标题： 公共可访问的操作技术及其相关风险分析 显示英文标题

标题： Analysis of Publicly Accessible Operational Technology and Associated Risks

摘要： 操作技术（OT）是关键国家基础设施的重要组成部分，使能源、制造和交通等行业实现自动化和控制。 然而，OT网络、系统和设备在设计和部署时优先考虑功能而非安全。 这导致当操作配置错误将它们暴露在互联网上时，许多已部署的系统存在固有漏洞。 本报告提供了对公开互联网上暴露的OT威胁态势的最新概述，并研究了受影响的协议、供应商、软件以及系统的地理分布。 我们的发现显示，全球近70,000个OT设备被暴露，其中北美和欧洲有显著集中。 对常见协议（例如ModbusTCP、EtherNet/IP、S7）的分析表明，许多设备暴露了详细的识别信息，包括过时的固件版本，这些版本存在已知的关键漏洞，且在披露后多年仍未打补丁。 此外，我们展示了如何通过自动分析截图来发现人机界面（HMI）和监控控制与数据采集（SCADA）系统的暴露图形界面，突显了潜在未经授权访问的多种途径，并强调了对工业流程和关键基础设施的风险。 显示英文摘要

摘要： Operational Technology (OT) is an integral component of critical national infrastructure, enabling automation and control in industries such as energy, manufacturing, and transportation. However, OT networks, systems, and devices have been designed and deployed prioritising functionality rather than security. This leads to inherent vulnerabilities in many deployed systems when operational misconfigurations expose them to the internet. This report provides an up-to-date overview of the OT threat landscape exposed to the public internet and studies the affected protocols, vendors, software, and the geographic distribution of systems. Our findings reveal nearly 70,000 exposed OT devices globally, with significant concentrations in North America and Europe. Analysis of prevalent protocols (e.g., ModbusTCP, EtherNet/IP, S7) shows that many devices expose detailed identifying information, including outdated firmware versions with known critical vulnerabilities that remain unpatched for years after disclosure. Furthermore, we demonstrate how automated analysis of screenshots can uncover exposed graphical interfaces of Human Machine Interfaces (HMIs) and Supervisory Control and Data Acquisition (SCADA) systems, highlighting diverse pathways for potential unauthorized access and underscoring the risks to industrial processes and critical infrastructure.