Your expensive PLC is just as naked as the cheap one

Whenever the Modbus-has-no-password story goes around, someone in the comments says the sensible-sounding thing: that is what you get for running a forty-year-old protocol, buy a proper PLC from a proper vendor and this goes away.

It does not go away. I put two of those proper PLCs on a bench, a Rockwell one and a Siemens one, the kind that run real plants and cost real money, and I did the same simple thing to each. I sat on the network between the controller and the software that talks to it, and I watched.

The Rockwell speaks EtherNet/IP, the most common protocol on the North American plant floor. To talk to it you open a session, and that open-session handshake asks for nothing. It is a hello, not a login. Once you have said hello you can name a tag and read it or write it. So I wrote one. A setpoint, changed to a new value, and the value went across the wire in plain sight. The tag names travel as readable text too, so I did not even need the documentation. The controller told me what everything was called and then let me change it.

The Siemens speaks S7comm, which runs a huge share of the controllers across Europe and the Gulf. It has an extra step the others do not, a setup exchange that looks like it might be where a password lives. It is not. It negotiates buffer sizes. After that the story is identical: I wrote a value into a data block, in the clear, and the controller accepted it without asking who I was.

Two vendors, two protocols, one result. The name on the front of the cabinet did not buy a lock. And that is the point worth sitting with, because it means this was never about one cheap old protocol. Modbus, EtherNet/IP, S7comm, three different eras and three different companies, all trust whoever is on the wire, for the same reason. They were all built for a network where being on the wire meant you were already inside the plant. Copper and concrete did the security. The protocol never had to.

To be fair to both vendors, there is a lock available now. Rockwell has a secure version of its protocol; Siemens has protection levels and a newer, better-behaved dialect. These are real and you should turn them on. But they are optional, they are uneven across a floor full of mixed-age equipment, and they are off by default, which means on most sites they are a plan rather than a fact. One old drive in the cell that cannot speak the secure version leaves a plaintext island behind the fence anyway.

So the thing you can actually rely on, across a floor of new Rockwell and old Siemens and the ancient drive nobody will ever replace, is the same thing that protected the pump in the first part of this series: the network drawing. Segment the cell. Let only the paths that must write, write. Watch for the write that should not come. The lesson of the pump was that the flat network is the problem, not the protocol. The lesson here is that the flat network does not care what you spent.

I captured both writes, on both controllers, and decoded them down to the bytes. If you want to see a name-brand PLC hand over its setpoint to a stranger, the captures are in the lab write-up.