Post #4436107

I went to a really nice tech talk at SecDSM last night. It was on PLC insecurity, how to build a trainer kit for building your own simple process control experiment with an HMI, etc. https://github.com/oniskin/PLC-Trainer-Kit is the writeup, and Oren even posts little videos on how to get started. One of the neater things was showing a modern functioning arp poison attack to blind operators (thanks to no integrity in the control systems protocols). I liked Oren's approach, which let you specify which registers get what values for read operations. I wrote a tool of my own a while ago but it is pretty limited (just records a 10 second 'tape loop' where it then replays responses, seen here: https://github.com/reidmefirst/modbus-vcr ). Hopefully Oren publishes his soon...