Cyber-Physical Systems Security—A Survey <s> b) ICS V4, OS vulnerabilities: <s> Supervisory Control and Data Acquisition(SCADA) systems are deeply ingrained in the fabric of critical infrastructure sectors. These computerized real-time process control systems, over geographically dispersed continuous distribution operations, are increasingly subject to serious damage and disruption by cyber means due to their standardization and connectivity to other networks. However, SCADA systems generally have little protection from the escalating cyber threats. In order to understand the potential danger and to protect SCADA systems, in this paper, we highlight their difference from standard IT systems and present a set of security property goals. Furthermore, we focus on systematically identifying and classifying likely cyber attacks including cyber-induced cyber-physical attack son SCADA systems. Determined by the impact on control performance of SCADA systems, the attack categorization criteria highlights commonalities and important features of such attacks that define unique challenges posed to securing SCADA systems versus traditional Information Technology(IT) systems. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> b) ICS V4, OS vulnerabilities: <s> The article mentions that the malware such as Stuxnet can affect critical physical infrastructures that are controlled by software, which implies that threats might extend to real lives. Stuxnet differs from past malware in several ways. First, most malware tries to infect as many computers as possible, whereas Stuxnet appears to target industrial control systems and delivers its pay load under very specific conditions. Second, Stuxnet is larger and more complex than other malware. It cotains exploits for four vulnerabilities. <s> BIB002
The operating systems in ICS devices, such as PLCs and RTUs, are real-time operating system (RTOS), and they do not implement access control measures. Therefore, all users are given the highest privileges, i.e., root access. This is fundamentally insecure, and clearly makes the devices vulnerable to various kinds of attacks BIB001 . Applications that are used for controlling and monitoring field devices are running on general-purpose OS. If the OS or running software have vulnerabilities, the hosting computers or laptops possess a potential attack vector on the connected field devices and as a result, their physical components. An example of such exploitable vulnerabilities are two Windows OS vulnerabilities that were exploited in the Stuxnet attack. The first one is a vulnerability in the Print Spooler Service, which is vulnerable to remote code execution over RPC  . This vulnerability allowed Stuxnet to copy itself onto the vulnerable computer BIB002 . The other exploited vulnerability was in Windows Server Service that also was vulnerable to remote code execution through sending a specially crafted RPC request  . Using this vulnerability, Stuxnet connected to other computers BIB002 . In addition, some attacks are realized by exploiting buffer overflow vulnerabilities in the OS running in the control center  , BIB001 . Buffer overflow vulnerabilities are the most commonly reported vulnerabilities to ICS-CERT  . c) ICS V5, software vulnerabilities: We consider programs running on general-purpose OS for controlling and monitoring controllers as cyber-physical components. WinCC is an example of such programs, which is a Siemens software used for controlling PLCs. In the Stuxnet attack, the first step was to target vulnerable computers running WinCC software BIB002 . A vulnerable computer is exploited so Stuxnet can copy itself onto the computer, it then installs a rogue driver DLL file that is used by both WinCC software and the PLC. Once the driver DLL installed, a rogue code is sent to the PLC. The critical vulnerability in the controller that allows such an action is the lack of digital signature  . PLCs and other field devices have limited computational capabilities and cannot perform computationally expensive solutions such as cryptographic measures. Another class of cyber-physical software components cover software running on field devices such as PLCs and other controllers. As we pointed out earlier, the presence of COTS products in CPS is one of the contributing factors for the increased number of vulnerabilities. Leverett and Wightman  revealed an authentication vulnerability in a very common COTS product deployed in 200 PLC models. This vulnerability allows an attacker to bypass the authentication and consequently, take control of the PLC. The authors conducted multiple scans and discovered a surprisingly large number of PLCs that directly connect to the Internet. In addition, some vendors leave backdoors in some field devices. This makes it possible for attackers to gain access and full control over the device when valid credentials are gathered  .