Modbus TCP/RTU Security: No Auth, No Encryption
Modbus was created by Modicon in 1979 for serial communication between PLCs. It has three variants: Modbus RTU (compact binary over serial), Modbus ASCII (human-readable over serial), and Modbus TCP (encapsulated over Ethernet, port 502). All three share the same security posture: none.
Any device on a Modbus TCP network can read sensor values, write setpoints, and toggle actuator outputs — with no credentials required. The protocol has no concept of identity, sessions, or permissions.
Protocol Architecture
Modbus uses a master-slave (initiator-responder) model. The master sends requests; slaves respond. Each request carries a Function Code (FC) that specifies the operation:
| FC | Operation | Security Risk |
|---|---|---|
0x01 | Read Coils | Discloses digital output states |
0x03 | Read Holding Registers | Discloses process values, setpoints |
0x05 | Write Single Coil | Toggles actuators (pump on/off) |
0x06 | Write Single Register | Modifies setpoints — primary attack vector |
0x10 | Write Multiple Registers | Mass parameter modification |
A Modbus TCP frame adds a 6-byte MBAP header (Transaction ID, Protocol ID, Length, Unit ID) before the standard PDU. No authentication fields exist anywhere in the frame.
Security Vulnerabilities
- No authentication — zero credential check before any command executes
- No encryption — all process data readable by any host on the path
- No replay protection — captured frames can be retransmitted indefinitely
- No message integrity — MBAP CRC only detects bit errors, not tampering
- Broadcast Unit ID 0xFF — one frame addresses all devices simultaneously
Real-World Incidents
- Oldsmar Water Treatment (2021) — Attacker used remote access to issue FC06 write, changing NaOH concentration from 111 ppm to 11,100 ppm. Operator reversed it manually.
- Stuxnet (2010) — Used Modbus to communicate with Siemens S7 PLCs alongside proprietary STEP 7 protocol to gather process data before the centrifuge attack.
- Industroyer (2016) — Dedicated Modbus module issued commands to RTUs in the Ukrainian power grid attack alongside IEC 104.
Defences (IEC 62443)
| Control | IEC 62443 SR | Effect |
|---|---|---|
| Network segmentation | SR 5.1 | PLCs on isolated VLAN, no IT→OT direct path |
| FC allow-listing firewall | SR 5.2 | Block FC05/FC06/FC10 from non-SCADA IPs |
| OT-aware IDS | SR 6.2 | Alert on FC03/FC06 from unknown master IPs |
| Encrypted VPN tunnel | SR 4.1 | Wrap Modbus TCP in IPsec for WAN links |
Walk through ARP spoofing, register injection, and false data injection against a simulated Modbus TCP network — then apply IEC 62443 defences.
Open Attack Simulator →