TY - GEN A1 - Alsabbagh, Wael A1 - Kim, Chaerin A1 - Langendörfer, Peter T1 - Investigating the security of OpenPLC : vulnerabilities, attacks, and mitigation solutions T2 - IEEE Access Y1 - 2024 U6 - https://doi.org/10.1109/ACCESS.2024.3356051 SN - 2169-3536 VL - 12 SP - 11561 EP - 11583 PB - Institute of Electrical and Electronics Engineers (IEEE) ER - TY - GEN A1 - Alsabbagh, Wael A1 - Langendörfer, Peter T1 - A Fully-Blind False Data Injection on PROFINET I/O Systems T2 - 2021 IEEE 30th International Symposium on Industrial Electronics (ISIE) Y1 - 2021 SN - 978-1-7281-9024-2 SN - 978-1-7281-9023-5 U6 - https://doi.org/10.1109/ISIE45552.2021.9576496 SN - 2163-5145 ER - TY - GEN A1 - Alsabbagh, Wael A1 - Langendörfer, Peter T1 - Patch Now and Attack Later - Exploiting S7 PLCs by Time-Of-Day Block T2 - 2021 4th IEEE International Conference on Industrial Cyber-Physical Systems (ICPS) Y1 - 2021 SN - 978-1-6654-3045-6 SN - 978-1-7281-6207-2 U6 - https://doi.org/10.1109/ICPS49255.2021.9468226 ER - TY - GEN A1 - Alsabbagh, Wael A1 - Langendörfer, Peter T1 - A Stealth Program Injection Attack against S7-300 PLCs T2 - 2021 22nd IEEE International Conference on Industrial Technology (ICIT) Y1 - 2021 SN - 978-1-7281-5731-3 SN - 978-1-7281-5730-6 U6 - https://doi.org/10.1109/ICIT46573.2021.9453483 ER - TY - GEN A1 - Alsabbagh, Wael A1 - Langendörfer, Peter T1 - A New Injection Threat on S7-1500 PLCs - Disrupting the Physical Process Offline T2 - IEEE Open Journal of the Industrial Electronics Society Y1 - 2022 U6 - https://doi.org/10.1109/OJIES.2022.3151528 SN - 2644-1284 IS - 3 SP - 146 EP - 162 ER - TY - GEN A1 - Alsabbagh, Wael A1 - Langendörfer, Peter T1 - No Need to be Online to Attack - Exploiting S7-1500 PLCs by Time-Of-Day Block T2 - Proc. 28th International Conference on Information, Communication and Automation Technologies (ICAT 2022), arajevo, Bosnia and Herzegovina, 16-18 June 2022 Y1 - 2022 SN - 978-1-6654-6692-9 SN - 978-1-6654-6691-2 U6 - https://doi.org/10.1109/ICAT54566.2022.9811147 SN - 2643-1858 ER - TY - GEN A1 - Alsabbagh, Wael A1 - Langendörfer, Peter ED - Jasperneite, Jürgen ED - Lohweg, Volker T1 - A Remote Attack Tool on Siemens S7-300 Controllers: Practical Report T2 - Kommunikation und Bildverarbeitung in der Automation : Ausgewählte Beiträge der Jahreskolloquien KommA und BVAu 2020 Y1 - 2022 SN - 978-3-662-64282-5 SN - 978-3-662-64283-2 U6 - https://doi.org/10.1007/978-3-662-64283-2_1 SN - 2522-8579 SP - 3 EP - 21 PB - Springer Vieweg CY - Heidelberg ER - TY - GEN A1 - Alsabbagh, Wael A1 - Amogbonjaye, Samuel A1 - Kim, Chaerin A1 - Langendörfer, Peter T1 - Pirates of the MQTT : raiding IIoT systems with a rogue client T2 - 2024 8th Cyber Security in Networking Conference (CSNet) N2 - The integration of MQTT (Message Queuing Telemetry Transport) in Industrial Internet of Things (IIoT) systems enhances operational efficiency but introduces significant security vulnerabilities, particularly through rogue MQTT clients. These clients exploit MQTT weaknesses to disrupt industrial processes and compromise data integrity. This paper examines the impact of rogue MQTT client attacks, demonstrated through a detailed case study using the Fischertechnik Lernfabrik 4.0. We highlight how attackers can exploit MQTT's inherent vulnerabilities, including anonymous connections and message retention, to inject false data and interfere with operations. To address these risks, we propose several mitigation strategies: implementing fine-grained authorization for topic access control, enhancing replay attack protection with Message Authentication Code (MAC), employing mutual TLS (mTLS) for secure client authentication, and incorporating real-time client activity monitoring and anomaly detection. These measures aim to bolster IIoT system security, mitigate potential disruptions, and maintain operational integrity. Our findings and recommendations contribute to advancing security practices in MQTT-based IIoT environments. All attack codes and a proof-of-concept are ublicly available. KW - Rogue Client KW - MQTT Protocol KW - Cyberattacks KW - Cybersecurity Y1 - 2024 U6 - https://doi.org/10.1109/CSNet64211.2024.10851733 SP - 248 EP - 253 PB - IEEE CY - Piscataway, NJ ER - TY - GEN A1 - Alsabbagh, Wael A1 - Kim, Chaerin A1 - Langendörfer, Peter T1 - A payload of lies : false data injection attacks on MQTT-based IIoT systems T2 - IECON 2024 - 50th Annual Conference of the IEEE Industrial Electronics Society : proceedings N2 - In the ever-evolving landscape of Industrial Internet of Things (IIoT), security emerges as a critical concern. This paper delves into the realm of False Data Injection Attacks (FDIAs) within MQTT-based IIoT systems, specifically targeting the publisher-subscriber model. Our exploration unveils two distinct attack scenarios that exploit the vulnerabilities inherent in the communication fabric. In the first scenario, we demonstrate the potential chaos wrought by sending false data to subscribers, manipulating their perception and inducing actions that align with the attacker’s whims. The second scenario ventures into the heart of the publisher, where the attacker injects false data – deceptive status updates from other publishers e.g., Programmable Logic Controllers (PLCs). The repercussions ripple through the entire industrial process, impacting operations based on fraudulent information. This showcases the cascading effects of FDIAs, illustrating the profound threat they pose to the reliability and integrity of IIoT systems. For real-world attack scenarios, Our attacks were conducted on a small MQTT-based IIoT system, using the Fischertechnik Lernfabrik 4.0 9V factory. Finally, we proposes mitigation solutions to safeguard IIoT systems from the far-reaching consequences of false data manipulation. Our attack codes as well as a proof-of-concept are publicly available for further research. KW - FDIAs KW - IIoT KW - IoT KW - MQTT Protocol Y1 - 2024 SN - 978-1-6654-6454-3 U6 - https://doi.org/10.1109/IECON55916.2024.10905487 SP - 1 EP - 8 PB - IEEE CY - Piscataway, NJ ER - TY - GEN A1 - Alsabbagh, Wael A1 - Sayegh, Bahij A1 - Kim, Chaerin A1 - Langendorfer, Peter T1 - FeatNet-IDS : anomaly detection based-features for industrial internet of things systems T2 - 2025 Silicon Valley Cybersecurity Conference (SVCC) N2 - Anomaly detection is critical for securing Industrial Internet of Things (IIoT) systems against evolving cyber threats. This paper introduces FeatNet-IDS, an enhanced Intrusion Detection System (IDS) for MQTT-based IIoT environments. FeatNet- IDS combines advanced feature selection and machine learning techniques to improve anomaly detection accuracy, efficiency, and interpretability. Evaluated on a domain-specific dataset of MQTT-related attacks, including control logic injection, the framework achieves 92.3% accuracy, 91.5% F1-score, and 96.8% ROC AUC, with a low false alarm rate of 2.73%. By emphasizing feature stability and importance, FeatNet-IDS outperforms or matches state-of-the-art methods, demonstrating robustness and transparency. Practical deployment implications are discussed, with future work addressing dataset expansion, hyperparameter tuning, and advanced ensemble approaches. The dataset and framework codes are publicly available to support further research. KW - IIoT KW - MQTT Protocol KW - Cyberattacks KW - Cybersecurity KW - Anomaly Detection Y1 - 2025 SN - 979-8-3315-3429-5 U6 - https://doi.org/10.1109/SVCC65277.2025.11133650 SP - 1 EP - 8 PB - IEEE CY - Piscataway, NJ ER - TY - GEN A1 - Alsabbagh, Wael A1 - Urrego, Diego A1 - Langendörfer, Peter T1 - Smart traps for smart systems : scalable honeynets for IIoT cybersecurity T2 - 2025 34th International Conference on Computer Communications and Networks (ICCCN) N2 - Honeypots serve as decoy systems that attract and monitor intruders, offering insights into their behavior. When interconnected, these honeypots form honeynets, simulating high-value environments to engage attackers and facilitate deeper analysis. However, in Industrial Internet of Things (IIoT) networks, deploying honeypots presents challenges such as static configurations, lack of network context, and difficulties in scaling.In this paper, we introduce TrapNet, a scalable, lightweight honeynet framework specifically designed for IIoT environments. TrapNet combines compact, on-site honeypots with large-scale, adaptive honeynets deployed on fog and cloud infrastructures using microservices. This approach enables fast deployment, scalability, and flexibility, providing an effective solution for IIoT cybersecurity. Our experimental results show that TrapNet efficiently detects intrusions while maintaining low resource overhead. Additionally, all code and configurations used in this study are publicly available, fostering further research and innovation in honeynet design and IIoT security. KW - Honeypots KW - Cybersecurity KW - IIoT Security KW - Fog Computing KW - Cloud Infrastructure Y1 - 2025 SN - 979-8-3315-0898-2 U6 - https://doi.org/10.1109/ICCCN65249.2025.11133761 SP - 1 EP - 6 PB - IEEE CY - Piscataway, NJ ER -