312-50 Question 425
Single answer▪ OT AttacksDuring an authorized security assessment of a manufacturing plant, you are asked to evaluate the risk of OT protocol abuse without disrupting production. The plant uses PLCs and HMIs on an industrial Ethernet network, and engineering workstations communicate directly with controllers over Modbus/TCP. You capture traffic and observe repeated unauthenticated requests from an engineering workstation to TCP port 502 on several PLCs. The requests include function code 0x05 and are followed by unexpected actuator state changes on the test line. Which finding BEST explains the security weakness being demonstrated?
- A
The PLCs are vulnerable to a SYN flood because Modbus/TCP uses TCP port 502
- B
The engineering workstation is exploiting the lack of authentication and integrity controls in Modbus/TCP to issue write commands to PLC coils
- C
The HMIs are protected because Modbus/TCP encrypts function codes but not payload data
- D
The actuator changes are caused by ARP spoofing, which is required to modify Modbus/TCP coil states
Show answer and explanation
Correct answer: B
Explanation
This scenario reflects a classic OT attack path: abusing inherently insecure industrial protocols to send unauthorized control commands. Modbus function code 0x05 corresponds to Write Single Coil, which can toggle discrete outputs and lead to physical process changes. Many OT protocols, including traditional Modbus/TCP, were designed for trusted industrial environments and lack modern security features such as authentication and message integrity by default. That is why compensating controls are emphasized in guidance from sources such as CISA and NIST, including NIST SP 800-82, Guide to Operational Technology (OT) Security. Best practices include strict network segmentation between IT and OT, limiting access to engineering workstations, allowlisting authorized communications, monitoring industrial protocol traffic, and using vendor-supported secure architectures where possible. The central finding is not merely that port 502 is open, but that the protocol permits unauthenticated write operations capable of affecting physical equipment.
- A. Incorrect.
Incorrect. A SYN flood is a TCP-layer denial-of-service attack and is not what is being demonstrated in the scenario. The key evidence is the observed Modbus/TCP function code 0x05, which is the Write Single Coil operation. The issue is unauthorized command execution, not transport-layer resource exhaustion.
- B. Correct.
Correct. Modbus/TCP traditionally provides little to no native authentication, authorization, or cryptographic integrity protection. Function code 0x05 is used to write a single coil, which can directly change discrete outputs and therefore actuator behavior. In OT environments, this creates a serious risk because an attacker or compromised engineering workstation can send legitimate-looking control commands that PLCs may accept if network access is available.
- C. Incorrect.
Incorrect. This is a common misconception. Standard Modbus/TCP does not provide built-in encryption for function codes or payloads. If security is present, it is typically added through external controls such as network segmentation, VPNs, firewalls, industrial security gateways, or newer secure variants and overlays. The scenario specifically indicates unauthenticated requests being accepted.
- D. Incorrect.
Incorrect. ARP spoofing can be used as a man-in-the-middle technique on local networks, but it is not required to change Modbus/TCP coil states. If a host already has direct network reachability to the PLC and the PLC accepts unauthenticated Modbus write requests, it can issue write commands directly. The observed weakness is protocol-level trust without authentication, not necessarily layer 2 interception.