SCADA Honeypots
SCADA (Supervisory Control and Data Acquisition) systems are embedded, realtime, industrial process control systems that are mainly used to centrally supervise distributed nodes (e.g., motors or pipelines). For more information, please see the wikipedia entry on SCADA systems.
Some of these systems are also connected to the public Internet and thus can be targeted by an attacker. A common protocol for accessing SCADA nodes is Modbus/TCP on port 502. Other protocols can also be used and a nice overview is available in the ThreatMind Security Wiki.
Honeypots can also be used to learn more about this kind of threat. The folks from Digital Bond have designed such a honeypot system and publish more information about it in their blog. Yesterday I received an image of their honeypots and once I am back in Germany I will start to deploy it. Looking forward to the results. although it is a bit questionable whether we will see many specific attacks...
Some of these systems are also connected to the public Internet and thus can be targeted by an attacker. A common protocol for accessing SCADA nodes is Modbus/TCP on port 502. Other protocols can also be used and a nice overview is available in the ThreatMind Security Wiki.
Honeypots can also be used to learn more about this kind of threat. The folks from Digital Bond have designed such a honeypot system and publish more information about it in their blog. Yesterday I received an image of their honeypots and once I am back in Germany I will start to deploy it. Looking forward to the results. although it is a bit questionable whether we will see many specific attacks...
".
