ICS/OTRockwell Automation Urges Customers to Disconnect ICS From Internet
Rockwell Automation is concerned about internet-exposed ICS due to heightened geopolitical tensions and adversarial cyber activity globally.
https://www.securityweek.com/rockwell-automation-urges-customers-to-disconnect-ics-from-internet/

Rockwell Automation is concerned about internet-exposed ICS due to heightened geopolitical tensions and adversarial cyber activity globally.

Rockwell Automation has issued a security notice urging customers to ensure that their industrial control systems (ICS) are not connected to the internet and exposed to cyber threats.

The industrial automation giant has told customers to take ‘immediate’ action and check whether any devices that are not specifically designed for public connectivity are exposed to the web.

Translation: We added network interfaces to our machines because sales needed the feature, but nobody wanted to change their development practices to secure it.

Over many years cyber actors have demonstrated their continued willingness to conduct malicious cyber activity against critical infrastructure (CI) by exploiting internet-accessible operational technology (OT) assets. Many products many by many different companies and used in OT applications have more or less questionable cyber security. Many legacy OT assets were not designed to defend against malicious cyber activities, combined with readily available information that identifies OT assets connected via the internet. There are also many new security problems in many newer devices. So generally it is a good idea to not to connect your OT networks directly to Internet.

A Shodan search for ‘Rockwell’ currently returns more than 7,000 results, including thousands of what appear to be Allen-Bradley programmable logic controllers (PLCs).

Rockwell’s advisory highlights several vulnerabilities found and patched in recent years, including CVE-2021-22681, CVE-2022-1159, CVE-2023-3595 and CVE-2023-3596, CVE-2023-46290, CVE-2024-21914, CVE-2024-21915, and CVE-2024-21917.

These flaws can allow hackers to conduct DoS attacks, escalate privileges, modify settings, remotely compromise PLCs, and even conduct Stuxnet-style attacks.

The discovery of exploits targeting CVE-2023-3595 and CVE-2023-3596 suggests that threat actors, particularly APT groups, have set their sights on Rockwell industrial products

Disconnect ICS Devices From Internet Per Rockwell Automation
https://www.youtube.com/watch?v=eA4g2s_Pi40

Rockwell Advises Disconnecting Internet-Facing ICS Devices Amid Cyber Threats
https://thehackernews.com/2024/05/rockwell-advises-disconnecting-internet.html

The company said it’s issuing the advisory due to “heightened geopolitical tensions and adversarial cyber activity globally.”

SD1672 | IMPORTANT NOTICE: Rockwell Automation Reiterates Customer Guidance to Disconnect Devices from the Internet to Protect from Cyber Threats
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1672.html

IMPORTANT NOTICE: Rockwell Automation Reiterates Customer Guidance to Disconnect Devices from the Internet to Protect from Cyber Threats

Due to heightened geopolitical tensions and adversarial cyber activity globally, Rockwell Automation is issuing this notice urging all customers to take IMMEDIATE action to assess whether they have devices facing the public internet and, if so, urgently remove that connectivity for devices not specifically designed for public internet connectivity.

More information on attacks on public-internet-exposed assets, including information on how to identify exposed assets and disconnect them from the public internet, is available in these documents from Rockwell Automation and CISA (Cybersecurity and Infrastructure Security Agency):

Rockwell Automation | Advisory on web search tools that identify ICS devices and systems connected to the Internet [login required]
CISA | NSA and CISA Recommend Immediate Actions to Reduce Exposure Across Operational Technologies and Control Systems
CISA | How-to Guide: Stuff Off Shodan

The US cybersecurity agency CISA has also posted an alert to bring attention to Rockwell’s notice.
https://www.cisa.gov/news-events/alerts/2024/05/21/rockwell-automation-encourages-customers-assess-and-secure-public-internet-exposed-assets

I will never be able to hear the name “Rockwell Automation” without thinking of this:
https://www.youtube.com/watch?v=RXJKdh1KZ0w

SANS ICS HyperEncabulator
He’s baaaaaaaaaaaaaaack …
https://www.youtube.com/watch?v=5nKk_-Lvhzo

This article provides an overview of the most promising network technologies and innovations, such as time-sensitive networking, and looks at how they’re revolutionizing industrial communications.

Here are some links to some other related articles:

https://www.electronicdesign.com/blogs/altembedded/article/21240842/electronic-design-the-evolution-of-ethernet

Time for Time-Sensitive Networking (TSN)
Synchronization of clocks across the network is being standardized
https://www.electronicdesign.com/magazine/51099?utm_source=EG+ED+Auto+Electronics&utm_medium=email&utm_campaign=CPS220627006&o_eid=7211D2691390C9R&rdx.ident%5Bpull%5D=omeda%7C7211D2691390C9R&oly_enc_id=7211D2691390C9R

https://www.electronicdesign.com/industrial-automation/article/21241056/electronic-design-nxp-upgrades-industrialgrade-mcu-with-tsn-ethernet

https://www.electronicdesign.com/industrial-automation/article/21154669/electronic-design-switch-chips-bring-timesensitive-networking-to-factory-floors

What’s the Difference: Serial Communications 101
June 1, 2021
Communication is the hallmark of IoT and computer systems in general. Here are some of the basics.
https://www.electronicdesign.com/technologies/communications/whitepaper/21127800/whats-the-difference-serial-communications-101?utm_source=EG+ED+Auto+Electronics&utm_medium=email&utm_campaign=CPS220627012&o_eid=7211D2691390C9R&rdx.ident%5Bpull%5D=omeda%7C7211D2691390C9R&oly_enc_id=7211D2691390C9R

R413D08 DC 5V 12V 24V 8ch RS485 Modbus Rtu Control Module for Relay PLC Switch technical data:
1: Operating Voltage : DC 5V(5V Version) / DC 6-24V(6-24 Version)
2: Operating Current : 10-15MA
3: ”open” ”close” ”Momentary” ”Self-locking” ”Interlock” ”Delay” 6 Commands
4: Two instruction-control mode : AT command and MODBUS command
5: Under the AT command ,the maximum delay is 9999 seconds
Under the MODBUS command ,the maximum delay is 255 seconds
6 AT commands can be made serial HyperTerminal (serial assistant) Enter;
MODBUS commands can be made serial HyperTerminal (serial assistant) OR ”Modbus Poll” Enter;
7 Under the MODBUS command mode, it can support up to 247 devices in parallel
8 With RS485 and RS232 (TTL) dual bus interface
9 Output control pins 8, 5V TTL level, low level (default) / high level output
10 Size: 45 * 30 * 15mm
11 Weight: 10g

Function description:
“Open”: Control port outputs low level (default)
“Off”: Control port outputs high level (default)

Here is an application example from R413D08 DC 5V 12V 24V 8ch RS485 Modbus Rtu Control Module for Relay PLC Switch product page:

Here a cheap USB-RS485 converter convers the data from computer to RS-485 format, and the board receives the data.

Modbus controlling

Modbus or MODBUS is a client/server data communications protocol in the application layer. It was originally published by Modicon (now Schneider Electric) in 1979 for use with its programmable logic controllers (PLCs). Modbus has become a de facto standard communication protocol for communication between industrial electronic devices in a wide range of buses and network.

This board supports MODBUS communications. The default communications parameters are 9600 Band ,8 Data bits,None Parity,1 Stop Bit. The default MODBUS slave address is 01.

Here is table from https://github.com/microrobotics/R413D08/issues/1 page that describes the supported MODBUS read commands:

When you read relay state, value 0×0001 means open and 0×0000 means closed.

The MODBUS address can be changed and if it is unknown, it can be read with “Read Slave ID” request: FF 03 00 FF 00 01 A1 E4

Here are the relay control commands:

I found the most useful command to be this direct control commands.
Command 0×06
Address 1-8 relay number
Values:
Open 256 (0×0100)
Close 512 (0×0200)

There are also commands that support more advanced features, for example opening or closing relay after predefined delay time. Under the MODBUS command the timing resolution is one second and the maximum delay is 255 seconds

More command details can be found in manual at https://github.com/microrobotics/R413D08/files/5689915/8.Channel.Multifunction.RS485.Module.command.pdf

AT commands

The Hayes command set (also known as the AT command set) is a specific command language originally developed for controlling modems. The command set consists of a series of short text strings which can be combined to produce commands for operations such as dialing, hanging up, and changing the parameters of the connection. It has been also adapted for other uses as well. In this product the AT command set is used to control the relays.

The module needs to be set to AT command mode to be able to use AT commands. This is done by making M0′s two pads are soldered together or connected with other means.

The communications worked well through RS-485 using TeraTerm terminal program with 9600 8N1 no handshake communications settings and the following terminal settings:

Here is the AT command (ASCII) overview if you want to try to use them:

Read Status:
Channel 1: AT+R1
Channel 2: AT+R2
Channel 3: AT+R 3
Channel 4: AT+R 4
Channel 5: AT+R 5
Channel 6: AT+R 6
Channel 7: AT+R 7
Channel 8: AT+R 8

Open relay:
Channel 1: AT+O1
Channel 2: AT+O2
Channel 3: AT+O3
Channel 4: AT+O4
Channel 5: AT+O5
Channel 6: AT+O6
Channel 7: AT+O7
Channel 8: AT+O8

Close:
Channel 1: AT+C1
Channel 2: AT+C2
etc..

Toggle (Self locking):
Channel 1: AT+T1
Channel 2: AT+T2
etc.

Latch
Inter locking
Channel 1: AT+L1
Channel 2: AT+L2
etc..

Momentary
Non locking )
Channel 1: AT+M1
Channel 2: AT+M2
etc.

Delay
Channel 1: AT+D1=XXXX
Channel 2: AT+D2=XXXX
etc.
XXXX = refers to the 0000 to 9999 figures, Unit is seconds
Under the AT command ,the maximum delay is 9999 second (over 2.7 hours).

Example 1:
Send command
“AT+ 0010 “”, Channel 1 is ” Open “”, after delay of 10 seconds, channel 1 is Close
Send command
” D 2= 0 10 0 “”, Channel 2 is ” Op en “”, after delay of 1 0 0 seconds, channel 2 is Close

Example 2:
Send command
“AT+ L1″, Channel 1 is ” Open “”, other C hannel s is ” Close
Send command
“AT+ L2″, Channel 2 is ” Open “”, other C hannel s is ” Close

More command details can be found in manual at https://github.com/microrobotics/R413D08/files/5689915/8.Channel.Multifunction.RS485.Module.command.pdf

More information

Links to more information:

5V 6-24V RS485 RS232 R413D08 8 Channel (TTL) Modbus RTU Control Module Multi-Function Relay PLC Control Board
https://www.aliexpress.com/i/1005003098396828.html

This RUST project can read and write a R413D08 module from the command line.
https://github.com/acpiccolo/R413D08-Controller/blob/main/README.md

RS485MODBUS V3.O
Software utility for STM8S103, R421A08, R221A04, R413D08 relay board
https://sourceforge.net/projects/rs485modbus/

R413D08
8 Channel Relay Control Module – RS485 & RS232
https://github.com/microrobotics/R413D08

Linux app named RS485modbus
https://www.onworks.net/software/app-rs485modbus

Product R413D08, USB to RS485/RS232 – documentation?
https://github.com/microrobotics/R413D08/issues/1

Product pages:

R413D08 DC 5V 12V 24V 8ch RS485 Modbus Rtu Control Module for Relay PLC Switch
https://www.ebay.com/itm/333654114235

5V 6-24V RS485 RS232 R413D08 8 Channel (TTL) Modbus RTU Control Module Multi-Function Relay PLC Control Board
https://www.aliexpress.com/item/1005003098396828.html

Description:
Specification:
Power Source: DC
Contact Load: Low Power
Voltage: 12V

Modbus RTU instruction
Baud rate: 9600 8 NONE 1

This cheap relay module arrived with no user manual, no operating instructions, no datasheets, and no technical support.

Steps:
1. Software settings communication baud rate
2. Set the address (communication using the device address, the default address is 01)

Modbus RTU instructions
Baud rate :9600 8 NONE 1

Modbus RTU Relay Module article describes 5V version of same type of board. The article list also the following commands to control the relays on the board.

Relay 1 ON = 01 05 00 00 FF 00 8C 3A
Relay 2 ON = 01 05 00 01 FF 00 DD FA
Relay 1 OFF = 01 05 00 00 00 00 CD DA
Relay 2 OFF = 01 05 00 01 00 00 9C 0A

After finishing the command I should get get the corresponding relay click and LED feedback and relay indicator lights up when the relay is ON.

I needed a software to send those codes to the device. The typical normal terminal editors like TeraTerm and Putty are not the right tools to do that. I need something where I can feed those HEX codes and send them out when I need. HTerm is a free terminal program for serial communication running on Windows and Linux. It supports sending messages you define (it accept input in HEX format). I installed to Windows version to a computer that run Windows 10.

The software worked well and my card reacted to most of those commands. Everything except relay one off command worked.

The board tells that it is designed to work with 12V power (it has relays with 12V coils in there). For a short test it seemed to work OK when powered with 9V battery. The relays say that they can control 10A 250V AC or 10A 30V DC. The relay outputs have a changeover contacts (closes one circuit and simultaneously opens a second circuit).

According Modbus protocol description the data packets indicate that the default device address is 1 (0×01) and the relays are controlled with Write Single Coil (0×05) command. The write address for first relay is 0 (0×0000) and for second relay it is 1 (0×0001). The value to write to turn on relay is 0xFF00 and to turn relay off the value to write is 0×0000.

Next test was to try a Modbus test software for controlling the relays. I used a free PowerHud Mobbus Tester softwARE from https://www.modbustester.com/ to test Modbus communications. It worked well and could control both relays.

The module also supports two digital inputs. There was lack of exact technical data on voltage levels they are designed to use and the addresses the information should be read from. But after some testing I found out that the inputs can be rad with Read Discrete Input (0×02) command at addresses 0×0000 for IN1 and 0×0001 for IN2.

The inputs are connected to the power input ground

The inputs seemed to react so that a positive voltage of 0 to 0.6V showed state “off” and voltage of 0.7V to 12V showed state “on”. Due the lack of exact technical data I did not try higher voltage than the device nominal operating voltage. The input circuit seems to consists of a transistor driven with few resistors. I measured that the input takes around 2 mA current when you feed control voltage to it from 9V battery.

Information on other board that look similar but might not be exactly similar:

Modbus RTU Relay Module
https://www.electroschematics.com/modbus/

MODBUS RTU 2 CHANNEL RELAY MODULE FIRST TEST
https://www.youtube.com/watch?v=o5cIF3TRwyg

N4ROB02 2CH Micro Size MODBUS RTU RS485 Relay Board
https://www.youtube.com/watch?v=P0LsmAz_VpU

Modbus-Rtu 2 Relay Outputs 2 Switch Inputs TTL/ RS485 Interface Communication
https://www.fruugo.fi/modbus-rtu-2-relay-outputs-2-switch-inputs-ttl-rs485-interface-communication/p-274194316-608528429?language=en&ac=croud&utm_source=organic_shopping&utm_medium=organic

N4ROB02 2CH Micro Size MODBUS RTU RS485 Relay Board
https://www.youtube.com/watch?v=P0LsmAz_VpU

Modbus RTU 2 Way Relay Module TTL/RS485 Interface Communication with Indicator
https://www.ebay.co.uk/itm/144858429900?chn=ps&_ul=GB&_trkparms=ispr%3D1&amdata=enc%3A1n1VKqhPwR8y76HhajGXCxw84&norover=1&mkevt=1&mkrid=710-169684-076987-9&mkcid=2&itemid=144858429900&targetid=293946777986&device=c&mktype=pla&googleloc=1005576&poi=&campaignid=20646531284&mkgroupid=154544387436&rlsatarget=pla-293946777986&abcId=&merchantid=232722533&gad_source=1&gclid=EAIaIQobChMIgLXm4fPEhAMV-VCRBR0IYgy8EAQYCCABEgLCAfD_BwE

LC 2-way Modbus relay module
http://www.chinalctech.com/m/view.php?aid=455

N4ROB02 2CH Micro Size MODBUS RTU RS485 Relay Board
https://www.youtube.com/watch?v=P0LsmAz_VpU

Parameters:
Product name: temperature and humidity transmitter
DC power supply: DC 5V-30V
Output signal: RS485 signal
Temperature accuracy: ±0.5℃ (25℃)
Humidity accuracy: ±3%RH
Temperature range: 0%RH-80%RJ
Temperature resolution: 0.1℃
Humidity resolution: 0.1%RH
Equipment power consumption: ≤0.2W
Communication address: 1-247 can be set, default 1
Communication protocol: Modbus-RTU protocol and custom common protocol
Baud rate: configurable, default 9600, 8-bit data, 1-bit stop, no parity

This product integrates the MODBUS protocol and the common protocol Using RS485 hardware interface. The user can choose the communication protocol. The product adopts industrial grade chip, high-precision SHT40 temperature and humidity sensor.

Wiring:

My plan was to first test it with Modbus protocol. I wired this sensor to PC using a cheap “no name” USB to RS-485 adapter. For powering the sensor I used 5V from USB port (wired to sensor with cut USB cable).

Here is the overview of the supported Modbus communications protocol.

I think I need to read the temperature and humidity register. To use it I need some software to handle Modbus communications and help testing if it works.

CAS Modbus Scanner is a free proprietary application from Chipkin Automation Systems that I used as first tool to verify that basic Modbus communications works and devices could be found on but. It’s Discover functionality allowed to find that device is there, but for some reason the software did not seem to get successfully data from it.

So it seems that I needed some other tool to make communications work. PowerHud Mobbus Tester from https://www.modbustester.com/ could read the data successfully from the sensor.

How to interpret data info from https://www.aliexpress.com/item/1005001475675808.html

In addition to Modbus protocol, there is another protocol called common protocol. That “common protocol” is a simple ASCII protocol that can be used with any common serial port terminal program. I followed the instructions from XY-MD02 Temp Humidity Serial UART Communication article and video. Here is the most important takeout of special Putty settings in addition to serial port (9600 BPS 8N1) needed to get communications to work:

I got this other protocol to work with Putty program. The READ command reads the temperature and humidity values.

The common protocol has said to have an automatic upload function (connecting RS485 through the serial port adjustment tool will automatically output temperature and humidity). That can be started using command AUTO.

Links to more material:

XY-MD02 Sensor Setting – Modbus RTU Network
https://accautomation.ca/xy-md02-sensor-setting-modbus-rtu-network/

XY-MD02 Temp Humidity Serial UART Communication
https://accautomation.ca/xy-md02-temp-humidity-serial-uart-communication/

https://www.instructables.com/XY-MD02-Temperature-and-Humidity-Sensor-Module-Mod/

Product pages with data:
https://www.aliexpress.com/item/1005001475675808.html

Videos:
https://www.youtube.com/watch?v=V0_IqkWIPG0
https://www.youtube.com/watch?v=e_1QHtkOf6k

Source code links:
https://github.com/TitusSetiawan/XYMD02-ESP32-modbus
https://github.com/cesgarma/modbus-XY-MD02

The thermostat is based on bimetal strip that bends based on temperature. To get sharp transition and some hysteresis there is also magnet near silver calibration adjustment screw and electrical contacts. Components on board are small 4700 pF capacitor for NC contact filtering and one resistor (marked as RF in circuit wiring).

The electrical NC contact (heater) is rated for 10A current at AC230V and NO contact (fan) for 5A. The contacts can also be used for low voltage signals (24V DC minimum 20 mA current for reliable indication).

RF had value of around 237 kohms. When wired at mains power application means about 1 mA current at 230V AC goes through the RF resistor when the heater is turned on. Around 230 mW power loss on resistor, which means some heating to bimetal strip to reduce hysteresis according to document that came with the product. According to manual the N contact connected to resistor can be left not connected if higher hysteresis is wanted than what is got when N is wired to neutrak.

“Some of the recent cybersecurity incidents involving industrial control systems (ICS) have resulted in injury and even loss of life, according to a survey conducted by Control Systems Cyber Security Association International (CS2AI).”

More:

https://www.securityweek.com/some-ics-security-incidents-resulted-injury-loss-life-survey

Solid-state relay ST-OV2- 12DC/ 60DC/1 – 2905022 is a plug-in power solid-state relay (plug to certain Phoenix Contact wiring terminals), with LED and protective circuit in input and output circuits. Here is a simplified circuit diagram (from manufacturer data) of this solid state relay model:

This relay model has nominal input voltage of 12V DC. The relay output is designed to drive load at 12 – 60 V DC voltage range and maximum 1A current. More detailed data:

Input data
Nominal input voltage UN 12 V DC
Input voltage range in reference to UN 0.8 … 1.2
Input voltage range 9.6 V DC … 14.4 V DC
Switching threshold “0″ signal in reference to UN ≤ 0.4
Switching threshold “1″ signal in reference to UN ≥ 0.8
Typical input current at UN 7 mA
Typical response time 20 µs
Typical turn-off time 200 µs
Status display Yellow LED
Type of protection Reverse polarity protection
Surge protection
Protective circuit/component Polarity protection diode
Transmission frequency 500 Hz

Output data
Output voltage range 12 V DC … 60 V DC
Limiting continuous current 1 A (see derating curve)
Surge current 5 A (t = 1 s)
Peak offstate voltage 60 V DC (Collector-emitter reverse voltage)
Voltage drop at max. limiting continuous current 1.2 V
Output circuit 2-wire, floating
Type of protection Reverse polarity protection
Surge protection
Protective circuit/component Polarity protection diode

General
Test voltage input/output 2.5 kV AC
Mounting position any
Standards/regulations DIN VDE 0110b, Gr. C for 250 V DC
DIN VDE 0160 (in relevant parts)

Let’s take a closer look at the product:

Let’s open the case:

A look at electronics inside. This looks quite complicated construction that has many components and two circuit boards.

The product data also gives this kind of drawing that describes the circuit protection built into the relay:

Here is my hand drawing of the circuit inside SSR:

The signal input circuit is pretty basic consisting of polarity protection diode, current limiting resistor, zener diode and optocoupler LED. There is also a VDR between input pins for over voltage / surge protection. Those three zero ohms resistors make me wonder why they have used so many resistors. The reason for this could be that because there are variations of this relay also for other voltages (for example 24V DC input and 110V DC input), and on those higher voltage versions there could be need to use several resistors in series (to meet voltage and/or power handling ratings needed).

The output side is implemented with NPN power transistor that is driven with optoisolator output amplified with one PNP transistor. The all output transistors and optoisolator output have high enough rating to handle the full output voltage. On the output there is a surge protection component between output pins (striking voltage 65-71V). Theoretically the power transistor itself could handle much more current than 1A, but I think the output is limited to 1A because of thermal constraints (just transistor inside small case). Other limiting factor is that the IN4007 diode on the output is rated only for 1A current.

Component data of most important components:
2SD843 NPN power transistor (Vce 80V, Ic 5A , 40W, 10 MHz, hFE 70)

BC640 PNP transistor

SFH601-3 optoisolator

1.5K-68CA Transient Voltage Suppression Diode

What is insideComponents close-upWhat was found was two dual gas discharge tubes ant two other over voltage protectors. The gas discharge tubes were connected to pins at one end (two protectors for two signal wire pairs).The contacts on other and go to flexible circuit board that has just those surgectors/zeners in it. Look like a bit of complicated electro-mechanical construction because it looks like just directly soldering the components to pins on bottom had done the same.