SCADA Protocol Weakness Lab
An industrial protocol's risk is set by its version and security mode, not its name. Modbus/TCP, IEC 60870-5-104 and classic S7comm have no authentication field at all; DNP3 can enable Secure Authentication v5; OPC-UA swings from wide-open (SecurityMode None) to fully protected (Sign & Encrypt); and IEC 61850 GOOSE is unauthenticated L2 multicast unless IEC 62351 signing is applied. In each of 12 rounds you read a wire-view of the frame, name the concrete weakness, and pick the mitigation that fits that exact version. Defender lens only — weakness and mitigation from public documentation, no exploit code or payloads.
The real job. More noise, a tighter clock.
Protocol 1 / 12
Modbus/TCP · as designed (no security)
A PLC on a cell that the business VLAN can route to. A historian polls it; so can anything else on the path.
1 · Concrete weakness (this version)
2 · Real mitigation
Pick the weakness and the mitigation for this version.
Protocol clinic
12 real protocols, each pinned to a specific version or security mode. Read the wire-view, name the concrete weakness, and pick the mitigation that fits that exact version. Watch for the hardened variants — DNP3-SA, signed GOOSE, OPC-UA Sign&Encrypt — where the answer flips.
So far: 0 / 12 answered.
Read the version, not the name
No auth field in the frame (Modbus, 104, classic S7comm) → you cannot fix the protocol, you segment + DPI.
Auth that is switched off (DNP3) → enable it. A security mode (OPC-UA None/Sign/S&E) → raise it.
Already authenticated (DNP3-SA, signed GOOSE, OPC-UA S&E) → verify it stays enforced.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based lab on the real security properties of the protocols that run industrial plants — and how they change with version and security mode.
- Twelve rounds across Modbus/TCP, DNP3 (and DNP3 Secure Authentication v5), IEC 60870-5-104, IEC 61850 GOOSE and MMS, Siemens S7comm vs S7CommPlus, and OPC-UA at SecurityMode None, Sign and Sign & Encrypt.
- For each you read a wire-view of the frame, name the concrete weakness (no authentication, replay/spoof, plaintext, GOOSE L2 spoof, or already authenticated), and pick the mitigation that fits that exact version.
- Version-aware traps are the point: plain DNP3 is spoofable but DNP3-SA v5 is not; OPC-UA None is wide open but Sign & Encrypt is the protocol done right; default GOOSE spoofs but IEC 62351-6 signing closes it.
- Scored and graded S–D. Educational and defender-focused — weakness and mitigation from public protocol documentation and CISA ICS guidance. No exploit code, no payloads, no live traffic.
Read the version, not the name
Most OT protocols were built for trusted, private networks and assume everyone on the wire is authorised. Modbus (1979), IEC 60870-5-101/104 and classic Siemens S7comm carry no authentication in the frame, so any host that can reach the device may read and write it. There is nothing to enable; the defense is compensating controls — segmentation, allow-listing the master, and protocol-aware DPI of control messages.
Other protocols can authenticate, and the question becomes whether it is turned on. DNP3 has optional Secure Authentication v5 (IEEE 1815) that adds challenge-response / HMAC on critical requests; enabling it makes control spoofing and replay far harder. OPC-UA is secure by design but configurable: SecurityMode None is unauthenticated plaintext, Sign authenticates and protects integrity but leaves payloads readable, and Sign & Encrypt adds confidentiality — the intended posture. IEC 61850 GOOSE is unauthenticated Layer-2 multicast and spoofable via an incremented stNum unless IEC 62351-6 message authentication is applied.
Siemens is a good illustration of version mattering: classic S7comm on S7-300/400 has no real authentication and its protection levels are trivially bypassed, while S7CommPlus on S7-1200/1500 added anti-replay integrity — meaningfully better, though researchers have reversed it, so it belongs in a defense-in-depth stack rather than as a single control. Judge the exact deployment, then match the weakness to the mitigation that actually fits it.
Frequently asked questions
What does the SCADA Protocol Weakness Lab teach?
It teaches you to judge an industrial protocol’s real risk from its version and security mode, not just its name. Across twelve rounds you look at Modbus/TCP, DNP3 with and without Secure Authentication v5, IEC 60870-5-104, IEC 61850 GOOSE and MMS (with and without IEC 62351), Siemens S7comm versus S7CommPlus, and OPC-UA at SecurityMode None, Sign and Sign & Encrypt. For each you name the concrete weakness and choose the mitigation that actually fits that configuration. It is a defender-lens teaching simulation — no exploit code, no payloads, no live traffic.
Why do Modbus, IEC 104 and classic S7comm have no authentication?
They were designed for trusted, private industrial networks and predate networked threats. Modbus (1979), IEC 60870-5-101/104, and classic Siemens S7comm carry no field in the frame to prove who sent a message, so any host that can reach the device is implicitly trusted to read and write it. There is nothing to "switch on" — which is why the mitigation for these is compensating controls around the protocol: network segmentation, allow-listing the legitimate master, and protocol-aware deep packet inspection of control messages.
When does the version actually change the answer?
Often, and that is the whole exercise. DNP3 has an optional Secure Authentication v5 (IEEE 1815) that adds challenge-response / HMAC authentication of control requests — off by default, so enabling it is the fix. OPC-UA’s risk is entirely its SecurityMode: None is unauthenticated plaintext, Sign authenticates but leaves payloads readable, and Sign & Encrypt gives mutual authentication, integrity and confidentiality. IEC 61850 GOOSE is unauthenticated Layer-2 multicast unless IEC 62351-6 message authentication is applied. Siemens S7CommPlus adds anti-replay integrity that classic S7comm lacks (though researchers have shown it can be reversed, so it is not a substitute for network controls).
Is this safe and legal to use?
Yes. Everything runs in your browser against a teaching simulation — there is no real device, no network traffic, and no exploit code or payloads. Each round describes the weakness at the level of public protocol documentation and CISA ICS guidance (mechanism plus mitigation), so you learn how to assess and defend your own environment, not how to attack someone else’s.