MODBUS Security (GDC)

[Bruce Cloutier]

The topic of Security with respect to the JNIOR came up in a meeting yesterday, Most of you know that the Series 3 JNIOR handles MODBUS by default but that with Series 4 you have to enable it. I am not sure that you know that this is because MODBUS does not require a login and represents a huge security vulnerability. Correct me if I am wrong but I believe MODBUS is only required with GDC servers.

What this means is that anyone that can get on the network with access to a JNIOR can invoke MODBUS and play havoc with the I/O.

The JNIOR does have a login feature for MODBUS however this requires that the server implement the custom command to handle that. Of course if they just pull some MODBUS library from someplace companies like GDC cannot accommodate the feature. They certainly won't if they don't realize the security aspect of this. That won't concern them unless the end-users inquire about it.

Obviously you wouldn't want to put a Series 3 on the open Internet at all. A Series 4 performs quite well on the open network however one assumes that MODBUS would not be enabled. If it is they had better enable the login.

I am not a MODBUS fan. Most MODBUS implementations end up polling for status (repeatedly asking for the state of something). You can never poll fast enough given that everyone wants an immediate response to some action. That ends up being a burden on the network and the machines at either end. Consider the JMP Protocol (or legacy JNIOR protocol) which transmits a status update only when a state changes. Polling is not required.

I suppose that I can implement an IP address filter on the MODBUS connection but that would end up creating another level of configuration confusion. And, naturally, MODBUS over a serial cable is not an issue.

I just thought I would put this out there in case security concerns you.

[James Gardiner]

A physically isolated serial cable is ok but a physically isolated network is not?

If your ok with one I think your ok with the other

[Bruce Cloutier]

By "physically isolated" I assume you mean sandboxed and/or air-gapped from another network (presumably the Internet)?

Obviously an isolated network is better but not equivalent to a point-to-point serial cable. There are other devices on the isolated network. While there is the one that you want to act as the MODBUS server and the JNIOR as a MODBUS client are you certain that none of the other devices can utilize MODBUS if so malconfigured? From a hackers point of view you need only find some way to snap into a hub/switch. Maybe there is a WiFi connection through an access point or some WiFi enabled server? You think that is secure but where there is a will there is a way. Consider that a weaponized computer virus was successful at taking out uranium enrichment centrifuges in remote secure military complexes.

We take our role on these isolated networks seriously. I want to make sure that our devices are secure. But when people (most of you in this market) leave the default administrator usernames and passwords active, it is hard for us to justify the extra effort to close every possible vulnerability. The decision to not have MODBUS active by default in the Series 4 was definitely controversial internally.

There are a percentage of our products that we know are not on an isolated network.

Plus your network might be isolated today but if it should become connected to the rest of the world would you know?

Better safe than sorry.