Attacking the smart grid using public information

Konstantinou, Charalambos; Sazos, Marios; Maniatakos, Michail

doi:10.1109/latw.2016.7483348

Cited by 19 publications

(16 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They present probabilistic power flow studies that show how the variable nature of power flow, due to wind fluctuations and uncertainties, can alter the number and location of the most critical contingencies recognized by system operators. The correct identification of these critical contingencies is of paramount importance as they can be potentially leveraged by adversaries in order to cause major disruptions in EPS [26], [27].…”

Section: ) Methods For N − K Contingency Analysismentioning

confidence: 99%

Deep Reinforcement Learning for Cybersecurity Assessment of Wind Integrated Power Systems

2020

Self Cite

View full text Add to dashboard Cite

Section: ) Methods For N − K Contingency Analysismentioning

confidence: 99%

Deep Reinforcement Learning for Cybersecurity Assessment of Wind Integrated Power Systems

2020

Self Cite

View full text Add to dashboard Cite

“…For instance, sticky valves, changes in chemical reaction kinetics, and random variations in the composition of input streams. Each disturbance has a unique numeric identifier in the range [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20]. Finally, there are process operating constraints (e.g., maximum reactor temperature, maximum reactor pressure, etc.)…”

Section: Tennessee Eastman Plantmentioning

confidence: 99%

Identifying Near-Optimal Single-Shot Attacks on ICSs with Limited Process Knowledge

Esquivel-Vargas¹,

Castellanos²,

Caselli³

et al. 2022

Preprint

View full text Add to dashboard Cite

Industrial Control Systems (ICSs) rely on insecure protocols and devices to monitor and operate critical infrastructure. Prior work has demonstrated that powerful attackers with detailed system knowledge can manipulate exchanged sensor data to deteriorate performance of the process, even leading to full shutdowns of plants. Identifying those attacks requires iterating over all possible sensor values, and running detailed system simulation or analysis to identify optimal attacks. That setup allows adversaries to identify attacks that are most impactful when applied on the system for the first time, before the system operators become aware of the manipulations. In this work, we investigate if constrained attackers without detailed system knowledge and simulators can identify comparable attacks. In particular, the attacker only requires abstract knowledge on general information flow in the plant, instead of precise algorithms, operating parameters, process models, or simulators. We propose an approach that allows single-shot attacks, i.e., near-optimal attacks that are reliably shutting down a system on the first try. The approach is applied and validated on two use cases, and demonstrated to achieve comparable results to prior work, which relied on detailed system information and simulations.

show abstract

“…Table 1 summarizes the state-of-the-art process-aware attacks and countermeasures for various ICS sectors. While there are many sector-specific attacks for Energy [19,23,29], Water [1,2,17,25,31,35], and Chemical [8,22,26,46] sectors, research on generic payload generation [17,32,33] is the closest to our work. We differ from ladder logic, bombs [17] in the impact of our attack vector: We cause specific sustainable manipulations whereas it focuses on random manipulations.…”

Section: Related Workmentioning

confidence: 99%

“…These characteristics require complete reconnaissance of the target. While public information about plants [23], device fingerprinting [14], social engineering [4] and model simulation [22] may be used to gain pre-infection knowledge, this leads to crafting manually designed target-specific attack vectors. We, on the other hand, aim to build attack tools that can automatically gain knowledge about the plant and can design payloads accordingly.…”

Section: Threat Modelmentioning

confidence: 99%

I came, I saw, I hacked: Automated Generation of Process-independent Attacks for Industrial Control Systems

Sarkar

Benkraouda²,

Maniatakos³

2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

Malicious manipulations on Industrial Control Systems (ICSs) endanger critical infrastructures, causing unprecedented losses. Stateof-the-art research in the discovery and exploitation of vulnerability typically assumes full visibility and control of the industrial process, which in real-world scenarios is unrealistic. In this work, we investigate the possibility of an automated end-to-end attack for an unknown control process in the constrained scenario of infecting just one industrial computer. We create databases of human-machine interface images, and Programmable Logic Controller (PLC) binaries using publicly available resources to train machine-learning models for modular and granular fingerprinting of the ICS sectors and the processes, respectively. We then explore control-theoretic attacks on the process leveraging common/ubiquitous control algorithm modules like Proportional Integral Derivative blocks using a PLC binary reverse-engineering tool, causing stable or oscillatory deviations within the operational limits of the plant. We package the automated attack and evaluate it against a benchmark chemical process, demonstrating the feasibility of advanced attacks even in constrained scenarios. CCS CONCEPTS • Security and privacy → Systems security.

show abstract

Attacking the smart grid using public information

Cited by 19 publications

References 3 publications

Deep Reinforcement Learning for Cybersecurity Assessment of Wind Integrated Power Systems

Deep Reinforcement Learning for Cybersecurity Assessment of Wind Integrated Power Systems

Identifying Near-Optimal Single-Shot Attacks on ICSs with Limited Process Knowledge

I came, I saw, I hacked: Automated Generation of Process-independent Attacks for Industrial Control Systems

Contact Info

Product

Resources

About