17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks

The rest of PT0-003 4.9 is operational technology (OT) / industrial control systems (ICS) and radio-frequency attacks, plus the remaining named tools. CompTIA lists register manipulation, CAN bus attack, Modbus attack, plaintext attack, and replay attack under OT, then near-field communication (NFC), Bluejacking, radio-frequency identification (RFID), and Bluetooth spamming. Tools on this half are Scapy, tcprelay, Wireshark/tcpdump, and Bluestrike (MobSF, Frida, Drozer, and ADB were the mobile half). This is still explain-level. It is safety-first. This guide will not give exploit proofs of concept against cars or plants.

Purdue recap: one paragraph, then stop hopping

The Purdue model from objective 1.3 is ICS/OT segmentation, not a pentest methodology. Level 0 is the physical process (sensors, actuators). Level 1 is basic control (programmable logic controllers (PLCs), remote terminal units). Level 2 is supervisory (human-machine interface, SCADA). Level 3 is site operations (MES, historians). Level 4 is site business IT. Level 5 is enterprise. Jumping from Level 3 operations to Level 1 basic control without explicit RoE is a scoping and safety issue: a write can change logic or setpoints and move Level 0 equipment. 4.9 does not re-score the architecture table. It uses the levels to remind you that OT findings have physical consequences.

Safety: no reckless writes to PLCs

Do not write to live PLCs to prove a finding. Objective 3.1 already taught ICS vulnerability assessment as manual assessment plus port mirroring (SPAN), not blasting default Nessus plugins. 4.9 is the attack name when that traffic is abused — still not a license to flip a coil on a running line. Prefer a lab, a historian, a vendor-approved window, or a read-only demonstration from a mirror port. If the RoE is silent on OT writes, the answer is do not write. A tripped process is a safety event, not extra exam points. Exam trap: treating 4.9 as a Domain 4 exception to OT safety. Explain does not mean break the plant.

Modbus, registers, plaintext, and replay

Modbus is a common ICS protocol (often TCP port 502, or serial). It is often cleartext: function codes and register values ride without encryption or strong authentication. A Modbus attack on the exam is using that protocol as it already stands — reading or writing coils and holding registers — not inventing a new CVE.

Register manipulation is changing those values: a coil that starts a motor, a holding register that is a setpoint. Identification: the stem shows an unauthenticated or weakly authenticated write path to a register map. Do not demonstrate by changing a live plant setpoint. Report that the map was reachable and that a write would change process state. That is enough on an explain objective.

Plaintext attack is capturing unencrypted fieldbus or serial traffic (Modbus, and conceptually similar cleartext industrial protocols). Replay attack is capturing a valid control frame and sending it again so the PLC or device repeats an action. Both are why a SPAN session from 3.1 still matters on 4.9: you observe first. A capture that shows a coil-write in the clear is a plaintext finding and a replay candidate. Sending that frame into production without a lab or a maintenance window is the reckless write by another name.

When you pick Modbus / register / plaintext / replay: the stem is ICS protocol traffic, a register map, cleartext function codes, or a repeated control frame. When you do not: a rooted phone (17.1) or a public object-storage bucket (4.6). Exam trap: treating every OT finding as run Nessus. 3.1 forbade blasting PLCs. 4.9 still prefers a mirror over a flood. Trap two: calling every industrial protocol CAN. Modbus TCP 502 is Modbus.

CAN bus: vehicles, conceptually

Controller Area Network (CAN) bus is the shared vehicle (and some machine) bus. Frames on many implementations are unauthenticated or weakly authenticated, so a node that can speak on the bus can inject frames. CAN bus attack on PT0-003 is that identification: the tester (or malware on an infotainment unit) can put frames on the bus. This guide will not provide a vehicle exploit proof of concept. Scope and safety are stricter than a web form: a careless frame can affect brakes, steering, or a plant conveyor that also uses CAN-like fieldbus. Stay inside a named RoE, prefer a lab bench or a manufacturer test mode, and stop at identification if production vehicles are in the parking lot.

When you pick it: the stem is a vehicle bus, OBD-adjacent access, or unauthenticated CAN frames. When you do not: Modbus TCP 502 on a PLC — that is Modbus, not CAN. Exam trap: treating CAN as 4.2 VLAN hopping because both involve a shared medium. VLAN hopping is Ethernet switching. CAN is a specialized fieldbus.

NFC, RFID, Bluejacking, and Bluetooth spamming

NFC is very short range (about four centimeters). Exam pictures are skimming (reading a contactless card or tag the owner did not intend to tap) and relay (extending a tap over a network so a card in one place authorizes a reader in another). Conceptual only — no relay recipe, and no instruction to stand over strangers' wallets.

RFID is the broader radio-frequency identification family, including longer-range proximity badges (classically 125 kHz prox). Badge cloning from objective 3.3 is the physical-test technique; RFID on 4.9 is the specialized-system attack name for that RF copy. 3.3 still requires written physical-test scope. A network SoW does not authorize cloning a badge. Encrypted smart cards are harder; the exam still wants RFID or cloning as the name for weak badge technology. Exam trap: calling every contactless tap RFID cloning. A four-centimeter payment skim is NFC. A lobby prox badge is RFID and a 3.3 authorization question.

Bluejacking is sending unsolicited Bluetooth messages (a vCard, a text) to a nearby discoverable device. It is nuisance and social, not typically a data theft. Bluetooth spamming is flooding nearby devices with pairing requests, connection attempts, or advertisement packets — disruption at scale, sometimes to force an interaction. When you pick bluejacking: one unsolicited message. When you pick spamming: volume, pairing storms, or advertisement floods. Exam trap: calling every Bluetooth finding bluejacking. Trap two: treating Bluetooth as 4.7 Wi-Fi. 4.7 is 802.11 (Aircrack-ng, evil twin). 4.9 is NFC, RFID, and Bluetooth as specialized RF.

Tools: Scapy, tcprelay, Wireshark/tcpdump, Bluestrike

Scapy crafts and inspects packets in Python. On 4.9 it is the protocol-crafting tool for specialized traffic you are allowed to observe — custom frames in a lab, or replay of a captured frame after the RoE allows it. Objective 4.10 lists Scapy again as a Python library; 4.2 used packet crafting on the network. Here, pick Scapy when the specialized protocol is the point, not when the stem is an APK permission list (MobSF) or a Bluetooth pairing flood (Bluestrike).

tcprelay forwards a TCP stream from one listener to another so the tester can observe or insert themselves on a specialized path (a relayed session to an analysis host, conceptually including some NFC or RFID relay pictures). Identification of the relay job is enough. It is not Frida and it is not a plant-write tool.

Wireshark and tcpdump capture. On OT they belong on a port-mirror or authorized tap, proving plaintext Modbus or a replay candidate. They are not a PLC write tool. Using them on a SPAN you already had from 3.1 is the safe 4.9 demonstration.

Bluestrike is the named Bluetooth testing tool on the 4.9 list. When you pick it: Bluetooth spamming or bluejacking-style assessment. Do not invent extra Bluetooth suite names as if CompTIA listed them. Exam trap: answering Aircrack-ng (4.7) for Bluetooth. Trap two: answering Drozer for a pairing-storm stem. Drozer is Android IPC.

free PenTest+ practice questionsPractice questions with detailed explanations

Worked OT and RF estate

The same engagement that held the Android app also has a plant historian and a badge reader. A SPAN of the Level 2/3 path shows Modbus TCP 502 in cleartext — plaintext attack, and a candidate replay. The register map is readable without authentication — report register manipulation as the risk; do not write a live coil. That is a Modbus attack family finding, not a CAN finding and not a Nessus blast. A fleet vehicle's diagnostic port is in a separate, explicit RoE: CAN bus attack as identification only. In the lobby, a 125 kHz prox card clones under physical-test scope — RFID, the 4.9 name for the 3.3 clone. A contactless payment tap skimmed at four centimeters is NFC, not RFID badge work. A discoverable phone receives an unsolicited vCard — Bluejacking. Pairing requests flood the same lobby — Bluetooth spamming, and Bluestrike is the named tool. Wireshark on the mirror, Scapy only in a lab, tcprelay if a TCP path must be forwarded. Sequence: safety and Purdue first, name the OT or RF attack, then the tool.