Abstract:SCADA protocols for Industrial Control Systems (ICS) are vulnerable to network attacks such as session hijacking. Hence, research focuses on network anomaly detection based on meta--data (message sizes, timing, command sequence), or on the state values of the physical process. In this work we present a class of semantic network-based attacks against SCADA systems that are undetectable by the above mentioned anomaly detection. After hijacking the communication channels between the Human Machine Interface (HMI) and Programmable Logic Controllers (PLCs), our attacks cause the HMI to present a fake view of the industrial process, deceiving the human operator into taking manual actions. Our most advanced attack also manipulates the messages generated by the operator's actions, reversing their semantic meaning while causing the HMI to present a view that is consistent with the attempted human actions. The attacks are totaly stealthy because the message sizes and timing, the command sequences, and the data values of the ICS's state all remain legitimate. We implemented and tested several attack scenarios in the test lab of our local electric company, against a real HMI and real PLCs, separated by a commercial-grade firewall. We developed a real-time security assessment tool, that can simultaneously manipulate the communication to multiple PLCs and cause the HMI to display a coherent system--wide fake view. Our tool is configured with message-manipulating rules written in an ICS Attack Markup Language (IAML) we designed, which may be of independent interest. Our semantic attacks all successfully fooled the operator and brought the system to states of blackout and possible equipment damage.

False Logic Attacks on SCADA Control System

Reverse Engineering Physical Semantics of PLC Program Variables Using Control Invariants.

Anomoly Detection for PLC Based on Magnetic Side Channel

State Machine Based Malicious Packet Attack Detection and Security Situation Assessment

DoS Attacks in Electrical Cyber-Physical Systems: A Case Study Using TrueTime Simulation Tool

Analysis of Malware-Induced Cyber Attacks in Cyber-Physical Power Systems

Intrusion Detection Model of SCADA Using Graphical Features

Stealthy Deception Attacks Against SCADA Systems

SoK: Attacks on Industrial Control Logic and Formal Verification-Based Defenses

A cyber-physical model for SCADA system and its intrusion detection

Detecting Integrity Attacks on SCADA Systems

The Security Assessment on Programmable Logic Controller Based on Attack Tree Model and FAHP

Research on cyber-physical system control strategy under false data injection attack perception

A Survey on Programmable Logic Controller Vulnerabilities, Attacks, Detections, and Forensics

Detecting PLC Intrusions Using Control Invariants

SCAPHY: Detecting Modern ICS Attacks by Correlating Behaviors in SCADA and PHYsical

Multi-Objective False Data Injection Attacks of Cyber–Physical Power Systems

False-Data-Injection-Enabled Network Parameter Modifications in Power Systems: Attack and Detection

Detecting Semantic Attack in SCADA System: A Behavioral Model Based on Secondary Labeling of States-Duration Evolution Graph

Detection and Analysis Technique for Manipulation Attacks on PLC Control Logic

Common criteria for security evaluation and malicious intrusion detection mechanism of dam supervisory control and data acquisition system