Experimental Physics and
Industrial Control System

Andrew Johnson <[email protected]> · Mon, 28 Mar 2016 13:04:25 -0500

Hi Alex,

On 03/28/2016 12:48 PM, Wallace, Alex wrote:
> Recently we had an incident where many of our devices using modbus were
> knocked offline, or experience intermittent connectivity. This occurred
> across all subnets, and seemed to affect devices that used modbus to
> communicate. Below are more details. I am wondering if anyone has seen
> something like this before? Automation Direct says there are some
> firmware updates we are behind on. I suspect Beckhoff will say the same.
> I will be recording network traffic on one of these devices to try and
> catch some malformed packet, or some other thing.

Is it possible that someone ran a network security scan on your internal
networks? That has often been found to cause problems with
network-attached devices like PLCs. It might not have been an official
scan, malware might also do that kind of thing (think Stuxnet, but from
a much less careful adversary in your case).

- Andrew

-- 
There are only two hard problems in distributed systems:
  2. Exactly-once delivery
  1. Guaranteed order of messages
  2. Exactly-once delivery
 -- Mathias Verraes

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System