Cyber-Physical Systems Security—A Survey <s> A. Cyber Attacks 1) ICS Attacks: a) Communication protocols: <s> Critical infrastructures such as the Supervisory Control and Data Acquisition (SCADA) systems have succumbed to the demands of greater connectivity. Although the scheme of connecting these critical equipment and devices to cyberspace has brought us tremendous convenience, it also enabled certain unimaginable risks and vulnerabilities. These risks and vulnerabilities are very critical to our daily existence and are perilous to ignore. This paper presents an overview of wireless security and vulnerabilities of SCADA systems. Also described are proof-of-concept methods of attacking wireless vulnerabilities on SCADA systems. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> A. Cyber Attacks 1) ICS Attacks: a) Communication protocols: <s> Modern critical infrastructure systems are built on a hodgepodge of complex, interconnected information systems for control and management. For electric power, the critical infrastructure includes the physical systems; comprised of power generation, transmission and distribution capabilities. The control of the physical systems is accomplished via Supervisory Command and Data Acquisition (SCADA) systems. The SCADA systems employ both new and legacy systems along with many of the same information system devices as traditional business information systems. SCADA system networks, just as business information system networks, are connected to external networks, including the Internet. Thus, SCADA systems are vulnerable to the same classes of threats as other networked computer systems in addition to threats associated with their legacy systems. Many of these systems have been put in place for decades and often have an unknown security posture. Cyber security analysis of these systems remains a significant challenge. Traditional techniques such as red-teaming, vulnerability assessments, and penetration testing are often unsatisfactory and limited in scope because power utilities do not want to risk taking the systems off-line or degrading or damaging the expensive equipment. The consequence is that the effects of a cyber-attack on these SCADA systems are often unknown. In order to provide greater SCADA system security posture insight to utilities and administrators, security experts must perform security analysis. To overcome the problems with security analysis using either an exclusive hardware SCADA testbed or a simulation of a SCADA system, Sandia National Labs has developed a cyber-security analysis capability using physical hardware, extensive virtualization and emulated machines, and simulation to answer complex system questions about SCADA systems. In this paper we will discuss the methodology, several use-cases that were executed during the course of the study which leverage the methodology, the types of cyber-attacks that can be assessed and the class of questions security professionals can now ask and answer about cyber-attacks against SCADA systems. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> A. Cyber Attacks 1) ICS Attacks: a) Communication protocols: <s> On October 14, 2011, we were alerted to a sample by the Laboratory of Cryptography and System Security (CrySyS) at Budapest University of Technology and Economics. The threat appeared very similar to the Stuxnet worm from June of 2010 [1]. CrySyS named the threat Duqu [dyu-kyu] because it creates files with the file name prefix “~DQ” [2]. We confirmed Duqu is a threat nearly identical to Stuxnet, but with a completely different purpose of espionage rather than sabotage. <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> A. Cyber Attacks 1) ICS Attacks: a) Communication protocols: <s> The Flame Virus will go down in history as the most complex, most sophisticated and largest cyber-espionage tool to fool Microsoft's Terminal Services licensing certificate authority. Using a detailed yet brilliant (in terms of cybercrime) strategy, Flame infiltrated thousands of computers in the Middle East by capitalising on a flaw that allowed attackers to create a digital security certificate masquerading as an official Microsoft security certificate. What's more, it came in the form of a Microsoft update. Although it looked genuine, users allowing the update were giving Flame the go-ahead to install massive amounts of spyware and code on their machines. The Flame Virus will go down in history as one of the largest and most complex cyber-espionage tools. Using a detailed yet brilliant (in terms of cybercrime) strategy, Flame infiltrated thousands of computers in the Middle East by forging an official Microsoft security certificate. Traditional anti-virus software is sadly ineffective against such sophisticated attacks. Organisations need to move to a whitelisting model if they want to stand any chance of beating off the attacks of the future, argues Kate Munro of Bit9. <s> BIB004
A number of attacks have exploited vulnerabilities in communication protocols. For example, spoofing attacks on address resolution protocol were demonstrated on SCADA system BIB001 , BIB002 . b) Espionage: DuQu and Flame are two examples of ICS attacks with spying purposes BIB003 , BIB004 . Flame, for example, targeted various ICS networks in the Middle East and was discovered in 2012. This malware's main goal was to collect corporations' private data such as emails, keyboard strokes , TABLE II  ICS CYBER-PHYSICAL ATTACKS   TABLE III  SMART GRIDS CYBER-PHYSICAL ATTACKS   TABLE IV  MEDICAL DEVICES CYBER-PHYSICAL ATTACKS and network traffic BIB004 . Although the intention of the attack was not clear, hostile nations or industrial competitors could benefit from such information leakages. In addition, in 2013, a group of hackers, known as Dragonfly, targeted energy firms in the U.S. and Europe. The attackers main goal seems to have been gathering private information. To do that, they needed to infect systems in the targeted firms with malware that grants remote access. They started by sending phishing emails to the personnel of the targeted firms containing malicious PDF attachments. Then the attack vector escalated to exploiting watering hole vulnerabilities in victims' browsers by directing victims to visit malicious websites hosted by the attackers. Both delivery mechanisms infected targeted systems with a malware that allowed attackers to gather private information in the infected systems  .