Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

ICS/OT

New Open Source Tool Helps Identify EtherNet/IP Stacks for ICS Research, Analysis

Industrial cybersecurity firm Claroty on Wednesday announced a new open source tool designed for identifying EtherNet/IP stacks.

According to the company, the new “EtherNet/IP & CIP Stack Detector” tool can be useful to security researchers, operational technology (OT) engineers, and asset owners.

Industrial cybersecurity firm Claroty on Wednesday announced a new open source tool designed for identifying EtherNet/IP stacks.

According to the company, the new “EtherNet/IP & CIP Stack Detector” tool can be useful to security researchers, operational technology (OT) engineers, and asset owners.

EtherNet/IP (ENIP) is an industrial network protocol that implements the Common Industrial Protocol (CIP). ENIP is often used for process control and industrial automation applications.

In the past years, Claroty researchers have conducted projects focusing on the security of ENIP stacks and found vulnerabilities that could pose serious risks to industrial control systems (ICS).

Claroty says this open source tool can be used to identify and classify the use of third-party ENIP stack code, helping organizations understand their exposure to vulnerabilities found in these stacks.

The cybersecurity firm’s research has shown that many industrial organizations might not be aware that they are vulnerable to attacks due to the fact that many commercial products don’t clearly specify which third-party components they use. Situations like this have led to discussions on the need for SBOMs (software bill of materials).

There are also other use cases for the open source tool. Researchers can use it to identify connected industrial devices and the ENIP stacks they use.

“The tool would allow researchers to classify groups of devices running the same ENIP stack, and understand the scale of vulnerabilities and affected devices,” Claroty said.

Researchers can also use it to improve their ICS honeypots — they can make it more difficult for attackers to deduce that the system they are targeting is part of a honeypot.

Learn More About Industrial Security Solutions at SecurityWeek’s ICS Cyber Security Conference

Claroty has used the tool in its own research to identify ENIP stacks and group similar implementations.

The tool currently supports the RTAutomation, CPPPO, OpENer and various Rockwell stacks.

The source code of the new EtherNet/IP & CIP Stack Detector is available on GitHub.

Claroty previously released open source tools for the vulnerabilities tracked as Urgent/11 and for analyzing Microsoft Access database files associated with SCADA applications.

Related: Open Source Tool Helps Secure Siemens PCS 7 Control Systems

Related: Researcher Shows How Adversaries Can Gather Intel on U.S. Critical Infrastructure

Related: Open Source Tool Helps Organizations Secure GE CIMPLICITY HMI/SCADA Systems

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

ICS/OT

Otorio has released a free tool that organizations can use to detect and address issues related to DCOM authentication.