SCADA / HMI
The supervisory layer that lets humans watch and steer a plant. The HMI is the most internet-exposed part of OT, and a screen that lies to the operator is a safety hazard, not just a data leak.
SCADA (Supervisory Control And Data Acquisition) is the layer that lets humans watch and steer an industrial process, and the HMI (Human Machine Interface) is the screen they watch. This is not a single wire protocol; it is the supervisory tier that sits above the field protocols (Modbus, DNP3, S7comm, OPC-UA) and turns their raw points into dashboards, alarms, and controls. It matters to an attacker because it is the most internet-exposed part of OT and because a compromised HMI is a physical-safety problem.
What it is
Map it onto the Purdue model, the reference layering for OT networks. You mostly care about two levels:
| Level | What lives there | Talks to |
|---|---|---|
| Level 1 | PLCs, RTUs, IEDs (the controllers) | the physical process, and Level 2 |
| Level 2 | HMI, operator console, SCADA server, engineering workstation | Level 1 (field protocols) and the business/IT side |
A typical Level 2 estate: a SCADA server polling PLCs; one or more HMIs (vendor panels like Ignition or Wonderware, or a generic web HMI) drawing the process mimic; operator consoles reached over VNC or RDP for remote and after-hours support; a historian logging every tag; and an engineering workstation with the PLC programming software (TIA Portal and friends). The HMI reads and writes the controllers as part of its job, so owning it hands you their read/write access for free.
Why it matters
Level 2 straddles IT and OT: it must touch the business network (web, remote access) and the control network (to read and write PLCs). That dual nature makes it the bridge from the internet to the process. The recurring field failures are IT-grade, not exotic:
- Web HMIs and VNC/RDP consoles stood up on a public IP by a contractor "temporarily" and forgotten.
- Default or missing credentials on the HMI login and on VNC ("No authentication").
- Unauthenticated tag APIs that return or set live process values without checking a session.
- A framebuffer or dashboard an attacker can freeze or spoof, so the operator sees green while the process runs away.
That last one is the point: in OT the operator is a safety control. An HMI that lies removes the human who was supposed to catch the runaway, which is why this is a safety hazard, not merely an information leak.
How to work it
- Find exposed supervisory surfaces. Passively, index data: Shodan/Censys for VNC banners and HMI login titles. On an engagement, scan:
nmap -p 80,443,5900,3389,102,502,20000,4840 --open <subnet>
- Try the operator console first. Open VNC ("No authentication") mirrors exactly what the operator sees.
- Hit the web HMI and its API. An unauthenticated tag endpoint leaks the live process state:
curl -s http://<hmi>/api/tags | jq '.[] | {name, value}'
- From the owned HMI, pivot to Level 1: it already has a route and the field protocol to the PLC. That is where the Modbus/DNP3/S7comm/OPC-UA skills come back in.
Pitfalls
- The HMI is not the plant. Reading a tag through the HMI is safe; writing a control point drives real hardware. Every write belongs on a lab or a system you own.
- Shodan/Censys queries are passive lookups of already-indexed data. The moment you send a crafted request to someone else's plant you have crossed into unauthorized access to critical infrastructure. Do not.
- A green screen is not proof the process is fine; on a compromised HMI it can be a frozen or spoofed view. Cross-check the field devices directly.
- Level 2 is a pivot, not the objective. The prize is the isolated Level 1 control network the HMI can reach.