The PLC Answered. That Is Not a Bridge Going Haywire

Movable bridge control systems should be invisible from the public internet. Passive search results suggest otherwise.

If you grew up in this country with a television, you have already seen a bridge go haywire. The Tacoma Narrows film from 1940 is the clip everyone means even when they do not know they mean it: Galloping Gertie rolling, the span turning into a ribbon, a car left on the deck like a toy somebody forgot. That footage is a real collapse, shot in daylight, and it had nothing to do with EtherNet/IP. It was wind, and a deck that found a frequency it liked. The public remembers the ribbon. The people who build decks remember the flutter.

The first version of this page borrowed that picture for a headline. A search box had returned some industrial banners, a few of them containing the word lock, and the title went ahead and gave you a span that had lost its mind. The comments that followed were rude. They were also not wrong about the size of the claim. A Shodan hit is not Galloping Gertie, and it does not become Galloping Gertie because the headline is hungry.

What I actually had, and still have, is quieter than a poster, which is not the same thing as nothing.

Sitting with the index

On a developer-tier Shodan account, with no active scanning and no packets aimed at anyone else's controller, I asked the public index for industrial banners on the ports those protocols already advertise. EtherNet/IP on 44818. Modbus TCP on 502. The index answered. That is a duller sentence than a headline wants. It is also the whole field method, and once you stop dressing the result for a trailer, it is the whole finding.

Rockwell devices answering on port 44818:

• 37 in Alabama
• 49 in the New Orleans metro area
• 6 anywhere in the index whose banner contained the word lock

Modbus devices answering on port 502:

• 91 in Alabama
• 218 in the New Orleans metro area
• 12 anywhere in the index whose banner contained the word lock

Sit with those last two numbers for a second. They are not an inventory of the Mississippi River. They are not a census of movable spans. They are a handful of strings a device was willing to say out loud. Lock in that string might mean a navigation lock, or a lockout tag, or a vendor product name, or a word some integrator typed in 2009 because it fit the twenty-character field and nobody has edited the field since. I did not log into any of these boxes. I did not walk them to a named bridge, a named lock, or a named operator. I did not prove that a compromised hit would lift a leaf, swing a span, or hold a barge against the current. Anyone who tells you I did is reading a newsreel into a search box.

The thing I can say without lying is smaller, and it is still worth saying. Industrial protocol hardware of the same families used around movable bridges, navigation locks, and a thousand other plants is sitting in a public search index, including a handful of banners that happen to contain the word lock. The devices are reachable. What they are named, who owns them, and whether a write would move a span are questions this search did not answer, and it would be a kind of theater to pretend otherwise.

A port that answers is closer to a porch light than to a collapse. You know someone wired a thing to the street. You do not know whether the thing is the span drive, a spare rack in a shed, a vendor lab, or a honeypot with a sense of humor. The porch light is still a fact. It is just not the film.

What the path is supposed to be, and what the night shift actually hangs

In a plant, or at a lock, or under a highway leaf, the control path is not supposed to answer from the public internet. If IEC 62443 and NIST 800-82 mean anything once you have closed the binder, they mean this: Monitoring can leave, and commands should not wander in because a search engine asked. A unidirectional gateway is how you keep that promise in hardware. Status goes out. The street does not get a vote. Waterfall and the other diode people have been saying that in rooms for years, and they are right about the physics even when the budget meeting is about something else.

The installed base is older than those sentences, and it has a talent for remaining so. A diagnostic rule from a hurricane season, a vendor VPN, a temporary NAT that outlived the outage, a cellular modem hung so somebody could check a tank from the truck: Each of those was a reasonable ticket on the day it was cut. Then the span had to move at 2 a.m., and the path that got it moving is the path that stayed. Plants skip the diode because the vendor path is already hung and the outage is tonight, not because the diode was a foolish idea. Convenience tickets are still the native language of industrial networks. I have been in rooms where everyone agreed the old rule had been removed, and the banner was still answering, which is another way of saying that agreement is not a control.

None of that requires anyone to pretend I watched a particular bridge misbehave. It only requires noticing that the protocols you would use to misbehave are, in some places, polite enough to say hello to strangers.

If you operate something that moves, the most useful check you can run is the small one. Ask whether Modbus, EtherNet/IP, or the family you actually run will answer from outside the zone that is supposed to own them. If they will, you have a door you did not mean to leave open. If they will not, this page is not about your plant. Either way, a word in a banner is not a verdict on the American inventory of movable spans. It is a porch light. The film of the ribbon is a different story, and it was already true in 1940.

The same remote access path that shows up on bridges and locks is the one that shows up everywhere else in OT. If you want the jump host, MFA, and vendor time box method in one download, the otfeed.com is here.

All data in this article was collected through passive Shodan search queries. No active scanning, no probing, no interaction with target systems was performed. Findings represent publicly indexed device banners, not vulnerability assessments. This research does not attribute specific devices to specific facilities.

← Back to Control Systems Security