Abstract:Industrial Control Systems (ICS) help to automate various cyber-physical systems in our world. The controlled processes range from rather simple traffic lights and elevators to complex networks of ICS in car manufacturing or controlling nuclear power plants. With the advent of industrial Ethernet ICS are increasingly connected to networks of Information Technology (IT). Thus, novel attack vectors on ICS are possible. In IT networks information hiding and steganography is increasingly used in advanced persistent threats to conceal the infection of the systems allowing the attacker to retain control over the compromised networks. In parallel ICS are more and more a target for attacks as well. Here, simple automated attacks as well as targeted attacks of nation state actors with the intention of damaging components or infrastructures as a part of cyber crime have already been observed. Information hiding could bring such attacks to a new level by integrating backdoors and hidden/covert communication channels that allow for attacking specific processes whenever it is deemed necessary. This paper sheds light on potential attack vectors on Programmable Logic Controllers (PLCs) using OPC Unified Architecture (OPC UA) network protocol based communication. We implement an exemplary supply chain attack consisting of an OPC UA server (Bob, B) and a Siemens S7-1500 PLC as OPC UA client (Alice, A). The hidden storage channel is using source timestamps to embed encrypted control sequences allowing for setting digital outputs to arbitrary values. The attack is solely relying on the programming of the PLC and does not require firmware level access. Due to the potential harm to life caused by attacks on cyber-physical systems any presentation of novel attack vectors need to present suitable mitigation strategies. Thus, we investigate potential approaches for the detection of the hidden storage channel for a warden W as well as potential countermeasures in order to increase the warden-compliance. Our machine learning based detection approach using a One-Class-Classifier yields a detection performance of 89.5% with zero false positives within an experiment with 46,159 OPC UA read responses without a steganographic message and 7,588 OPC UA read responses with an embedded steganographic message.

Mismatched Control and Monitoring Frequencies: Vulnerability, Attack, and Mitigation

Anomoly Detection for PLC Based on Magnetic Side Channel

Reverse Engineering Physical Semantics of PLC Program Variables Using Control Invariants.

Identification of ICS Security Risks Toward the Analysis of Packet Interaction Characteristics Using State Sequence Matching Based on SF-FSM

LQG Control under Denial-of-Service Attacks: an Experimental Study

An Improved Support Vector Machine Attack Detection Algorithm for Industry Controls System

Stealthy Deception Attacks Against SCADA Systems

Designing Actively Secure, Highly Available Industrial Automation Applications

Information Hiding in Industrial Control Systems: An OPC UA based Supply Chain Attack and its Detection

Implementation and Detection of Novel Attacks to the PLC Memory of a Clean Water Supply System

A Survey on Programmable Logic Controller Vulnerabilities, Attacks, Detections, and Forensics

PLC Cybersecurity Test Platform Establishment and Cyberattack Practice

Attacks on Data-Driven Process Monitoring Systems: Subspace Transfer Networks

NIPAD: a Non-Invasive Power-Based Anomaly Detection Scheme for Programmable Logic Controllers

Research on Attack Mechanism of Network Intrusion in Industrial Control System

Fuzzing proprietary protocols of programmable controllers to find vulnerabilities that affect physical control

PLC access control: a security analysis

Stealthy Attack Against Redundant Controller Architecture of Industrial Cyber-Physical System.

Vulnerability Detection of ICS Protocols Via Cross-State Fuzzing.

Detecting PLC Intrusions Using Control Invariants

Towards Comprehensively Understanding the Run-time Security of Programmable Logic Controllers: A 3-year Empirical Study