Abstract:Industrial Control Systems (ICS) help to automate various cyber-physical systems in our world. The controlled processes range from rather simple traffic lights and elevators to complex networks of ICS in car manufacturing or controlling nuclear power plants. With the advent of industrial Ethernet ICS are increasingly connected to networks of Information Technology (IT). Thus, novel attack vectors on ICS are possible. In IT networks information hiding and steganography is increasingly used in advanced persistent threats to conceal the infection of the systems allowing the attacker to retain control over the compromised networks. In parallel ICS are more and more a target for attacks as well. Here, simple automated attacks as well as targeted attacks of nation state actors with the intention of damaging components or infrastructures as a part of cyber crime have already been observed. Information hiding could bring such attacks to a new level by integrating backdoors and hidden/covert communication channels that allow for attacking specific processes whenever it is deemed necessary. This paper sheds light on potential attack vectors on Programmable Logic Controllers (PLCs) using OPC Unified Architecture (OPC UA) network protocol based communication. We implement an exemplary supply chain attack consisting of an OPC UA server (Bob, B) and a Siemens S7-1500 PLC as OPC UA client (Alice, A). The hidden storage channel is using source timestamps to embed encrypted control sequences allowing for setting digital outputs to arbitrary values. The attack is solely relying on the programming of the PLC and does not require firmware level access. Due to the potential harm to life caused by attacks on cyber-physical systems any presentation of novel attack vectors need to present suitable mitigation strategies. Thus, we investigate potential approaches for the detection of the hidden storage channel for a warden W as well as potential countermeasures in order to increase the warden-compliance. Our machine learning based detection approach using a One-Class-Classifier yields a detection performance of 89.5% with zero false positives within an experiment with 46,159 OPC UA read responses without a steganographic message and 7,588 OPC UA read responses with an embedded steganographic message.

Stealthy Deception Attacks Against SCADA Systems

An Enhanced Multi-Stage Semantic Attack Against Industrial Control Systems

Reverse Engineering Physical Semantics of PLC Program Variables Using Control Invariants.

Anomoly Detection for PLC Based on Magnetic Side Channel

SCAPHY: Detecting Modern ICS Attacks by Correlating Behaviors in SCADA and PHYsical

A Deep Learning-based Framework for Conducting Stealthy Attacks in Industrial Control Systems

Mismatched Control and Monitoring Frequencies: Vulnerability, Attack, and Mitigation

Information Hiding in Industrial Control Systems: An OPC UA based Supply Chain Attack and its Detection

An Analytics Framework for Heuristic Inference Attacks against Industrial Control Systems

NIPAD: a Non-Invasive Power-Based Anomaly Detection Scheme for Programmable Logic Controllers

Designing Actively Secure, Highly Available Industrial Automation Applications

Exposing Hidden Attackers in Industrial Control Systems using Micro-distortions

Analysis of ICS and SCADA Systems Attacks Using Honeypots.

Side-channel based intrusion detection for industrial control systems

False Sequential Logic Attack on SCADA System and Its Physical Impact Analysis

False Logic Attacks on SCADA Control System

Implementation and Detection of Novel Attacks to the PLC Memory of a Clean Water Supply System

Empirical Study of PLC Authentication Protocols in Industrial Control Systems

Control Behavior Integrity for Distributed Cyber-Physical Systems

Efficient Predictive Monitoring of Linear Time-Invariant Systems Under Stealthy Attacks

SoK: Attacks on Industrial Control Logic and Formal Verification-Based Defenses