CybersecurityDec 10, 2025
PLC Cybersecurity: How to Hack Modbus in 3 Steps (and Stop It)
Modbus has no security. Zero. We show how ridiculously easy it is to shut down a plant if you leave port 502 open, and how to lock it down.
A Protocol from the 1970s #
Modbus was created in 1979. Back then the internet didn't exist, and physical security (a locked door) was the only security anyone needed. Today we connect those same devices to Ethernet networks.
The problem is simple: Modbus TCP has no authentication.
If I can send a packet to your PLC's IP on port 502, the PLC will obey. It doesn't ask "Who are you?". It doesn't ask for a password. It just executes.
The Simplified "Kill Chain" #
# Step 1: Reconnaissance (Shodan)
Search for publicly exposed PLCs: port:502 country:"CL". (Thousands show up.)
# Step 2: Scanning
Use Nmap to identify active registers: nmap -p 502 --script modbus-discover 192.168.1.50
# Step 3: Command Injection
Use a simple Python client to write a '0' to the "Emergency Stop" coil.
client.write_coil(0, False) # Bye bye, production
How to Avoid Disaster #
You don't need to throw out your old PLCs. You need to wrap them.
- NEVER EXPOSE PORT 502 TO THE INTERNET: The golden rule. Use VPNs.
- Macro-segmentation: The PLC network must have no route to the office network.
- Industrial firewall (Deep Packet Inspection): A firewall that understands Modbus can say: "The Engineering IP may READ and WRITE, but the HMI IP may only READ". It blocks unauthorized writes at the packet level.
Security through obscurity ("Nobody knows my IP") no longer works. Bots scan the entire IPv4 space in minutes.
🤖 Technical FAQ: Common Questions About Industrial Hacking
What is port 502?
It is the standard TCP port reserved for Modbus. If it is open to the internet, anyone can read and write your registers.
How do I know if my PLC is exposed?
Use search engines such as Shodan or Censys. Look up your public IP or port 502.
Does moving port 502 to 50200 help?
No. That's "security through obscurity". A full port scan (Nmap -p-) will find it in seconds.
Topics
- modbus security
- modbus hacking
- modbus pentesting
- ot security
- port 502
- plc cybersecurity
About the author
Francisco CisternasSenior Full-Stack Lead
Works on both the Edge and the cloud. Builds iGromi's infrastructure, from firmware on the controller to the dashboards the plant uses.
![Ransomware in the Plant: Anatomy of an OT Cyberattack (and How to Survive) [2026]](/images/blog/industrial-ransomware-screen.webp)
