CISA warns hackers are increasingly targeting US water systems after Minnesota attack

Introduction

Water systems across the United States are increasingly under cyber threat, as demonstrated by recent attacks on Minnesota's infrastructure. These attacks target the industrial control systems (ICS) that manage water treatment and distribution. In this tutorial, we'll explore how to secure these critical systems by learning how to identify and isolate industrial controllers on your network. This is a foundational skill for protecting critical infrastructure from cyberattacks.

Industrial control systems are often connected to the internet for remote monitoring and management, but this connectivity creates vulnerabilities. In this tutorial, we'll learn how to scan your network to find these systems and understand their basic configuration, which is the first step toward securing them.

Prerequisites

Before beginning this tutorial, you should have:

• A basic understanding of computer networks and how devices connect
• A computer with internet access
• Network scanning tools installed (we'll use Nmap, a free and open-source tool)
• Basic command-line experience (you don't need to be an expert, just comfortable running commands)

Note: This tutorial is for educational purposes only. Always ensure you have permission to scan any network or system you're working with.

Step-by-Step Instructions

1. Install Nmap on Your Computer

Nmap is a powerful network scanning tool that can help us discover devices on a network, including industrial controllers. First, we need to install it.

On Windows:

1. Visit the Nmap download page
2. Download the Windows version (nmap-x.x.x-setup.exe)
3. Run the installer and follow the prompts

On macOS:

1. Open Terminal
2. Install via Homebrew: brew install nmap

On Linux (Ubuntu/Debian):

1. Open Terminal
2. Run: sudo apt update && sudo apt install nmap

Why: Nmap is essential for network reconnaissance. It helps us identify which devices are active on a network and what services they're running, which is crucial for understanding how industrial systems are connected.

2. Find Your Network IP Address

Before scanning, we need to know our network's IP range. This helps us focus our scan on the correct devices.

On Windows:

1. Open Command Prompt (press Windows key + R, type 'cmd', press Enter)
2. Type: ipconfig
3. Look for your IPv4 Address and Subnet Mask (e.g., 192.168.1.100 and 255.255.255.0)

On macOS/Linux:

1. Open Terminal
2. Type: ip addr show or ifconfig
3. Find your network interface (like eth0 or en0) and note the IP address

Why: Knowing your network's IP range allows us to scan only the devices on our local network, making the scan faster and more accurate.

3. Scan Your Network for Devices

Now we'll run a basic Nmap scan to find devices on our network.

In Terminal or Command Prompt, run:

nmap -sn 192.168.1.0/24

Replace 192.168.1.0/24 with your own network range (from step 2).

Why: This scan uses the -sn flag, which performs a ping scan. It discovers active devices without connecting to them, which is safe and doesn't alert the systems we're scanning.

4. Identify Industrial Controllers

Industrial controllers often run specific services or use unique ports. We'll scan for common ports used by these systems.

Run this command to scan for known industrial ports:

nmap -p 102,502,20000,44818 192.168.1.0/24

This scans for ports used by:

• Port 102: ISO 10646 (used by some industrial systems)
• Port 502: Modbus (common in industrial control systems)
• Port 20000: Profinet (used in industrial networks)
• Port 44818: EtherNet/IP (used in industrial automation)

Why: By targeting these specific ports, we're looking for devices that are likely to be industrial controllers. These ports are commonly used by critical infrastructure and are often exposed to the internet, making them attractive targets for hackers.

5. Analyze the Scan Results

After running the scan, you'll see a list of devices and open ports. Look for devices that have any of the industrial ports open.

Example output:

Starting Nmap 7.92 ( https://nmap.org ) at 2023-05-15 10:00 EDT
Nmap scan report for 192.168.1.50
Host is up (0.0012s latency).
PORT      STATE SERVICE
502/tcp   open  modbus
20000/tcp open  dnp3

Why: Finding devices with open industrial ports tells us that these systems are potentially exposed to the internet and could be vulnerable to attacks. This is the first step in securing them.

6. Secure the Found Devices

Once we've identified industrial controllers, we must secure them. Here's how:

1. Isolate the devices: Move them to a separate network segment (VLAN) that's not connected to the internet
2. Update firmware: Ensure all devices are running the latest security patches
3. Change default passwords: Replace default credentials with strong, unique passwords
4. Disable unnecessary services: Turn off any services not needed for operation

Why: These steps help prevent unauthorized access. Industrial systems are often left unsecured because they're assumed to be isolated, but that's no longer safe in our connected world.

Summary

In this tutorial, we've learned how to use Nmap to scan a network for industrial control systems. We identified common ports used by these systems and practiced scanning to find potentially vulnerable devices. This knowledge is essential for protecting critical infrastructure like water systems from cyberattacks. Remember, always scan with permission and take steps to secure any devices you find. The first step to protecting your systems is knowing what's on them.