Abstract:SCADA protocols for Industrial Control Systems (ICS) are vulnerable to network attacks such as session hijacking. Hence, research focuses on network anomaly detection based on meta--data (message sizes, timing, command sequence), or on the state values of the physical process. In this work we present a class of semantic network-based attacks against SCADA systems that are undetectable by the above mentioned anomaly detection. After hijacking the communication channels between the Human Machine Interface (HMI) and Programmable Logic Controllers (PLCs), our attacks cause the HMI to present a fake view of the industrial process, deceiving the human operator into taking manual actions. Our most advanced attack also manipulates the messages generated by the operator's actions, reversing their semantic meaning while causing the HMI to present a view that is consistent with the attempted human actions. The attacks are totaly stealthy because the message sizes and timing, the command sequences, and the data values of the ICS's state all remain legitimate. We implemented and tested several attack scenarios in the test lab of our local electric company, against a real HMI and real PLCs, separated by a commercial-grade firewall. We developed a real-time security assessment tool, that can simultaneously manipulate the communication to multiple PLCs and cause the HMI to display a coherent system--wide fake view. Our tool is configured with message-manipulating rules written in an ICS Attack Markup Language (IAML) we designed, which may be of independent interest. Our semantic attacks all successfully fooled the operator and brought the system to states of blackout and possible equipment damage.

DNAttest: Digital-twin-based Non-intrusive Attestation under Transient Uncertainty.

NIPAD: a Non-Invasive Power-Based Anomaly Detection Scheme for Programmable Logic Controllers

Anomoly Detection for PLC Based on Magnetic Side Channel

Reverse Engineering Physical Semantics of PLC Program Variables Using Control Invariants.

Detecting PLC Intrusions Using Control Invariants

A novel delay-resilient remote memory attestation for smart grid

Programmable Logic Controllers Past Linear Temporal Logic for Monitoring Applications in Industrial Control Systems

PCaaD: Towards Automated Determination and Exploitation of Industrial Processes

HRPDF: A Software-Based Heterogeneous Redundant Proactive Defense Framework for Programmable Logic Controller.

Empirical Study of PLC Authentication Protocols in Industrial Control Systems

On Practicality of Using ARM TrustZone Trusted Execution Environment for Securing Programmable Logic Controllers

Towards Comprehensively Understanding the Run-time Security of Programmable Logic Controllers: A 3-year Empirical Study

Stealthy Deception Attacks Against SCADA Systems

Implementation and Detection of Novel Attacks to the PLC Memory of a Clean Water Supply System

Improving IIoT security: Unveiling threats through advanced side-channel analysis

Scalable Attestation Protocol Resilient to Physical Attacks for IoT Environments

Detecting Safety and Security Faults in PLC Systems with Data Provenance

SoK: Attacks on Industrial Control Logic and Formal Verification-Based Defenses

Partial Attestation: Towards Cost-Effective and Privacy-Preserving Remote Attestations

Scalable Attestation Resilient to Physical Attacks for Embedded Devices in Mesh Networks

Dead Man's PLC: Towards Viable Cyber Extortion for Operational Technology