Exploiting Control Device Vulnerabilities: Attacking Cyber-Physical Water System
Industrial Control Systems (ICS) are transitioning from isolated, custom built systems to those employing general purpose computer hosts, wireless networks, and artificial intelligence. An increasing number of vulnerabilities in ICS devices is a major cause for concern since it provides potential ad...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
FRUCT
2022-11-01
|
| Series: | Proceedings of the XXth Conference of Open Innovations Association FRUCT |
| Subjects: | |
| Online Access: | https://www.fruct.org/publications/volume-32/fruct32/files/Sin.pdf |
| _version_ | 1811320721036541952 |
|---|---|
| author | Parul Sindhwad Faruk Kazi |
| author_facet | Parul Sindhwad Faruk Kazi |
| author_sort | Parul Sindhwad |
| collection | DOAJ |
| description | Industrial Control Systems (ICS) are transitioning from isolated, custom built systems to those employing general purpose computer hosts, wireless networks, and artificial intelligence. An increasing number of vulnerabilities in ICS devices is a major cause for concern since it provides potential adversaries with a simple approach to exploit and attack unpatched ICS systems. In light of this, the paper explores attack vectors that target unpatched system vulnerabilities and their impact on the ICS, demonstrated using Waste Water Treatment Plant (WWTP) testbed. Denial of Service (DoS), Buffer overflow, privilege escalation, unauthorized command injection attacks are executed and their impacts are investigated using CIA and STRIDE threat modeling. The main outcomes of the study are, 1) An update on public advisory CVE-2021-33834 by Moxa. 2) Demonstration of attack on a device with publicly accessible Proof of Concept (POC) of another device using Modbus buffer overflow vulnerability. Finally, various recommendations are made that can be used for security penetration testing to identify security flaws, as well as directions for product developers to implement security by design. |
| first_indexed | 2024-04-13T13:04:19Z |
| format | Article |
| id | doaj.art-70d99c672549465bb0e3dc2a099bd014 |
| institution | Directory Open Access Journal |
| issn | 2305-7254 2343-0737 |
| language | English |
| last_indexed | 2024-04-13T13:04:19Z |
| publishDate | 2022-11-01 |
| publisher | FRUCT |
| record_format | Article |
| series | Proceedings of the XXth Conference of Open Innovations Association FRUCT |
| spelling | doaj.art-70d99c672549465bb0e3dc2a099bd0142022-12-22T02:45:49ZengFRUCTProceedings of the XXth Conference of Open Innovations Association FRUCT2305-72542343-07372022-11-0132127027910.23919/FRUCT56874.2022.9953826Exploiting Control Device Vulnerabilities: Attacking Cyber-Physical Water SystemParul Sindhwad0Faruk Kazi1VJTI, IndiaVJTI, IndiaIndustrial Control Systems (ICS) are transitioning from isolated, custom built systems to those employing general purpose computer hosts, wireless networks, and artificial intelligence. An increasing number of vulnerabilities in ICS devices is a major cause for concern since it provides potential adversaries with a simple approach to exploit and attack unpatched ICS systems. In light of this, the paper explores attack vectors that target unpatched system vulnerabilities and their impact on the ICS, demonstrated using Waste Water Treatment Plant (WWTP) testbed. Denial of Service (DoS), Buffer overflow, privilege escalation, unauthorized command injection attacks are executed and their impacts are investigated using CIA and STRIDE threat modeling. The main outcomes of the study are, 1) An update on public advisory CVE-2021-33834 by Moxa. 2) Demonstration of attack on a device with publicly accessible Proof of Concept (POC) of another device using Modbus buffer overflow vulnerability. Finally, various recommendations are made that can be used for security penetration testing to identify security flaws, as well as directions for product developers to implement security by design.https://www.fruct.org/publications/volume-32/fruct32/files/Sin.pdfcyber securitycyber attackstridebuffer over flowdosmitm |
| spellingShingle | Parul Sindhwad Faruk Kazi Exploiting Control Device Vulnerabilities: Attacking Cyber-Physical Water System Proceedings of the XXth Conference of Open Innovations Association FRUCT cyber security cyber attack stride buffer over flow dos mitm |
| title | Exploiting Control Device Vulnerabilities: Attacking Cyber-Physical Water System |
| title_full | Exploiting Control Device Vulnerabilities: Attacking Cyber-Physical Water System |
| title_fullStr | Exploiting Control Device Vulnerabilities: Attacking Cyber-Physical Water System |
| title_full_unstemmed | Exploiting Control Device Vulnerabilities: Attacking Cyber-Physical Water System |
| title_short | Exploiting Control Device Vulnerabilities: Attacking Cyber-Physical Water System |
| title_sort | exploiting control device vulnerabilities attacking cyber physical water system |
| topic | cyber security cyber attack stride buffer over flow dos mitm |
| url | https://www.fruct.org/publications/volume-32/fruct32/files/Sin.pdf |
| work_keys_str_mv | AT parulsindhwad exploitingcontroldevicevulnerabilitiesattackingcyberphysicalwatersystem AT farukkazi exploitingcontroldevicevulnerabilitiesattackingcyberphysicalwatersystem |