One of many recent additions to Awen Collective's asset discovery tool, Dot, is the ability to parse and analyse network traffic of the Z21 protocol. Chances are you know a thing or two about model trains if "Z21" sounds familiar. Indeed, Z21 is a German organisation that maintains proprietary technologies to monitor and control miniature locomotives.
There is a line of Z21 digital command stations available for Einsteiger (beginners) and another with more oomph targeted at Profis (professionals). Of course, there is also an app for iOS and Android devices to act as the system's human-machine interface (HMI) if so desired. It is perhaps unsurprising that there is such a demand for these systems in Germany, the home of Miniatur Wunderland (the largest model railway in the world by amount of track) and Deutsche Bahn (which requires no introduction).
With the full Z21 protocol specification available publicly and with a test dataset at hand, the Awen Collective development team was able to incorporate Z21 analysis into Dot in just a short timeframe. Serial numbers, firmware versions, and other key information about Z21 controllers and clients are extracted using Dot’s deep-packet inspection.
While Dot's capabilities to analyse prominent OT protocols (including Modbus and S7) is improved on a regular basis, there is value to society in addressing the more niche technologies that are used in the greater OT space. It takes just one vulnerability (or one rogue model train) to be the initial compromise that lays the tracks for a much larger and devastating attack, no matter if that vulnerability belongs to a widespread technology or a specialised one. Integrating Z21 analysis is testament to Awen's ability to swiftly create bespoke solutions for the specific needs of a given network.
