Cyber-Physical Systems Security—A Survey <s> B. Cyber-Physical Attacks 1) ICS Attacks: <s> The Analysis Function of the US-CERT Control Systems Security Center (CSSC) at the Idaho National Laboratory (INL) has prepared this report to document cyber security incidents for use by the CSSC. The description and analysis of incidents reported herein support three CSSC tasks: establishing a business case; increasing security awareness and private and corporate participation related to enhanced cyber security of control systems; and providing informational material to support model development and prioritize activities for CSSC. The stated mission of CSSC is to reduce vulnerability of critical infrastructure to cyber attack on control systems. As stated in the Incident Management Tool Requirements (August 2005) ''Vulnerability reduction is promoted by risk analysis that tracks actual risk, emphasizes high risk, determines risk reduction as a function of countermeasures, tracks increase of risk due to external influence, and measures success of the vulnerability reduction program''. Process control and Supervisory Control and Data Acquisition (SCADA) systems, with their reliance on proprietary networks and hardware, have long been considered immune to the network attacks that have wreaked so much havoc on corporate information systems. New research indicates this confidence is misplaced--the move to open standards such as Ethernet, Transmission Control Protocol/Internet Protocol, and Web technologiesmore » is allowing hackers to take advantage of the control industry's unawareness. Much of the available information about cyber incidents represents a characterization as opposed to an analysis of events. The lack of good analyses reflects an overall weakness in reporting requirements as well as the fact that to date there have been very few serious cyber attacks on control systems. Most companies prefer not to share cyber attack incident data because of potential financial repercussions. Uniform reporting requirements will do much to make this information available to Department of Homeland Security (DHS) and others who require it. This report summarizes the rise in frequency of cyber attacks, describes the perpetrators, and identifies the means of attack. This type of analysis, when used in conjunction with vulnerability analyses, can be used to support a proactive approach to prevent cyber attacks. CSSC will use this document to evolve a standardized approach to incident reporting and analysis. This document will be updated as needed to record additional event analyses and insights regarding incident reporting. This report represents 120 cyber security incidents documented in a number of sources, including: the British Columbia Institute of Technology (BCIT) Industrial Security Incident Database, the 2003 CSI/FBI Computer Crime and Security Survey, the KEMA, Inc., Database, Lawrence Livermore National Laboratory, the Energy Incident Database, the INL Cyber Incident Database, and other open-source data. The National Memorial Institute for the Prevention of Terrorism (MIPT) database was also interrogated but, interestingly, failed to yield any cyber attack incidents. The results of this evaluation indicate that historical evidence provides insight into control system related incidents or failures; however, that the limited available information provides little support to future risk estimates. The documented case history shows that activity has increased significantly since 1988. The majority of incidents come from the Internet by way of opportunistic viruses, Trojans, and worms, but a surprisingly large number are directed acts of sabotage. A substantial number of confirmed, unconfirmed, and potential events that directly or potentially impact control systems worldwide are also identified. Twelve selected cyber incidents are presented at the end of this report as examples of the documented case studies (see Appendix B).« less <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber-Physical Attacks 1) ICS Attacks: <s> A waterbed mattress adapted to fit within a rigid frame comprises a water-containing main chamber and at least one supplemental chamber along the perimeter of the main chamber for containing a fluid giving structural rigidity to the perimeter, particularly along the upper boundary abutting the frame. The supplemental chamber is established by an imperforate flexible membrane internally spanning the mattress corner between the top panel and the adjacent side panel. The cross sectional length of the membrane is not greater than the dimension of the adjacent top and side panel segments which constitute the outer walls of the chamber. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber-Physical Attacks 1) ICS Attacks: <s> Our study analyzes the security and privacy properties of an implantable cardioverter defibrillator (ICD). Introduced to the U.S. market in 2003, this model of ICD includes pacemaker technology and is designed to communicate wirelessly with a nearby external programmer in the 175 kHz frequency range. After partially reverse-engineering the ICD's communications protocol with an oscilloscope and a software radio, we implemented several software radio-based attacks that could compromise patient safety and patient privacy. Motivated by our desire to improve patient safety, and mindful of conventional trade-offs between security and power consumption for resource-constrained devices, we introduce three new zero-power defenses based on RF power harvesting. Two of these defenses are human-centric, bringing patients into the loop with respect to the security and privacy of their implantable medical devices (IMDs). Our contributions provide a scientific baseline for understanding the potential security and privacy risks of current and future IMDs, and introduce human-perceptible and zero-power mitigation techniques that address those risks. To the best of our knowledge, this paper is the first in our community to use general-purpose software radios to analyze and attack previously unknown radio communications protocols. <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber-Physical Attacks 1) ICS Attacks: <s> Abstract Modern critical infrastructures are continually exposed to new threats due to the vulnerabilities and architectural weaknesses introduced by the extensive use of information and communications technologies (ICT). Of particular significance are the vulnerabilities in the communication protocols used in supervisory control and data acquisition (SCADA) systems that are commonly employed to control industrial processes. This paper presents the results of our research on the impact of traditional ICT malware on SCADA systems. In addition, it discusses the potential damaging effects of computer malware created for SCADA systems. <s> BIB004 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber-Physical Attacks 1) ICS Attacks: <s> Wearable and implantable medical devices are being increasingly deployed to improve diagnosis, monitoring, and therapy for a range of medical conditions. Unlike other classes of electronics and computing systems, security attacks on these devices have extreme consequences and must, therefore, be analyzed and prevented with utmost effort. Yet, very little work exists on this important topic and the security vulnerabilities of such systems are not well understood. We demonstrate security attacks that we have implemented in the laboratory on a popular glucose monitoring and insulin delivery system available on the market, and also propose defenses against such attacks. Continuous glucose monitoring and insulin delivery systems are becoming increasingly popular among patients with diabetes. These systems utilize wireless communication links, which are frequently utilized as a portal to launch security attacks. Our study shows that both passive attacks (eavesdropping of the wireless communication) and active attacks (impersonation and control of the medical devices to alter the intended therapy) can be successfully launched using public-domain information and widely available off-the-shelf hardware. The proposed attacks can compromise both the privacy and safety of patients. We propose two possible defenses against such attacks. One is based on rolling-code cryptographic protocols, and the other is based on body-coupled communication. Our security analysis shows that the proposed defenses have the potential to mitigate the security risks associated with personal healthcare systems. <s> BIB005 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber-Physical Attacks 1) ICS Attacks: <s> The pervasiveness of Cyber-Physical Systems (CPS) in various aspects of the modern society grows rapidly. This makes CPS to increasingly attractive targets for various kinds of attacks. We consider cyber-security as an integral part of CPS security. Additionally, the necessity exists to investigate the CPS-specific aspects which are out of scope of cyber-security. Most importantly, attacks capable to cross the cyber-physical domain boundary should be analyzed. The vulnerability of CPS to such cross-domain attacks has been practically proven by numerous examples, e.g., by the currently most famous Stuxnet attack. In this paper, we propose taxonomy for description of attacks on CPS. The proposed taxonomy is capable of representing both conventional cyber-attacks as well as cross-domain attacks on CPS. Furthermore, based on the proposed taxonomy, we define the attack categorization. Several possible application areas of the proposed taxonomy are extensively discussed. Among others, it can be used to establish a knowledge base about attacks on CPS known in the literature. Furthermore, the proposed description structure will foster the quantitative and qualitative analysis of these attacks, both of which are necessarily to improve CPS security. <s> BIB006
a) Legacy communication channels: As we mentioned above, dial-up connections provide direct access to field devices and sometimes their security is overlooked. In 2005, billing information of a water utility was accessed by exploiting the dial-up connection in a canal system BIB001 . Although this attack did not have a physical impact, it could have, due to the control capabilities provided by the dial-up connection. b) Disgruntled insiders: A huge financial loss for utility companies with undesired environmental impacts could result from attacking a water and sewage system. In 2000, an ex-employee intentionally disrupted the operations of a sewage treatment system in Maroochy Water Services in Queensland, Australia. The attacker exploited his knowledge, as a previously legitimate insider, to change configurations in pumping stations using a laptop and a radio transmitter. The consequence of the attack caused a huge amount of raw sewage to flood into the streets and taint the environment BIB002 . c) Modbus worm: Fovino et al. BIB004 presented an alarming work on targeted malware. The authors crafted malware that exploits the lack of authentication and integrity vulnerabilities in Modbus protocol. The worm aims to perform two attacks: 1) DoS, by identifying sensors or actuators and sending them DoS-inducing messages and 2) command injection, by sending unauthorized commands to the sensors or actuators. d) Malware: Some malware targets specific systems to achieve goals like traffic interception and interruption of operations. They exploit software vulnerabilities in applications that manage control field devices. A well-known example is Stuxnet. This attack is considered one of the most sophisticated attacks on ICS that clearly embodies cyberwar. Stuxnet exploits software vulnerabilities to achieve physical consequences BIB006 . Because the targeted networks were off the Internet, it is believed that the delivery mechanism was an USB stick. The attack can be generally summarized into two phases: 1) spreading and determining targets and 2) PLCs hijacking  . The first step was realized by exploiting two zero-day Windows vulnerabilities, i.e., one in the shared printing server and the other was in Windows Server Service. Both vulnerabilities would allow remote code execution using RPC. Stuxnet used the first vulnerability to install itself in the system and the other to connect to other systems to also install itself in an iterative fashion. This process led to infecting about 100 000 infected systems worldwide, however, because the attack was targeted on specific PLCs, the infection did not have an influence on systems that were not connected to the targeted PLCs. Once Stuxnet is installed, it looks for a specific software used for monitoring and sending commands to the PLCs, that is Seimens WinCC. It goes through a thorough analysis to ensure that WinCC is connected to one of specific Siemens PLCs  . Once determined, the malware injects the malicious code that aims to alter PLCs' configuration. Once that is achieved, the final objective of the attack is realized, which is, most likely, damaging centrifuges used for uranium enrichment. For a detailed Stuxnet analysis, we refer you to  . e) Web-based attacks: A group of hackers exploit a Webbased interface that is directly connected to field devices like PLCs. They opened multiple connections and left them open until authorized users could not access them, resulting in a DoS attack. In addition, they also sent a Web page to the controller/ field device that contains malicious Java script code designed to exploit a bug in the TCP/IP stack causing resetting of the controller BIB001 . 2) Smart Grids Attacks: a) Cyber extortion: This type of attack is rare, at least publicly, where attackers take control over the target smart grid and make demands as a price of not causing a large-scale blackout  . b) Blackouts: In the context of smart grids, a blackout is considered a DoS attack. The availability of smart grids is probably the most important security goal to maintain, and attacks aiming to compromise it could result in a large-scale blackout that might have a nationwide impact. In 2007, Idaho National Laboratory demonstrated an experiment on how a generator could be damaged as a result of a cyber attack  . The experiment proved the feasibility of such attacks. For example, it is believed that two blackouts in Ohio and Florida in 2003 were caused by a Chinese politicallymotived group, the People's Liberation Army  . In addition, about 800 blackouts in the U.S. occurred in 2014 for unknown reasons  . Some speculations suggest that such mysterious outages may have resulted from cyber-physical attacks launched by hostile nations  . 3) Medical Devices Attacks: a) DoS attacks: This attack, when successful, could lead to critical health condition to patients. Halperin et al. BIB003 were able to disable an ICD therapies by replaying a previously recorded "turn off" command sent by the programmer. b) False data and unauthorized commands injection: Li et al. BIB005 were able to remotely control an insulin pump's remote control and successfully stopped and resumed the insulin injection from a 20-m distance. c) Replay attacks: By exploiting a software vulnerability in the replay attacks countermeasure, any packet can be retransmitted to the CGM and insulin pump BIB005 ,  .