CoChat
Sign Up
Cited by 63Smart Grid Security and ResilienceIndustrial Automation and Control SystemsNetwork Security and Intrusion Detection

Attacking Fieldbus Communications in ICS: Applications to the SWaT Testbed

Open access
Urbina David, Giraldo Jairo, Tippenhauer Nils Ole, Cardenas Alvaro·2016·Cryptology and Information Security Series
DOI 10.3233/978-1-61499-617-0-75
Open this paper in CoChat — free account

Abstract

The study of cyber-attacks in industrial control systems is of growing interest among the research community. Nevertheless, restricted access to real industrial control systems that can be used to test attacks has limited the study of their implementation and potential impact. In this work, we discuss practical attacks applied to a room-sized water treatment testbed. The testbed includes a complete physical process, industrial communication systems, and supervisory controls. We implement scenarios in which the attacker manipulates or replaces sensor data as reported from the field devices to the control components. As a result, the attacker can change the system state vector as perceived by the controls, which will cause incorrect control decisions and potential catastrophic failures. We discuss practical challenges in setting up Man-In-The-Middle attacks on fieldbus communications in the industrial EtherNet/IP protocol and topologies such as Ethernet rings using the Device-Level-Ring protocol. We show how the attacker can overcome those challenges, and insert herself into the ring. Once established as a Man-in-the-Middle attacker, we launched a range of attacks to modify sensor measurements and manipulate actuators. We show the efficacy of the proposed methodology in two experimental examples, where an adversary can intelligently design attacks that remain undetected for a typical bad-data detection mechanism.

Integrity signals

Registry

Crossref · 10.3233/978-1-61499-617-0-75

Cites

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Deception attacks were aimed at manipulating the information sent or received by sensors and PLCs, with the ultimate goal of affecting the operations of an actuator.

    “The latter were aimed at manipulating the information sent or received by sensors and PLCs, with the ultimate goal of affecting the operations of an actuator (Urbina et al. 2016).”

    From Battle of the Attack Detection Algorithms: Disclosing Cyber Attacks on Water Distribution Networks (2018) · cites this paper as Urbina et al. 2016

  • SCADA concealment was performed by either replacing actual traffic information between PLCs and SCADA with previously-recorded data (replay attacks) or adding an offset to the transmitted sensor readings.

    “SCADA concealment was performed by either replacing actual traffic information between PLCs and SCADA with previously-recorded data (replay attacks) or adding an offset to the transmitted sensor readings (Urbina et al. 2016).”

    From Battle of the Attack Detection Algorithms: Disclosing Cyber Attacks on Water Distribution Networks (2018) · cites this paper as Urbina et al. 2016

Cites

Still being checked.

Cited by

Sorted by citations

Related

Authors
David, U., Jairo, G., Ole, T. N., & Alvaro, C.
Venue
Cryptology and Information Security Series
Publisher
IOS Press
Published
2016
ISSN
1871-6431
DOI
10.3233/978-1-61499-617-0-75
OpenAlex
W2561371397
Cited by
63
References
0
Citations by year
2026: 1 · 2025: 2 · 2024: 5 · 2023: 5 · 2022: 4 · 2021: 9 · 2020: 7 · 2019: 7 · 2018: 7 · 2017: 10 · 2016: 6
FWCI
23.83
Type
book chapter
Language
en
Open access
Licence
cc-by-nc
Locations
IOS Press eBooks (publishedVersion, cc-by-nc)
Topics
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
  • Physical Sciences › Engineering › Control and Systems Engineering › Industrial Automation and Control Systems
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Keywords
industrial control systems, cyberattacks, man-in-the-middle attacks, EtherNet/IP, sensor data manipulation, bad data detection, industrial Ethernet

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review