CIP and Its History: From DeviceNet to Ethernet/IP

▶ Watch (0:06)

Common Industrial Protocol (CIP) runs on programmable logic controllers, variable frequency drives, motor starters, and smart sensors. It is not a single network — it has four media variants: DeviceNet (CAN), ControlNet (coaxial, 802.3B), Ethernet/IP (UDP/TCP), and CompoNet (dismissed as irrelevant). Allen‑Bradley originally developed CIP. The first implementation shipped in 1994 in Chicago. DeviceNet opened plant floors to smart sensors. ControlNet followed in 1997. Ethernet/IP arrived in 2000, adding multicast, unicast, and standard Ethernet transport.

CIP Objects and Communication

▶ Watch (4:59)

CIP acts like a remote procedure call. Objects in firmware have numeric IDs: class, instance, attribute, service. The identity class (class 1, instance 1, service 1) returns vendor, product type, firmware revision, and serial number — the “who” message. Communication operates in three modes. UCMM is the simplest: no CIP session, no routing, just send and receive. Unconnected messaging sets up a CIP session and route for a single request, then tears it down. Connected sessions leave the session open; the session number persists independently of TCP connections.

CIP Routing: Bridging Air‑Gapped Networks

▶ Watch (11:05)

CIP includes its own routing because it predates Ethernet in plants. A path can start on an Ethernet SCADA network, go through a card’s backplane, out a ControlNet port, across a control‑net network to an HMI, then out an Ethernet port to another PLC. The route uses IP addresses, port numbers, and slot numbers. Flynn demonstrated sending a command from one Ethernet network to another that had no direct Ethernet connection — they appeared air‑gapped. The devices do not authenticate or restrict such routing.

Fuzzing and Manurfs: Finding Vulnerabilities

▶ Watch (14:50)

Fuzzing sends targeted random values to CIP objects. A Python script using service 3 (get attribute list) on every class 1–1000 found two hits: class 0xA1 (service not supported — an unknown object) and class 0xF5 (the Ethernet TCP/IP object). The TCP/IP object allows remote IP, gateway, and subnet mask changes without authentication. Flynn warned that input validation failures cause major non‑recoverable faults (manurfs). A manurf halts the controller, dumps its program, and requires a technician to reload it. He finds three manurfs per day during fuzzing. He recommended Wireshark’s CIP plugin, the IC Village CTF repository, the Molex Ethernet/IP tool, and PyCom3 library.

Notable Quotes

i can find on average three manurfs a day Trevor Flynn · ▶ 21:32

the TCP object allows me to remotely set the ip address of the device change its gateway change its subnet mask without requiring any authentication mechanism Trevor Flynn · ▶ 18:30

we took two networks that from a network topology standpoint look like they were airgapped and we got a command between them Trevor Flynn · ▶ 13:23

Key Takeaways

  • CIP’s object model uses numeric IDs for classes, instances, attributes, and services.
  • CIP routing can traverse Ethernet and ControlNet networks that appear air‑gapped.
  • Fuzzing CIP devices routinely triggers manurfs — three per day during testing.