscan.org,欢迎继续关注之后的更多工控设备统计报告或来信与我交流。

Hack For Fun

点我轻松一刻

omron_plc_exposed

About Z-0ne

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

最新工业控制系统漏洞

ICS-CERT Advisory Feed
Philips PageWriter TC10, TC20, TC30, TC50, and TC70 Cardiographs

This medical device advisory includes mitigation recommendations for improper input validation and use of hard-coded credentials vulnerabilities in Ph. . . read more Thu, 16 Aug 2018 10:10:15 EDT

Emerson DeltaV DCS Workstations

This advisory includes mitigation recommendations for uncontrolled search path element, relative path traversal, improper privilege management, and st. . . read more Thu, 16 Aug 2018 10:05:11 EDT

Tridium Niagara

This advisory was originally posted to the HSIN ICS-CERT library on July 10, 2018, and is being released to the NCCIC/ICS-CERT website. This advisory. . . read more Thu, 16 Aug 2018 10:00:55 EDT

Philips IntelliSpace Cardiovascular Vulnerabilities

This medical advisory includes mitigation recommendations for improper privilege management and unquoted search path vulnerabilities in Philips'. . . read more Tue, 14 Aug 2018 10:15:11 EDT

Siemens SIMATIC STEP 7 and SIMATIC WinCC

This advisory includes mitigation recommendations for incorrect default permissions vulnerabilities in Siemens' STEP 7 and SIMATIC WinCC TIA Port. . . read more Tue, 14 Aug 2018 10:10:11 EDT

Siemens OpenSSL Vulnerability in Industrial Products

This advisory includes mitigations for OpenSSL vulnerabilities reported in various Siemens industrial products.. . . read more Tue, 14 Aug 2018 10:05:47 EDT

Siemens Automation License Manager

This advisory includes mitigation recommendations for relative path traversal and improper input validation vulnerabilities in Siemens' Automatio. . . read more Tue, 14 Aug 2018 10:00:11 EDT

Crestron TSW-X60 and MC3

This advisory includes mitigation recommendations for OS command injection, improper access control, and insufficiently protected credentials vulnerab. . . read more Thu, 09 Aug 2018 10:05:01 EDT

NetComm Wireless 4G LTE Light Industrial M2M Router

This advisory includes mitigation recommendations for information exposure, cross-site forgery, cross-site scripting, and information exposure through. . . read more Thu, 09 Aug 2018 10:00:01 EDT

Medtronic MyCareLink 24950 Patient Monitor

This medical device advisory includes mitigation recommendations for insufficient verification of data authenticity and storing passwords in a recover. . . read more Tue, 07 Aug 2018 10:10:31 EDT

Medtronic MiniMed 508 Insulin Pump

This medical device advisory includes mitigation recommendations for cleartext transmission of sensitive information and authentication bypass by capt. . . read more Tue, 07 Aug 2018 10:05:37 EDT

Delta Electronics CNCSoft and ScreenEditor

This advisory includes mitigation recommendations for stack-based buffer overflow and out-of-bounds read vulnerabilities in Delta Electronics' CN. . . read more Tue, 07 Aug 2018 10:00:01 EDT

Davolink DVW-3200N

This advisory includes mitigation recommendations for a use of password hash with insufficient computational effort vulnerability in the Davolink DVW-. . . read more Tue, 31 Jul 2018 10:20:41 EDT

Johnson Controls Metasys and BCPro

This advisory includes mitigation recommendations for an information exposure through an error message vulnerability in Johnson Controls' Metasys. . . read more Tue, 31 Jul 2018 10:15:01 EDT

WECON LeviStudioU

This advisory includes mitigation recommendations for stack-based buffer overflow and heap-based buffer overflow vulnerabilities in WECON's LeviS. . . read more Tue, 31 Jul 2018 10:10:01 EDT

AVEVA InTouch Access Anywhere

This advisory includes mitigation recommendations for a cross-site scripting vulnerability in the outdated and insecure third-party jQuery library use. . . read more Tue, 31 Jul 2018 10:05:20 EDT

AVEVA Wonderware License Server

This advisory includes mitigation recommendations for an improper restriction of operations within the bounds of a memory buffer vulnerability in the. . . read more Tue, 31 Jul 2018 10:00:30 EDT

AVEVA InduSoft Web Studio and InTouch Machine Edition

This advisory includes mitigation recommendations for a stack-based buffer overflow vulnerability in AVEVA's InduSoft Web Studio and InTouch Mach. . . read more Thu, 19 Jul 2018 10:15:17 EDT

AVEVA InTouch

This advisory includes mitigation recommendations for a stack-based buffer overflow vulnerability in AVEVA's InTouch HMI software.. . . read more Thu, 19 Jul 2018 10:10:01 EDT

Echelon SmartServer 1, SmartServer 2, SmartServer 3, i.LON 100, i.LON 600

This advisory includes mitigation recommendations for information exposure, authentication bypass using an alternate path or channel, unprotected stor. . . read more Thu, 19 Jul 2018 10:05:16 EDT