Industrial cybersecurity firm Claroty on Wednesday announced a new open source tool designed for identifying EtherNet/IP stacks.
According to the company, the new “EtherNet/IP & CIP Stack Detector” tool can be useful to security researchers, operational technology (OT) engineers, and asset owners.
EtherNet/IP (ENIP) is an industrial network protocol that implements the Common Industrial Protocol (CIP). ENIP is often used for process control and industrial automation applications.
In the past years, Claroty researchers have conducted projects focusing on the security of ENIP stacks and found vulnerabilities that could pose serious risks to industrial control systems (ICS).
Claroty says this open source tool can be used to identify and classify the use of third-party ENIP stack code, helping organizations understand their exposure to vulnerabilities found in these stacks.
The cybersecurity firm’s research has shown that many industrial organizations might not be aware that they are vulnerable to attacks due to the fact that many commercial products don’t clearly specify which third-party components they use. Situations like this have led to discussions on the need for SBOMs (software bill of materials).
There are also other use cases for the open source tool. Researchers can use it to identify connected industrial devices and the ENIP stacks they use.
“The tool would allow researchers to classify groups of devices running the same ENIP stack, and understand the scale of vulnerabilities and affected devices,” Claroty said.
Researchers can also use it to improve their ICS honeypots — they can make it more difficult for attackers to deduce that the system they are targeting is part of a honeypot.
Learn More About Industrial Security Solutions at SecurityWeek’s ICS Cyber Security Conference
Claroty has used the tool in its own research to identify ENIP stacks and group similar implementations.
The tool currently supports the RTAutomation, CPPPO, OpENer and various Rockwell stacks.
The source code of the new EtherNet/IP & CIP Stack Detector is available on GitHub.
Claroty previously released open source tools for the vulnerabilities tracked as Urgent/11 and for analyzing Microsoft Access database files associated with SCADA applications.
Related: Open Source Tool Helps Secure Siemens PCS 7 Control Systems
Related: Researcher Shows How Adversaries Can Gather Intel on U.S. Critical Infrastructure
Related: Open Source Tool Helps Organizations Secure GE CIMPLICITY HMI/SCADA Systems
