aner/roam
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

backup: 2026-10-14 09:41

Browse Source
This commit is contained in:
Aner Zakobar
2026-10-14 09:41:44 +03:00
parent 828f59d961
commit 5c6ccbe3f2
13 changed files with 709 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ot-ics-security-rampreading-list.org
+1 -1
View File
@@ -15,4 +15,4 @@ Curated, high-quality cybersecurity resources Aner has found worth reading (and
- [[https://media.defense.gov/2026/Jul/09/2003959459/-1/-1/0/CSI_REDUCING_RISK_OF_SNMP_ABUSE.PDF][NSA/CISA CSI: Reducing the Risk of SNMP Abuse]] (2026-07-09) — joint US government cybersecurity advisory on SNMP abuse specifically in critical-infrastructure contexts. Covers v1/v2c plaintext community-string exposure, GET-based network/device-inventory reconnaissance, SET-based config tampering, and cites the Russian FSB Center 16 campaign that exfiltrated router configs (VPN configs, SCADA-network routing, credentials) from critical-infrastructure perimeter routers via SNMP + Cisco Smart Install — a real-world OT-relevant case study. Read 2026-10-09.
- [[https://redbotsecurity.com/examining-the-modbus-protocol/][RedBot Security: Examining the Modbus Protocol Through an Offensive-Security Lens]] — offensive/pentester-oriented deep-dive on Modbus TCP: function-code abuse, lack of auth/encryption/integrity, replay/MITM/DoS/command-injection patterns. Complements the FrostyGoop (2024) case study — malware that injected Modbus TCP commands to disable heating in Ukrainian apartment buildings, the modern successor to VPNFilter's 2018 Modbus traffic sniffing. Queued for review 2026-10-06.
- [[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7926645/][Vulnerability and Impact Analysis of the IEC 61850 GOOSE Protocol in the Smart Grid]] (open-access journal paper) — experimental analysis of GOOSE pub-sub weaknesses, showing an attacker with substation-network familiarity can falsify messages affecting real physical grid operation; covers why many vendor IEDs still ship without IEC 62351-6 encryption/signing since the overhead can exceed the end-to-end latency budget. Queued for review 2026-10-06.
- [[https://claroty.com/team82/research/opc-ua-deep-dive-a-complete-guide-to-the-opc-ua-attack-surface][Claroty Team82: OPC UA Deep Dive — A Complete Guide to the OPC UA Attack Surface]] — comprehensive attack-surface writeup from an OT security vendor's research team; relevant given current data (2026) showing over half of internet-exposed OPC-UA servers allow unauthenticated access and ~80% transmit in plaintext despite the protocol's built-in security options existing — "Security Policy: None" being valid and widely left set. Queued for review 2026-10-06.
- [[https://claroty.com/team82/research/opc-ua-deep-dive-a-complete-guide-to-the-opc-ua-attack-surface][Claroty Team82: OPC UA Deep Dive — A Complete Guide to the OPC UA Attack Surface]] — comprehensive attack-surface writeup from an OT security vendor's research team; relevant given current data (2026) showing over half of internet-exposed OPC-UA servers allow unauthenticated access and ~80% transmit in plaintext despite the protocol's built-in security options existing — "Security Policy: None" being valid and widely left set. Read 2026-10-12 — 10-part series covering protocol history, data model, HEL/OPN/MSG/CLO mechanics + SecureChannel/Session security model, supply-chain risk (529 products on a handful of shared SDKs), the ~50-vuln exploit framework, DoS/client-RCE/integration-server case studies, and asset-owner mitigations. See [[ot-ics-security-ramp/glossary]] for terms pulled from it.