Team82 Logo Claroty Logo

Team82 Research

OPC UA Deep Dive: A Complete Guide to the OPC UA Attack Surface

/ April 12th, 2023

Executive Summary 

  • OPC UA is the standard unified communication protocol in industrial environments

  • Proprietary field devices and ICS/SCADA systems that previously could not exchange data on the OT network now do so over OPC UA, which is now supported by dozens of vendors across industries

  • Team82 has compiled a comprehensive guide to OPC UA, examining its history, security features, and attack surface

  • Part 1, OPC UA Uncovered: History of the OPC UA Protocol is available today

  • In the coming weeks, we will publish additional installations of this guide, including disclosures of new vulnerabilities, details on some of the tools we use—including an OPC UA network fuzzer, and an exploitation framework

OPC UA (Open Protocol Communication Unified Architecture) is today the standard protocol for unified communications in industrial environments. As more vendors build new products that implement OPC UA—or retrofit older devices to support the protocol—it becomes one of the few mutually understood and adopted technologies in OT. 

OPC UA solved critical interoperability issues between field devices and ICS/SCADA systems that previously could not exchange data. Developed by the OPC Foundation, OPC UA is the standard protocol over which engineers and operators can, from a single server, communicate with and manage physical processes on the OT network. The fact that OPC UA is platform independent allows devices from different vendors to seamlessly communicate. 

To achieve this goal, a few components were introduced: the OPC server, OPC client, and the OPC gateway. The OPC server contains many protocol converters that are capable of communicating with devices, such as PLCs, using their proprietary protocols, including Modbus, EtherNet/IP, S7, and more. The OPC server will constantly query devices for specific predefined memory values that are known as tags or points, and store them in a special database. Later, an OPC client, such as an HMI, can communicate with the server using the generic OPC protocol to get the values of these tags/points. 

Team82 has invested considerable time and resources to research the security of the OPC UA protocol. Since 2020, we’ve disclosed more than two dozen vulnerabilities in OPC UA products, or in the protocol stack itself. We’ve researched clients, servers, and other software that supports OPC UA, and our work has helped improve the security of the overall network protocol stack. In addition, we also made freely available a network fuzzer used to find a number of zero-day vulnerabilities in OPC UA products in preparation for the Pwn2Own Miami competition in 2022 and 2023. 

Today, we’re publishing the first in a multipart series of blogs that we hope will be the ultimate resource for OT engineers, asset operators, and asset owners intimately involved in OT network security, and specifically, OPC UA. 

Throughout the series we plan to share our research into the OPC UA attack surface, and provide extensive background on the following:

  • The inner workings of the protocol

  • Recap OPC UA history

  • Explain OPC UA’s security features

  • Cover the OPC-UA attack surface

  • Disclose some information about new vulnerabilities

  • Describe new attack techniques targeting OPC UA

  • Introduce a new OPC UA exploit framework and fuzzers. 

Our goal is to publish and maintain a useful OPC UA security guide, one that can be referenced often in order to minimize the risk to OT networks, and reduce the potential for damaging remote code execution or denial-of-service attacks.

OPC UA Deep Dive series

Part 1: History of the OPC UA protocol

Part 2: What is OPC UA?

Stay in the know

Get the Team82 Newsletter


Recent Vulnerability Disclosures

Claroty Logo
LinkedIn Twitter YouTube Facebook