Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

ICS/OT

New Open Source Tool Helps Identify EtherNet/IP Stacks for ICS Research, Analysis

Industrial cybersecurity firm Claroty on Wednesday announced a new open source tool designed for identifying EtherNet/IP stacks.

According to the company, the new “EtherNet/IP & CIP Stack Detector” tool can be useful to security researchers, operational technology (OT) engineers, and asset owners.

Industrial cybersecurity firm Claroty on Wednesday announced a new open source tool designed for identifying EtherNet/IP stacks.

According to the company, the new “EtherNet/IP & CIP Stack Detector” tool can be useful to security researchers, operational technology (OT) engineers, and asset owners.

EtherNet/IP (ENIP) is an industrial network protocol that implements the Common Industrial Protocol (CIP). ENIP is often used for process control and industrial automation applications.

In the past years, Claroty researchers have conducted projects focusing on the security of ENIP stacks and found vulnerabilities that could pose serious risks to industrial control systems (ICS).

Claroty says this open source tool can be used to identify and classify the use of third-party ENIP stack code, helping organizations understand their exposure to vulnerabilities found in these stacks.

The cybersecurity firm’s research has shown that many industrial organizations might not be aware that they are vulnerable to attacks due to the fact that many commercial products don’t clearly specify which third-party components they use. Situations like this have led to discussions on the need for SBOMs (software bill of materials).

There are also other use cases for the open source tool. Researchers can use it to identify connected industrial devices and the ENIP stacks they use.

“The tool would allow researchers to classify groups of devices running the same ENIP stack, and understand the scale of vulnerabilities and affected devices,” Claroty said.

Advertisement. Scroll to continue reading.

Researchers can also use it to improve their ICS honeypots — they can make it more difficult for attackers to deduce that the system they are targeting is part of a honeypot.

Learn More About Industrial Security Solutions at SecurityWeek’s ICS Cyber Security Conference

Claroty has used the tool in its own research to identify ENIP stacks and group similar implementations.

The tool currently supports the RTAutomation, CPPPO, OpENer and various Rockwell stacks.

The source code of the new EtherNet/IP & CIP Stack Detector is available on GitHub.

Claroty previously released open source tools for the vulnerabilities tracked as Urgent/11 and for analyzing Microsoft Access database files associated with SCADA applications.

Related: Open Source Tool Helps Secure Siemens PCS 7 Control Systems

Related: Researcher Shows How Adversaries Can Gather Intel on U.S. Critical Infrastructure

Related: Open Source Tool Helps Organizations Secure GE CIMPLICITY HMI/SCADA Systems

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Discover strategies for vendor selection, integration to minimize redundancies, and maximizing ROI from your cybersecurity investments. Gain actionable insights to ensure your stack is ready for tomorrow’s challenges.

Register

Dive into critical topics such as incident response, threat intelligence, and attack surface management. Learn how to align cyber resilience plans with business objectives to reduce potential impacts and secure your organization in an ever-evolving threat landscape.

Register

People on the Move

Dan Pagel has been named the new CEO of risk management and remediation firm Brinqa.

The City of Phoenix has promoted Mitch Kohlbecker to the role of Chief Information Security Officer.

Gigamon has promoted Tony Jarjoura to CFO and Ram Bhide has been hired as Senior VP of engineering.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.