Abstract
SCADA protocols for Industrial Control Systems (ICS) are vulnerable to network attacks such as session hijacking. Hence, research focuses on network anomaly detection based on meta–data (message sizes, timing, command sequence), or on the state values of the physical process. In this work we present a class of semantic network-based attacks against SCADA systems that are undetectable by the above mentioned anomaly detection. After hijacking the communication channels between the Human Machine Interface (HMI) and Programmable Logic Controllers (PLCs), our attacks cause the HMI to present a fake view of the industrial process, deceiving the human operator into taking manual actions. Our most advanced attack also manipulates the messages generated by the operator’s actions, reversing their semantic meaning while causing the HMI to present a view that is consistent with the attempted human actions. The attacks are totaly stealthy because the message sizes and timing, the command sequences, and the data values of the ICS’s state all remain legitimate.
We implemented and tested several attack scenarios in the test lab of our local electric company, against a real HMI and real PLCs, separated by a commercial-grade firewall. We developed a real-time security assessment tool, that can simultaneously manipulate the communication to multiple PLCs and cause the HMI to display a coherent system–wide fake view. Our tool is configured with message-manipulating rules written in an ICS Attack Markup Language (IAML) we designed. Our semantic attacks all successfully fooled the operator and brought the system to states of blackout and possible equipment damage.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Final report on the August 14, 2003 blackout in the United States and Canada: Causes and recommendations. U.S.-Canada Power System Outage Task Force, U.S. Secretary of Energy and Minister of Natural Resources Canada, April 2004
Abad, C.L., Bonilla, R.I.: An analysis on the schemes for detecting and preventing ARP cache poisoning attacks. In: 27th International Conference on Distributed Computing Systems Workshops, ICDCSW 2007, pp. 60–60. IEEE (2007)
Alcaraz, C., Cazorla, L., Fernandez, G.: Context-awareness using anomaly-based detectors for smart grid domains. In: Lopez, J., Ray, I., Crispo, B. (eds.) CRiSIS 2014. LNCS, vol. 8924, pp. 17–34. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-17127-2_2
Atassi, A., Elhajj, I.H., Chehab, A., Kayssi, A.: The state of the art in intrusion prevention and detection. In: Intrusion Detection for SCADA Systems, Chap. 9, pp. 211–230. Auerbach Publications, January 2014
Barbosa, R., Sadre, R., Pras, A.: A first look into SCADA network traffic. In: IEEE Network Operations and Management Symposium (NOMS), pp. 518–521, April 2012
Barbosa, R., Sadre, R., Pras, A.: Towards periodicity based anomaly detection in SCADA networks. In: 17th IEEE Emerging Technologies Factory Automation (ETFA), pp. 1–4, September 2012
Byres, E.J., Franz, M., Miller, D.: The use of attack trees in assessing vulnerabilities in SCADA systems. In: International Infrastructure Survivability Workshop (2004)
Cárdenas, A.A., Amin, S., Lin, Z.S., Huang, Y.L., Huang, C.Y., Sastry, S.: Attacks against process control systems: risk assessment, detection, and response. In: 6th ACM Symposium on Information, Computer and Communications Security, pp. 355–366. ACM (2011)
Caselli, M., Zambon, E., Kargl, F.: Sequence-aware intrusion detection in industrial control systems. In: 1st ACM Workshop on Cyber-Physical System Security, New York, NY, USA, pp. 13–24 (2015). http://doi.acm.org/10.1145/2732198.2732200
Chen, C.M., Hsiao, H.W., Yang, P.Y., Ou, Y.H.: Defending malicious attacks in cyber physical systems. In: 2013 IEEE 1st International Conference on Cyber-Physical Systems, Networks, and Applications (CPSNA), pp. 13–18, August 2013
Cheung, S., Dutertre, B., Fong, M., Lindqvist, U., Skinner, K., Valdes, A.: Using model-based intrusion detection for SCADA networks. In: SCADA Security Scientific Symposium, pp. 127–134 (2007)
De Maizière, T.: Die Lage der IT-Sicherheit in Deutschland 2014. The German Federal Office for Information Security (2014). https://www.google.co.il/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0ahUKEwigs8_B1enXAhVSFuwKHQm3Ba8QFggmMAA&url=https%3A%2F%2Fwww.bmi.bund.de%2FSharedDocs%2Fdownloads%2FDE%2Fpublikationen%2F2014%2Fbsi-lagebericht-it-sicherheit.pdf%3F__blob%3DpublicationFile&usg=AOvVaw2deYBrgkWuS45W4MbRUldL
Dolev, D., Yao, A.C.: On the security of public key protocols. Technical report, Stanford, CA, USA (1981)
Erez, N., Wool, A.: Control variable classification, modeling and anomaly detection in Modbus/TCP SCADA systems. Int. J. Crit. Infrastruct. Prot. 10, 59–70 (2015)
Falliere, N., Murchu, L., Chien, E.: W32.Stuxnet dossier. White paper, Symantec Corporation, Security Response (2011)
Fovino, I.N., Carcano, A., Masera, M., Trombetta, A.: An experimental investigation of malware attacks on SCADA systems. Int. J. Crit. Infrastruct. Prot. 2(4), 139–145 (2009). http://www.sciencedirect.com/science/article/pii/S1874548209000419
Fovino, I., Carcano, A., De Lacheze Murel, T., Trombetta, A., Masera, M.: Modbus/DNP3 state-based intrusion detection system. In: 24th IEEE International Conference on Advanced Information Networking and Applications (AINA), pp. 729–736. IEEE (2010)
Goldenberg, N., Wool, A.: Accurate modeling of Modbus/TCP for intrusion detection in SCADA systems. Int. J. Crit. Infrastruct. Prot. 6(2), 63–75 (2013). http://www.sciencedirect.com/science/article/pii/S1874548213000243
Gorman, S.: Electricity grid in U.S. penetrated by spies. Wall Street J. A1 (2009). http://www.wsj.com/articles/SB123914805204099085
Hadziosmanovic, D., Bolzoni, D., Hartel, P.H., Etalle, S.: MELISSA: towards automated detection of undesirable user actions in critical infrastructures. In: European Conference on Computer Network Defense, EC2ND, Gothenburg, Sweden, USA, pp. 41–48, September 2011
Kleinmann, A., Amichay, O., Wool, A., Tenenbaum, D., Bar, O., Lev, L.: Stealthy deception attacks against SCADA systems. arXiv:1706.09303 [cs.CR], June 2017
Kleinmann, A., Wool, A.: Accurate modeling of the siemens S7 SCADA protocol for intrusion detection and digital forensic. JDFSL 9(2), 37–50 (2014). http://ojs.jdfsl.org/index.php/jdfsl/article/view/262
Kleinmann, A., Wool, A.: A statechart-based anomaly detection model for multi-threaded SCADA systems. In: Rome, E., Theocharidou, M., Wolthusen, S. (eds.) CRITIS 2015. LNCS, vol. 9578, pp. 132–144. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-33331-1_11
Kleinmann, A., Wool, A.: Automatic construction of statechart-based anomaly detection models for multi-threaded SCADA via spectral analysis. In: 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy, CPS-SPC 2016, pp. 1–12. ACM, New York (2016). http://doi.acm.org/10.1145/2994487.2994490
Kleinmann, A., Wool, A.: Automatic construction of statechart-based anomaly detection models for multi-threaded industrial control systems. ACM Trans. Intell. Syst. Technol. (TIST) 8(4), 55 (2017)
Langner, R.: Stuxnet: dissecting a cyberwarfare weapon. IEEE Secur. Priv. 9(3), 49–51 (2011)
Lee, R.M., Assante, M.J., Conway, T.: Analysis of the cyber attack on the Ukrainian power grid. Technical report, SANS E-ISAC, 18 March 2016. https://ics.sans.org/media/E-SAC_SANS_Ukraine_DUC_5.pdf
Liang, G., Weller, S.R., Zhao, J., Luo, F., Dong, Z.Y.: The 2015 Ukraine blackout: implications for false data injection attacks. IEEE Trans. Power Syst. 32(4), 3317–3318 (2017)
Lin, H., Slagell, A., Kalbarczyk, Z., Sauer, P.W., Iyer, R.K.: Semantic security analysis of SCADA networks to detect malicious control commands in power grids. In: First ACM Workshop on Smart Energy Grid Security, pp. 29–34. ACM (2013)
Liu, Y., Ning, P., Reiter, M.K.: False data injection attacks against state estimation in electric power grids. ACM Trans. Inf. Syst. Secur. (TISSEC) 14(1), 13 (2011)
Marsh, R.T.: Critical foundations: protecting America’s infrastructures - the report of the president’s commission on critical infrastructure protection. Technical report, President’s Commission on Critical Infrastructure Protection, October 1997
Mo, Y., Kim, T.H.J., Brancik, K., Dickinson, D., Lee, H., Perrig, A., Sinopoli, B.: Cyber-physical security of a smart grid infrastructure. Proc. IEEE 100(1), 195–209 (2012)
Mukherjee, B., Heberlein, L.T., Levitt, K.N.: Network intrusion detection. IEEE Netw. 8(3), 26–41 (1994)
Pasqualetti, F., Dörfler, F., Bullo, F.: Attack detection and identification in cyber-physical systems. IEEE Trans. Autom. Control 58(11), 2715–2729 (2013)
Roesch, M.: Snort - lightweight intrusion detection for networks. In: 13th USENIX Conference on System Administration, LISA 1999, pp. 229–238. USENIX Association, Berkeley (1999). http://dl.acm.org/citation.cfm?id=1039834.1039864
Urbina, D.I., Giraldo, J.A., Cardenas, A.A., Tippenhauer, N.O., Valente, J., Faisal, M., Ruths, J., Candell, R., Sandberg, H.: Limiting the impact of stealthy attacks on industrial control systems. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1092–1105. ACM (2016)
Valdes, A., Cheung, S.: Communication pattern anomaly detection in process control systems. In: IEEE Conference on Technologies for Homeland Security (HST), pp. 22–29 (2009)
Yang, D., Usynin, A., Hines, J.: Anomaly-based intrusion detection for SCADA systems. In: 5th International Topical Meeting on Nuclear Plant Instrumentation, Control and Human Machine Interface Technologies, pp. 12–16 (2006)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer International Publishing AG
About this paper
Cite this paper
Kleinmann, A., Amichay, O., Wool, A., Tenenbaum, D., Bar, O., Lev, L. (2018). Stealthy Deception Attacks Against SCADA Systems. In: Katsikas, S., et al. Computer Security. SECPRE CyberICPS 2017 2017. Lecture Notes in Computer Science(), vol 10683. Springer, Cham. https://doi.org/10.1007/978-3-319-72817-9_7
Download citation
DOI: https://doi.org/10.1007/978-3-319-72817-9_7
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-72816-2
Online ISBN: 978-3-319-72817-9
eBook Packages: Computer ScienceComputer Science (R0)