0x01 Preface
Industrial-control security has grown increasingly popular in recent years, and many friends have asked how to learn it. I am still learning myself, so I cannot claim to know the single correct or fastest path. I can only share methods and experience from my own perspective.
At the grandest level, learning industrial-control security contributes to national security; at the practical level, it is a way to make a living. The important thing is to choose the right prescription—which means looking at employers' job requirements. My learning recommendations therefore draw on the requirements published by major companies. Let us move on to the details.
0x02 Learning Objectives
-
Understand industrial-control protocols, including but not limited to Modbus, S7Comm, DNP3, OPC, EtherNet/IP, OMRON FINS, IEC 104, and OPC UA
-
Be familiar with PLC programming
-
Understand the architecture, components, and characteristics of industrial control systems such as PLC, DCS, and SCADA
-
Be familiar with configuration software from different vendors
-
Understand configuration and security management for HMIs and operating systems
-
Understand industrial control systems
-
Understand PE or ELF structures and x86 assembly; familiarity with ARM, MIPS, and PowerPC is also valuable. Be proficient in writing IDA scripts and using debuggers such as OllyDbg, Immunity Debugger, and WinDbg.
-
Be familiar with common interfaces and firmware-extraction methods
-
Have experience with IoT penetration testing or vulnerability research
0x03 Detailed Introduction
The learning objectives above are concise but cover a broad body of knowledge. For an industrial protocol, one must study its structure, specification, characteristics, and much more. Control systems differ between vendors, requiring practical knowledge of each; without physical hardware or a simulator, learning operation is difficult. Configuration software is meaningful only alongside real equipment, where it can also be examined for vulnerabilities. Likewise, without exposure to a complete industrial-control environment, it is hard to understand how its components differ from those of an ordinary internal network.
These are only part of the learning objectives. Some unmentioned abilities are assumed as fundamentals, including scripting and reverse engineering. Here are severallauCyun Books recommended by other researchers:
Recommended foundational books:
- Assembly Language, 3rd Edition, Wang Shuang, Tsinghua University Press
- C Primer Plus, 6th Edition, Chinese
- Python Crash Course
- Python Tutorial, Liao Xuefenghttps://www.liaoxuefeng.com
In addition to programming languages, learn automation fundamentals such as the principles and components of automation equipment.
Recommended books:
- Sensors and Automatic Measurement Technology
- Principles of Automatic Control
- Programmable Logic Controllers (PLC), Morriss, China Machine Press
- Industrial Control Networks
- Signals and Systems
Recommended books on protocol fundamentals:
- TCP/IP Illustrated, Volume 1: The Protocols
Recommended industrial-control security books:
- Industrial Control Network Security Technology and Practice, Yao Yu et al., China Machine Press
- Industrial SCADA System Information Security Technology, Rao Zhihong et al., National Defense Industry Press
- Industrial Control System Information Security, Xiao Jianrong, Publishing House of Electronics Industry
- Industrial Control System Classified-Protection Solutions and Applications, Cai Wandong, National Defense Industry Press
- Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems, Eric D. Knapp, National Defense Industry Press
- Smart Grid Security: Security for the Next-Generation Grid, Tony Flick, National Defense Industry Press
Readers comfortable with C should also study the Wireshark source code:
https://github.com/wireshark/wireshark
It contains a wealth of material that can deepen your understanding of industrial-control security protocols.
0x04 Recommended Learning Sites
Industry vulnerabilities in industrial-control systems:https://ics.cnvd.org.cn/
Industrial-control vulnerability database:http://vulhub.org.cn/view/ics
Ditecting—industrial-control security search:http://www.ditecting.com/index.php/Home/Index/index
IoT Security Encyclopedia:https://iot-security.wiki/
Industrial-control security books and materials:Industrial-Control Security Resource Search
Industrial-control security resource library:https://github.com/Gh05ter/Bank
Beacon Lab:http://plcscan.org/blog/
International industrial-control security companies:https://dragos.com/blog/
International industrial-control security companies:https://cyberx-labs.com/blog/
0x05 Shared Resources
Here are resources I have collected, including protocol documentation, technical articles, PLC programming materials, DCS operation tutorials, Siemens learning resources, PLC configuration software, simulators, and industrial-control security tools:
-
Emerson
├── Overview of the DeltaV DCS Control System.pdf
├── Emerson DCS Chinese Manual.pdf
├── Emerson PLC Programming Manual.pdf
└── Emerson Chinese Instructions.pdf
-
University electrical-engineering videos
├── Complete Harbin Institute of Technology Electrical Engineering Courses ├── Tsinghua University Generator and Transformer Relay Protection Applications, 19 Lectures, Wang Weijian ├── Southeast University Electrical Engineering ├── Beihang University Sensors ├── Complete Xi'an Jiaotong University Electrical Engineering Courses ├── Complete Zhejiang University Electrical Engineering Videos └── Complete China University of Petroleum Electrical Engineering Courses
-
Industrial-control security attack and defense scripts
├── GRASSMARLIN—industrial-control situational awareness
├── PLCinject—injects code into PLCs
├── Redpoint—Nmap scripts for industrial-control scanning
├── SCADAShutdownTool-SCADAShutdownTool
├── icsmaster—industrial-control security resources
├── mbtget—a simple Perl script for Modbus transactions
├── modbus-pcap-parser
├── plcscan—a Python script for scanning PLCs
├── s7scan—a tool for enumerating Siemens S7 PLCs
├── scada-S7 command scripts
├── smod—MODBUS penetration-testing framework
├── Control-command attacks for various protocols
└── Network packet-processing scripts
-
Articles about learning industrial-control security
├── 2014 ISC Industrial-Control Security Forum
├── 2016 ICSISIA
├── 2017 ICSISIA
├── 2017 Industrial-Control Security Training.pdf
├── 3-Building Security-Aware Industrial-Control Cybersecurity_360 Safeguard.pps
├── 9 Introduction to Industrial Control System Security Standards and Policies 201211.pdf
├── ICS Security Risk Analysis.pdf
├── NSFOCUS IoT Security White Paper 2016.pdf
├── Comprehensive Analysis of the Stuxnet Attack on Industrial Control Systems.pdf
├── Antiy—Industrial-Control System Security Analysis 201401.pdf
├── Research on Securing Distribution-Network Modbus Messages with SM2.pdf
├── The Upside-Down World: Industrial-Control Defense Challenges and Responses from an Attacker's Perspective.pdf
├── Policies and regulations
├── Cybersecurity Industry White Paper 2017.pdf
├── Industrial Control System Cybersecurity—360.pdf
├── Industrial Information Security Situation White Paper.pdf
├── Industrial Internet Development Action Plan, 2018–2020.pdf
├── Exploring Industrial-Control System Security Threats and Responses.pdf
├── Thoughts and Practice on Industrial-Control System Protection, Sun Limin, Institute of Information Engineering, Chinese Academy of Sciences.docx
├── Common Pitfalls and Misconceptions in Building Industrial-Control System Cybersecurity.pps
├── Global Critical Information Infrastructure Cybersecurity Analysis Report, 360.pdf
└── Industrial-Control System Information-Security Framework for a Large Aluminum Processor.docx
-
Ladder-logic programming
├── 4.0.9.25_Individual
└── 7002247_STEP7_Micro-WIN.pdf
-
Recommended books
├── 1. Recommended books for foundational knowledge
│ ├── C Primer Plus, 6th Edition, Chinese ([US] Stephen Prata), Complete.pdf.zip
│ ├── Python Crash Course.pdf
│ ├── Liao Xuefeng's Python Tutorial.pdf
│ └── Assembly Language, 3rd Edition, Wang Shuang.pdf
├── 2. Recommended books on automation
│ ├── Signals and Systems, Zheng Junli, 2nd Edition, Clear Complete Version.pdf
│ ├── Industrial Control Networks—Industrial Ethernet.pdf
│ ├── Sensors and Measurement Technology, Practical Automation Textbook Series for Chinese Universities in the 21st Century.pdf
│ ├── Programmable Logic Controllers (PLC).pdf
│ └── Principles of Automatic Control, Hu Shousong, 5th Edition.pdf
└── 3. Recommended books on protocol fundamentals
└── TCP/IP Illustrated, Volume 1: The Protocols (fujieace.com).pdf
-
Siemens resources
-
Siemens comprehensive collection:
├── Siemens WinCC Video Tutorial, 48 Episodes (1) ├── MicroWin ├── Siemens S7-200 PLC from Beginner to Expert, 1–56 ├── S7-200 Tutorial ├── Complete Siemens PLC Video Tutorials + Programming Software + Simulation Software ├── Siemens Manuals ├── S7-200 Programming Software ├── S7-300/400 Tutorial ├── PCS 7 ├── S7-300 Programming Software ├── WinCC flexible 2008 ├── Siemens S7-300/400 Tutorial, Yang Shengfeng, 40 Lectures (1) ├── TIA Portal V13 Complete, Including PLC, HMI, Simulation, and Activation ├── Siemens LOGO! Programming Software.rar ├── S7-300/400 (LAD) Programming Manual.pdf ├── SIMATIC STEP 7 V5.5 SP3.iso ├── Siemens Training Tutorials and Manuals Collection (1).rar ├── 88 Illustrated Siemens S7-200 PLC Application Examples, Zheng Fengyi.pdf ├── Industrial-Control Veteran: Classic Collection.rar ├── WinCC flexible Multimedia Tutorial (1).rar ├── Siemens S7-300 STEP 7 Video Tutorial.rar ├── Siemens Training Tutorials and Manuals Collection (5).rar ├── Siemens Keys.zip ├── Siemens STEP 7 V5.4 Chinese Edition, with Keys.rar ├── Siemens Simulation 5.4.rar ├── Siemens Training Tutorials and Manuals Collection (6).rar ├── WinCC V7 Application Examples, Video.rar ├── STEP 7 V5.5 SP1_Home_x32_x64.iso ├── Siemens Chinese Training Materials.rar ├── Siemens Training Tutorials and Manuals Collection (7).rar ├── WinCC Courseware.rar ├── S7-1200 Multimedia Tutorial.rar ├── Siemens Training Tutorials and Manuals Collection (9).rar ├── A Practical Guide to Siemens S7-300 PLC.pdf ├── Siemens Training Tutorials and Manuals Collection (3).rar ├── PID Simulation Test Software—Industrial Control.rar ├── Siemens Training Tutorials and Manuals Collection (4).rar ├── Siemens Touchscreen Video Tutorial.rar ├── Siemens S7-200 Programming Software SP9 Standalone Installer for Windows 7 64-bit.rar ├── WinCC flexible Multimedia Tutorial.rar ├── Siemens Training Tutorials and Manuals Collection (8).rar └── Siemens Training Tutorials and Manuals Collection (2).rar
-
Siemens 200
├── PLC Programming and Applications Videos ├── Yang Shengfeng WinCC Tutorial └── Siemens S7-200 PLC from Beginner to Expert, 68 Lectures
-
Siemens PLC documentation
├── Siemens PLC Training ├── Filename, Size, Modified Date ├── Siemens Industrial Network Communication Guide, Part 2.pdf ├── Siemens Technician PCS 7 Training Materials.pdf ├── Siemens Technical Manuals, Bookmarked Edition.pdf ├── Modern Electrical Control and PLC Application Technology, Wang Yonghua 03.pdf ├── Principles and Applications of Siemens PLCs, Sui Yuanyuan.pdf ├── Siemens CNC Maintenance and Adjustment Training, Essential Edition.pdf ├── Applications of Siemens Products in Textile Machinery.pdf ├── Zhengzhou S7-300 Training Materials, Lecturer Yang Shengfeng.pdf ├── Siemens Turning Programming.pdf ├── S7-300 and S7-200 Communication via EM277_DP Example.doc ├── Siemens Electrical Installation Technical Manual.pdf ├── Siemens Hardware Configuration and Communication Connections.pdf ├── Complete S7-200 Training Tutorial.pdf ├── Siemens Industrial Communication Network Configuration, Programming, and Troubleshooting.pdf ├── Siemens Internal Training Notes.pdf ├── Modern Electrical Control and PLC Application Technology, 2nd Edition, Wang Yonghua, Beihang University Press.pdf ├── Siemens, Mitsubishi, and Omron Comprehensive Training Tutorial.pdf ├── Siemens Variable-Frequency Drives and Engineering Applications.pdf ├── Siemens Industrial Network Communication Guide, Part 1.pdf ├── Siemens AC/DC Drive Operation Manual.pdf ├── Complete S7-200 Training Tutorial (1).pdf ├── Siemens Servo S120/S150 Chinese Parameter Manual.pdf ├── Complete Siemens Advanced Programming Training, 386 Pages.pdf ├── Siemens and Mitsubishi PLC Comprehensive Training Tutorial.pdf ├── Siemens Qingdao Complete Training Tutorial.pdf └── Siemens Training Tutorial, STEP 7 and flexible.pdf
-
Siemens WinCC
├── 019 WinCC Installation Required Reading.zip ├── Siemens WinCC flexible Advanced.zip ├── 0019 WinCC V7.0 SP3 Video Tutorial, Materials, and Installation.zip ├── Siemens WinCC Video Tutorial, 48 Episodes.rar ├── 0019 WinCC_7.0_SP3_CN.part2.rar ├── 0019 WinCC_7.0_SP3_CN.part6.rar ├── Siemens Touchscreen Video Tutorial.rar ├── Siemens WinCC flexible Beginner.zip ├── 0019 WinCC_7.0_SP3_CN.part3.rar ├── 0019 WinCC_7.0_SP3_CN.part5.rar ├── Siemens STEP 7 V5.5 CN Software.rar ├── 0019 WinCC_7.0_SP3_CN.part1.rar ├── 0019 WinCC_7.0_SP3_CN.part4.rar ├── Siemens Tutorials, Installation, Materials, and Examples.zip └── 0019 WinCC_7.0_SP3_CN.part7.rar
-
Siemens PLC videos + programming software + simulation software
├── B107 Siemens 300 Video Tutorial, Ouyang Feng.zip ├── B117 WinCC V7.0 SP3 Video Tutorial + Materials + Installation.zip ├── B101 HIT Siemens 200 Video Tutorial, Lectures 31–36.zip ├── B116 Siemens STEP 7 V5.5 Programming Software, XP/Windows 7 32-bit.zip ├── B117 WinCC_7.0_SP3_CN.part5.rar ├── B102 PLC Programming and Applications.zip ├── B103 S7-200CN E-learning—Basic Instructions.zip ├── B104 S7-200CN E-learning—Programming Basics.zip ├── B110 S7-300 PowerPoint Lessons.zip ├── B111 Complete Siemens 300 Learning Collection.zip ├── B105 S7-200CN E-learning—Wizard Programming.zip ├── B115 Complete STEP 7 MicroWIN V4.0 SP9 Installer for S7-200 PLC.zip ├── B118 Siemens Programming Software V5.5 for Windows 7 64-bit.zip ├── B119 S7-1200_56662.rar ├── B117 WinCC_7.0_SP3_CN.part4.rar ├── B113 Follow-Along WinCC Flexible.zip ├── B101 HIT Siemens 200 Videos 1–30.zip ├── B114 Siemens S7-200 PLC Quick Start.rar ├── B109 Siemens 200/300 Communication and Networking.zip ├── B106 Siemens Chinese Learning Materials.rar ├── B119 S7-1200 Video Tutorial.zip ├── B117 WinCC_7.0_SP3_CN.part2.rar ├── WinCC_Flexible_2008_SP2.part1.rar ├── B112 WinCC Video Tutorial.zip ├── B108 STEP 7 Video Tutorial.zip ├── B119 S7-1200 Documents.rar ├── B117 WinCC_7.0_SP3_CN.part6.rar ├── WinCC_flexible_2008_SP3.pdf ├── B117 WinCC_7.0_SP3_CN.part7.rar ├── B117 WinCC_7.0_SP3_CN.part1.rar ├── B119 Siemens S7-1200 Video Tutorial.rar ├── B114 Siemens S7-200 PLC Advanced Applications.rar └── B117 WinCC_7.0_SP3_CN.part3.rar
-
-
protocol
├── Modbus protocol
│ ├── ECOMV280 Serial Debugging Software with CRC Validation
│ ├── FreeModbus Source-Code Analysis.pdf
│ ├── Modbus Debugging Assistant
│ ├── Comparison of Modbus Data Reads and Writes.pdf
│ ├── Modbus Protocol, Chinese Complete Edition.pdf
│ └── modbusconmmunication(chinese).pdf
├── OPC protocol
│ ├── OPC Complex Data Specification.pdf
│ ├── OPC Protocol Version 2.02.pdf
│ └── Introduction to the OPC Communication Protocol.ppt
├── S7comm protocol
│ ├── System Software for S7-300:400 System and Standard Functions.pdf
│ ├── socomm.c
│ ├── An Introduction to the S7COMM and MODBUS Industrial-Control Protocols.pdf
│ └── Siemens S7Comm Communication Protocol.pdf
├── UPS communication protocols
│ ├── Adapt 16k–20k UPS Electrical-Bus Protocol V140.pdf
│ ├── Adapt 5k–10k UPS Electrical-Bus Protocol V140.pdf
│ ├── Adapt 1–3k UPS Electrical-Bus Protocol V110.pdf
│ ├── Hipulse U -V130.pdf
│ ├── Hipulse U -V130.txt
│ ├── NXr Electrical-Bus Protocol V170.pdf
│ ├── NX Series Electrical-Bus Edition V320.pdf
│ ├── UL33-V180.pdf
│ ├── XY0134V400 Final.doc
│ └── Chinese HiPulse CDT Protocol, Client Edition.pdf
├── DNP3 communication protocol
│ ├── DNP3
│ └── Introduction to DNP3.pdf
└── ethernet:IP
├── Ethernet/IP Communication Between ABB Robot Master and CP1H Slave.docx
├── EtherNet/IP, Chinese Edition 1.2.pdf
├── ethernet-ip.docx
└── ethernet:IP.pdf
-
DCS
├── DCS.pdf
├── DCS Learning Materials.pdf
└── HOLLiAS MACS V5.2.4 Software User Manual.0001.pdf
The preceding resources are available at: T00ls download:https://www.t00ls.net/thread-54064-1-1.html 90sec download:https://forum.90sec.com/t/topic/619 [No longer sent to personal email addresses]
For readers who enjoy CTFs, here are also some industrial-control security challenges:
Link:https://pan.baidu.com/s/1Qa-G3nx1YhRnEtWK0ldbSg Password: y09i
It contains many competitions. I participated in two and wrote a write-up for the third event of 2019: /ctf/415.html
Search online for the other challenges if needed.
0x06 References
https://laucyun.com/67decba60f45306ae8afdcbb2a1bf0a0.html
https://www.zhipin.com/job_detail/ea50fef474b06edb0nV-39W9EVM~.html?ka=search_list_8
https://www.zhipin.com/job_detail/502a2e7e5e870a131XV92d68E1E~.html?ka=search_list_11
https://www.zhipin.com/job_detail/8636a7197c0d5efc0ndy3N20GFI~.html?ka=search_list_15
https://www.zhipin.com/job_detail/b1dab151ebd627691HF-2du6GFE~.html?ka=search_list_16
https://www.zhipin.com/job_detail/0d3b7d7b32ec8e021Xd909S4FVE~.html?ka=search_list_25