Over 4,400 Rockwell Automation Programmable Logic Controllers (PLCs) have been discovered directly exposed to the internet, with a significant portion controlling critical water infrastructure systems. These industrial control systems lack proper security controls, making them vulnerable to unauthorized access, manipulation, and potential disruption of essential water treatment and distribution operations. Organizations must immediately audit their operational technology (OT) networks and implement network segmentation to prevent catastrophic service interruptions.
Introduction
A recent discovery has revealed a disturbing security landscape affecting critical infrastructure: more than 4,400 Rockwell Automation PLCs are directly accessible from the internet without adequate protection. These industrial control devices, which manage everything from water treatment processes to distribution pump stations, represent a significant attack surface for malicious actors seeking to disrupt essential services.
The exposure of these devices isn’t merely a theoretical concern. PLCs control physical processes in real-time, and unauthorized access could lead to contamination events, service disruptions, or damage to expensive equipment. With water systems being designated as critical infrastructure in most countries, the security implications extend far beyond individual facilities to affect entire communities and potentially millions of people.
This discovery underscores a persistent problem in industrial cybersecurity: the convergence of operational technology with internet connectivity without corresponding security improvements. Many of these systems were designed decades ago when air-gapped networks were the norm, and security wasn’t a primary design consideration.
Background & Context
Rockwell Automation PLCs, particularly from the Allen-Bradley ControlLogix and CompactLogix families, are ubiquitous in industrial environments worldwide. These devices execute ladder logic programs to control valves, pumps, motors, and sensors that manage physical processes. In water systems, they regulate chemical dosing, pressure management, filtration systems, and distribution networks.
The EtherNet/IP protocol, which many Rockwell PLCs use for communication, was designed for reliable industrial communications within controlled environments—not for exposure to the hostile internet. This protocol typically operates on TCP port 44818 and, by default, includes minimal authentication mechanisms.
Recent scanning initiatives by security researchers using platforms like Shodan and Censys have identified these exposed devices across North America, Europe, and other regions. The United States accounts for the largest concentration, with water utilities in both urban and rural areas affected. Many of these installations date back 10-15 years when the concept of “smart” infrastructure was gaining traction but cybersecurity best practices for OT environments were still emerging.
The water sector faces unique challenges in cybersecurity implementation. Many facilities operate with limited budgets, small IT/OT staffs, and legacy equipment that cannot be easily upgraded or replaced. This creates an environment where devices remain exposed not due to negligence, but because of resource constraints and the complexity of securing operational environments without disrupting critical services.
Technical Breakdown
The exposure vectors for these Rockwell PLCs fall into several categories:
Direct Internet Connectivity: Many devices have public IP addresses assigned directly to their Ethernet interfaces. This configuration allows anyone with network scanning tools to discover and attempt connections to these controllers.
Inadequate Firewall Rules: Some installations have firewalls, but overly permissive rules allow incoming connections on industrial protocols. Common misconfigurations include allowing EtherNet/IP (TCP/UDP 44818), HTTP configuration interfaces (TCP 80), and FTP services (TCP 21) from any source address.
VPN Misconfigurations: Several exposed systems appear to be behind VPN concentrators, but the VPNs either have default credentials, known vulnerabilities, or are configured to allow split-tunneling that exposes the PLC networks.
Lack of Authentication: EtherNet/IP implementations on many Rockwell PLCs don’t enforce strong authentication by default. An attacker who establishes network connectivity can often read configuration data, monitor process values, and in some cases, modify controller programs or force outputs.
The typical attack chain would follow this pattern:
1. Discovery Phase
- Scan for TCP port 44818 (EtherNet/IP)
- Identify Rockwell PLCs via CIP protocol fingerprinting
- Reconnaissance
- Query device identity and firmware version
- Enumerate I/O modules and network topology
- Read tag database and program logic
- Exploitation
- Upload modified ladder logic
- Force discrete outputs (open/close valves)
- Modify setpoints (chemical dosing levels)
- Disable safety interlocksTools required for this exploitation are freely available. Software like Rockwell’s RSLinx and third-party utilities can communicate with these PLCs without requiring specialized exploit code. The CIP (Common Industrial Protocol) specification is publicly documented, enabling anyone with moderate technical skills to craft malicious commands.
Impact & Risk Assessment
The consequences of compromised water system PLCs range from service disruption to public health emergencies:
Immediate Operational Impact:
- Unauthorized shutdown of pumping stations leading to water pressure loss
- Interruption of treatment processes causing untreated water distribution
- Damage to equipment through improper operation sequences
- Loss of SCADA visibility preventing operators from monitoring system status
Public Health Risks:
- Manipulation of chemical dosing systems (chlorine, fluoride, pH adjustment)
- Contamination events if treatment processes are disrupted
- Backflow situations if pressure management fails
- Potential for waterborne disease outbreaks
Economic Consequences:
- Emergency response costs averaging $500K-$2M per incident
- Equipment replacement from damage caused by improper operation
- Regulatory fines for water quality violations
- Liability exposure from service interruptions
Cascading Effects:
- Hospitals and emergency services lose water supply
- Fire suppression systems become inoperable
- Industrial processes dependent on water supply halt
- Public confidence in utility infrastructure erodes
The risk severity is classified as CRITICAL for several reasons: the ease of exploitation, the potential for widespread impact, the difficulty of rapid recovery, and the direct threat to public health and safety.
Historical precedents exist. The 2021 Oldsmar, Florida water treatment incident demonstrated how an attacker gained remote access to SCADA systems and attempted to increase sodium hydroxide levels to dangerous concentrations. While that attack was detected and prevented, it illustrated the real-world viability of such threats.
Vendor Response
Rockwell Automation has published security advisories and guidance documents addressing secure deployment of their PLC systems. The company’s position emphasizes that PLCs are designed for deployment within protected industrial networks and should never be directly exposed to the internet.
Key vendor recommendations include:
Security Development Lifecycle: Rockwell has implemented secure development practices for newer products, including the ControlLogix 5580 and CompactLogix 5380 series, which support enhanced security features like role-based access control, encrypted communications via TLS, and secure boot capabilities.
Published Guidelines: The company maintains a “Converged Plantwide Ethernet (CPwE) Design and Implementation Guide” that specifies industrial network architecture with proper segmentation, demilitarized zones (DMZ), and defense-in-depth strategies.
Security Patches: Rockwell regularly releases firmware updates addressing discovered vulnerabilities. However, the patching process for PLCs in production environments is complex, often requiring planned downtime and extensive testing.
Partnership Programs: Rockwell collaborates with industrial cybersecurity vendors to certify compatible security solutions, including industrial firewalls, intrusion detection systems, and secure remote access platforms.
The vendor has not issued a specific advisory regarding these internet exposures, as the root cause is deployment configuration rather than a product vulnerability. However, Rockwell’s customer support teams are reportedly reaching out to known customers with exposed systems to provide remediation assistance.
Mitigations & Workarounds
Organizations with exposed Rockwell PLCs should implement these immediate actions:
Emergency Mitigations (within 24-48 hours):
# Firewall rule to block external access to EtherNet/IP
iptables -A INPUT -p tcp --dport 44818 -s ! 10.0.0.0/8 -j DROP
iptables -A INPUT -p udp --dport 44818 -s ! 10.0.0.0/8 -j DROP
# Block HTTP/HTTPS management interfaces
iptables -A INPUT -p tcp --dport 80 -s ! 10.0.0.0/8 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 10.0.0.0/8 -j DROP
Network Segmentation:
- Implement separate VLANs for OT networks
- Deploy industrial firewalls between IT and OT zones
- Use unidirectional gateways for data flowing to business networks
- Remove public IP addresses from PLC devices
Access Control:
- Enable ControlLogix 5580 Enhanced Security features
- Configure role-based access with strong passwords
- Implement multi-factor authentication for remote access
- Use certificate-based authentication where supported
Remote Access Security:
- Deploy industrial VPN solutions (not consumer-grade)
- Implement jump boxes/bastion hosts for technician access
- Use time-limited access credentials
- Enable comprehensive logging of all remote sessions
Monitoring Implementation:
- Install network taps on critical OT segments
- Deploy passive monitoring solutions that don’t interfere with operations
- Configure alerts for unauthorized communication attempts
- Baseline normal PLC communication patterns
Long-term Architecture Changes:
- Implement the Purdue Model for industrial networks
- Design DMZ architecture for vendor remote support
- Deploy OT-specific security operations center (SOC) capabilities
- Conduct regular architecture reviews with cybersecurity experts
Detection & Monitoring
Identifying unauthorized access to PLCs requires specialized detection capabilities:
Network-Based Detection:
Monitor for anomalous EtherNet/IP traffic patterns:
# Example Snort rule for unauthorized PLC programming
alert tcp any any -> $PLC_NETWORK 44818 (msg:"Potential PLC Program Upload";
content:"|6f 00|"; offset:0; depth:2;
content:"Upload"; nocase;
classtype:policy-violation;
sid:1000001; rev:1;)Indicators of Compromise:
- Unexpected program uploads or downloads
- Configuration changes outside maintenance windows
- Login attempts from unknown IP addresses
- Unusual source/destination port combinations
- Off-hours communication sessions
- Multiple failed authentication attempts
PLC-Specific Monitoring:
- Track ladder logic modification timestamps
- Monitor for forced I/O conditions
- Alert on safety system bypasses
- Detect changes to controller mode (RUN/PROGRAM)
- Log all user authentication events
Behavioral Analytics:
- Establish baselines for normal PLC communication volumes
- Detect deviations in scan cycle times
- Monitor for unexpected peer-to-peer PLC communications
- Identify unusual patterns in tag value changes
Log Sources to Aggregate:
- Industrial firewall connection logs
- PLC audit logs (if enabled)
- SCADA system access records
- Network flow data (NetFlow/IPFIX)
- Physical access control systems
Deploy solutions like Nozomi Networks, Claroty, or Dragos Platform that provide OT-specific threat detection capabilities with awareness of industrial protocols and PLC-specific attack techniques.
Best Practices
Securing industrial control systems requires a comprehensive approach:
Organizational Practices:
- Conduct regular OT network assessments and penetration testing
- Maintain accurate asset inventories including firmware versions
- Develop incident response plans specific to OT environments
- Provide cybersecurity training tailored to OT personnel
- Establish clear change management procedures
Technical Controls:
- Apply defense-in-depth with multiple security layers
- Implement least-privilege access principles
- Use application whitelisting on HMI workstations
- Deploy industrial antivirus solutions designed for OT environments
- Enable all available security features on modern PLCs
Compliance & Standards:
- Follow NIST Cybersecurity Framework for water utilities
- Implement AWWA (American Water Works Association) guidance
- Comply with state-level critical infrastructure protection regulations
- Adopt IEC 62443 industrial security standards
- Conduct required CISA assessments for high-risk facilities
Vendor Management:
- Establish secure procedures for vendor remote access
- Require cybersecurity clauses in service contracts
- Verify vendor security practices before granting access
- Monitor vendor sessions with privileged access management tools
Continuous Improvement:
- Participate in information sharing (WaterISAC)
- Conduct tabletop exercises simulating cyber incidents
- Review security posture quarterly
- Stay informed about emerging threats targeting water systems
Key Takeaways
- Over 4,400 Rockwell PLCs are internet-accessible, primarily in water infrastructure, creating immediate security risks
- Default configurations lack authentication, allowing unauthorized access to read and potentially modify control programs
- Public health implications are severe, with potential for contamination or service disruption affecting millions
- Network segmentation is critical—PLCs should never be directly exposed to the internet under any circumstances
- Immediate action is required: organizations must audit their exposure and implement firewalls or remove public accessibility
- Specialized monitoring is essential to detect unauthorized access attempts and configuration changes
- Legacy systems present ongoing challenges that require balanced approaches considering operational requirements and security needs
The discovery of these exposed systems represents both a vulnerability and an opportunity. While the current state is concerning, it provides a catalyst for the water sector to prioritize cybersecurity investments and implement the protective measures necessary to safeguard essential services.
References
- Rockwell Automation Security Advisory: Converged Plantwide Ethernet Design Guide
- CISA ICS Advisory: Secure Water Treatment Control Systems
- AWWA G430-14: Security Practices for Operation and Management
- NIST Special Publication 800-82 Rev. 2: Guide to Industrial Control Systems Security
- Shodan Industrial Control System Report 2024
- ICS-CERT Monitor: Water and Wastewater Systems Sector
- WaterISAC Analysis: Cyber Threats to Water Utilities
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
