Modern Industrial Control Systems (ICSs) allow remote communication through the Internet using industrial protocols that were not designed to work with external networks. To understand security issues related to this practice, prior work usually relies on active scans by researchers or services such as Shodan. While such scans can identify public open ports, they are not able to provide details on configurations of the system related to legitimate Industrial Traffic passing the Internet (e.g., source-based filtering in Network Address Translation or Firewalls). In this work, we complement Shodan-only analysis with large-scale traffic analysis at a local Internet Exchange Point (IXP), based on sFlow sampling. This setup allows us to identify ICS endpoints actually exchanging Industrial Traffic over the Internet. Besides, we are able to detect scanning activities and what other type of traffic is exchanged by the systems (i.e., IT traffic). We find that Shodan only listed less than 2% of hosts that we identified as exchanging Industrial Traffic. Even with manually triggered scans, Shodan only identified 7% of them as ICS hosts. This demonstrates that active scanning-based analysis is insufficient to understand current security practices in ICS communications. We show that 75.6% of ICS hosts rely on unencrypted communications without integrity protection, leaving those critical systems vulnerable to malicious attacks.

中文翻译：

---

抱歉，Shodan 还不够！通过 IXP 网络流量分析评估 ICS 安全性

现代工业控制系统 (ICS) 允许使用非设计用于外部网络的工业协议通过互联网进行远程通信。为了了解与此做法相关的安全问题，之前的工作通常依赖于研究人员或 Shodan 等服务的主动扫描。虽然此类扫描可以识别公共开放端口，但它们无法提供与通过 Internet 的合法工业流量相关的系统配置的详细信息（例如，网络地址转换或防火墙中的基于源的过滤）。在这项工作中，我们基于 sFlow 采样，在本地互联网交换点 (IXP) 上用大规模流量分析补充了仅 Shodan 分析。此设置使我们能够识别实际通过 Internet 交换工业流量的 ICS 端点。除了，我们能够检测扫描活动以及系统交换的其他类型的流量（即 IT 流量）。我们发现 Shodan 只列出了不到 2% 的主机，我们确定为交换工业流量。即使使用手动触发扫描，Shodan 也仅将其中 7% 识别为 ICS 主机。这表明基于主动扫描的分析不足以了解 ICS 通信中的当前安全实践。我们表明 75.6% 的 ICS 主机依赖于没有完整性保护的未加密通信，使这些关键系统容易受到恶意攻击。Shodan 仅将其中 7% 确定为 ICS 主机。这表明基于主动扫描的分析不足以了解 ICS 通信中的当前安全实践。我们表明 75.6% 的 ICS 主机依赖于没有完整性保护的未加密通信，使这些关键系统容易受到恶意攻击。Shodan 仅将其中 7% 确定为 ICS 主机。这表明基于主动扫描的分析不足以了解 ICS 通信中的当前安全实践。我们表明 75.6% 的 ICS 主机依赖于没有完整性保护的未加密通信，使这些关键系统容易受到恶意攻击。