At Censys, our goal is to capture an accurate representation of the Internet at any given time. However, this is a deceivingly simple task. Not only is the Internet large, but our investigations and prior research show that many of the services on the Internet do not respond on their standard port. While you would expect Modbus to be found only on port 502, the reality is that there is a plethora of Modbus on other, non-standard ports.
Thus, today we’re going to dive under the hood and discuss how we use independent measurement and research to verify where to scan in a more focused manner. We focus on ICS protocols as a case study, given their interest of late.
One way to account for non-standard port is a global IPv4 65k port walk. However, given the sheer size of this scan, it is spread out over time, and thus, won’t find everything immediately. While we aren’t inclined to change the global 65k port walk, we can change our dedicated scans to include broader port scans in areas of interest, thus allowing us to find hosts more systematically.
A natural first question is “What non-standard ports are most likely to host protocols of interest?”. Instead of starting with a 65K port scan that blasts many hosts, we begin with a very targeted focus. Based on anecdota and prior knowledge, we have reason to believe that many ICS protocols are hosted on their standard port +/- 1 (e.g. Modbus on 501 and 503, even though its standard port is 502).
So, a measurement is born. Specifically, we want to test for the existence of an ICS protocol on its standard +/- 1 port, to see if further experiments are worthwhile. We pick Automatic Tank Gauges, or ATG, as our protocol of interest, since they are not the most populous ICS protocol, but still numerous. Since ATG’s standard port is 10001, we run a single Internet-wide scan to find as many devices as possible with ports 10000 and 10002 open. We then run our ATG protocol scanner against these hosts with open ports, filtering for successful scans and those that responded on ATG. Out of ~7K successful hosts that provide some sort of protocol-level data back, we find that ~1.3K are responsive ATG on these non-standard ports, or almost 20%!
Given this finding, as well as data in our platform to back up non-standard ports on other ICS protocols, we implement standard port +/- scanning for all ICS protocols. We then analyzed how our protocol coverage changes for these ICS protocols over time, and found an increase in a number of protocols, namely WDBRPC (~1.8x), DIGI (~2.8x), FINS (~1.9x). We also find more moderate increases in BACNET, S7, IEC60870_05_104, OPC_UA, DNP3, ATG.
This is a huge increase, and very exciting for us! In this process, we also examined what were the top three ports for each protocol. Naturally, we would expect that the three largest ports would be the standard port +/- 1 for each ICS protocol, especially given this new change to our scanning methodology. However, that wasn’t always the case. Stay tuned for next week, where we’ll discuss more about how we launched two additional measurements, and dived even deeper into the world of ICS coverage.
