Passive Sweep Analysis: Industrial Infrastructure Exposure and Defensive Baselines

Jeff Gray · July 2026 · 5 min read
Original Research · Cyborama OT Intelligence

Key Finding: A passive, non-intrusive scan of a regional US area identified 760 internet-exposed industrial devices utilizing unauthenticated protocols that operate without native security controls. A significant 44% of these exposures originate from devices connected via public cellular networks.

Author Note: This report utilizes public OSINT to establish a defensive baseline, with no active scanning or interaction with systems performed.

The Baseline Sweep & Protocol Exposure

The assessment highlights a breakdown in traditional Purdue Model segmentation, where Level 0–2 industrial systems become directly accessible from the public internet — primarily via unauthenticated, legacy protocols.

Protocol Exposure Breakdown

Serial Servers (200+): Convert legacy RS-485 to IP, preserving lack of authentication.
Modbus TCP (146): The underlying protocol operates without native authentication, which highlights an architectural reliance on network-level isolation.
EtherNet/IP (144): Widely deployed industrial network protocol responding from public infrastructure without built-in access controls.
DNP3 (118): SCADA utility protocol commonly found exposed, with authentication variants rarely deployed.
S7comm (73): Industrial controller protocol operating without authentication, designed for trusted internal networks.

These exposures represent an inherent, long-standing architectural vulnerability rather than mere misconfiguration.

Key Vulnerability: Public Cellular Infrastructure

A critical finding is that nearly half of the exposed IP addresses reside on public commercial cellular networks. This indicates that cellular gateways and serial-to-IP converters are being deployed directly to the internet, bypassing private APNs or VPN overlays.

Why the Exposure Persists

Legacy Protocol Design: Older protocols lack native authentication.
Cellular Convenience: Ease of deployment leads to bypassing secure network design.
Gateway Abstraction: Converters make legacy devices instantly accessible without security layers.

Defensive Recommendations

Prioritize Exposure: Treat internet-exposed PLC/SCADA protocols as high-priority risks.
Secure Cellular Assets: Transition to private APNs or VPN tunnels for remote devices.
Isolate Gateways: Place serial/protocol converters behind firewalls, not on public IPs.
Continuous Monitoring: Implement regular, passive, external reconnaissance.

Disclaimer: This research supports defensive awareness and does not involve active targeting or vulnerability exploitation.

← Back to Control Systems Security