Refine
Year of publication
Document Type
Way of publication
- Open Access (19)
Keywords
- Industrial Control Systems (2)
- ASIC (1)
- Address-bit attacks (1)
- Artificial intelligence (1)
- Atomicity principle (1)
- Buffer overflow (1)
- Buffer overflows (1)
- Command Injection Attacks (1)
- Computer architecture (1)
- Continuum robots (1)
- Cyber-physical systems (1)
- Cyberattacks (1)
- Cybersecurity (1)
- Digital forensics (1)
- Elliptic curve cryptography (1)
- Elliptic curves (1)
- Embedded computing (1)
- FPGA (1)
- Horizontal attacks (1)
- Industrial plants (1)
- Machine learning (1)
- Microprogramming (1)
- Mitigation Solutions (1)
- NIST (1)
- Neural networks (1)
- OpenPLC (1)
- Parkinson's disease (1)
- Pathogens (1)
- Performance evaluation (1)
- Process control (1)
- Programmable logic devices (1)
- Protocols (1)
- Real-time systems (1)
- Resilience (1)
- Robots (1)
- S7 Protocol (1)
- SCADA systems (1)
- Seucrity Solutions (1)
- Side-channel Analysis (SCA) (1)
- Simple Power Analysis (SPA) (1)
- Wearable computers (1)
- Wireless sensor networks (1)
- Xtensa (1)
- Xtensa architecture (1)
- classification (1)
- control logic injection attack (1)
- feature selection (1)
- homogeneous feature selection ensemble (1)
- horizontal attack (1)
- industrial control system (1)
- machine learning (1)
- milling (1)
- non-profiled attack (1)
- predictive maintenance (1)
- program injection (1)
- program modification (1)
- programmable logic controller (1)
- return-oriented prgramming (1)
- sensor fusion (1)
- side channel analysis (1)
- stability of feature selection (1)
- stack canaries (1)
- tool condition monitoring (1)
Institute
BTU
S7 protocol defines an appropriate format for exchanging messages between SIMATIC S7 PLCs and their corresponding engineering software i.e., TIA Portal. Recently, Siemens has provided its newer PLC models and their proprietary S7 protocols with a very developed and sophisticated integrity check mechanism to protect them from various exploits e.g., replay attacks. This paper addresses exactly this point, and investigates the security of the most developed integrity check mechanism that the newest S7CommPlus protocol version implements. Our results showed that the latest S7 PLC models as well as their related protocols are still vulnerable. We found that adversaries can manipulate two hashes that play a significant role in generating keys and bytes for the encryption processes implemented in the S7CommPlus protocol. This allows to reproduce S7 packets and conduct several attacks that eventually impact the operation of the target PLC and the entire physical process it controls. To validate our findings, we test all the attack scenarios presented in this work on a cryptographically protected S7 PLC from the 1500 family which uses the S7CommPlusV3 protocol.
In this chapter we are discussing the very basics in the sense of how to prepare your company with respect to security. The essential issues are a proper information security governance framework that takes into account the managerial and organizational issues as well as proper technical means. For the latter we introduce network separation as this is one of the prime means to protect your production network from network based attacks.
The use of Programmable Logic Controllers (PLCs) expands in industrial domains, which makes ensuring the security of Industrial Control Systems (ICSs) become paramount. The OpenPLC project, the first open-source initiative, provides flexible and cost-effective PLC solutions to build up affordable test-beds, as well as conduct experiments and academic researches. This project has wildly grown in the last few years, thus it is essential to address the most emerging security challenges it encounters. This paper introduces a new OpenPLC architecture, called OpenPLC Aqua, provided with a set of security solutions designed specifically to overcome the vulnerabilities that the current OpenPLC versions are prone to. The new OpenPLC architecture includes four security features: 1) user credentials encryption, securing the Webserver, Whitelisting and secure SSL/TLS communication channel. The OpenPLC Aqua software was tested against several attack scenarios, that were feasible against the old OpenPLC versions. Our experimental results showed our enhanced OpenPLC software is secure and resistant against several attack scenarios e.g., authentication, injection, Man-in-the-Middle and replay attacks. The OpenPLC Aqua is publicly available and a proof of concept demo is also published with this paper.
In this work we discuss the vulnerability of atomic pattern algorithms for elliptic curve point multiplication against simple side-channel analysis attacks using our own implementation as an example. One of the assumptions, on which the atomicity principle is based, is the indistinguishability of operations with different registers, i.e. storing of the data into two different registers cannot be distinguished if their old and new data values are the same. But before the data can be stored in a register/block, this register/block has to be addressed for storing the data. Different registers/blocks have different addresses. The key-dependent addressing of registers/blocks is an inherent feature of the binary kP algorithms and allows to reveal the key k. In our work we demonstrated it. This means that the main assumption, that addressing of different registers/blocks is an indistinguishable operation, may no longer be applied when realizing kP implementations, at least not for hardware implementations.
For those who have Parkinson's disease, one of the most incapacitating symptoms is Freezing of Gait (FOG). Gait impairment and disruptions limit everyday activities and reduce quality of daily life along with the increase in the risk of falling [1]. Thanks to recent advancement in embedded electronics and sensors as well as their adaptation in the wearable device market, low power devices are becoming more and more capable running neural networks. This enables researchers to implement complex models on wearable devices that capture and analyze sensor data to detect FOGin real-time.
While IoT technology makes industries, cities, and homes smarter, it also opens the door to security risks. With the right equipment and physical access to the devices, the attacker can leverage side-channel information, like timing, power consumption, or electromagnetic emanation, to compromise cryptographic operations and extract the secret key. This work presents a side channel analysis of a cryptographic hardware accelerator for the Elliptic Curve Scalar Multiplication operation, implemented in a Field-Programmable Gate Array and as an Application-Specific Integrated Circuit. The presented framework consists of initial key extraction using a state-of-the-art statistical horizontal attack and is followed by regularized Artificial Neural Networks, which take, as input, the partially incorrect key guesses from the horizontal attack and correct them iteratively. The initial correctness of the horizontal attack, measured as the fraction of correctly extracted bits of the secret key, was improved from 75% to 98% by applying the iterative learning.
Feature selection (FS) represents an essential step for many machine learning-based predictive maintenance (PdM) applications, including various industrial processes, components, and monitoring tasks. The selected features not only serve as inputs to the learning models but also can influence further decisions and analysis, e.g., sensor selection and understandability of the PdM system. Hence, before deploying the PdM system, it is crucial to examine the reproducibility and robustness of the selected features under variations in the input data. This is particularly critical for real-world datasets with a low sample-to-dimension ratio (SDR). However, to the best of our knowledge, stability of the FS methods under data variations has not been considered yet in the field of PdM. This paper addresses this issue with an application to tool condition monitoring in milling, where classifiers based on support vector machines and random forest were employed. We used a five-fold cross-validation to evaluate three popular filter-based FS methods, namely Fisher score, minimum redundancy maximum relevance (mRMR), and ReliefF, in terms of both stability and macro-F1. Further, for each method, we investigated the impact of the homogeneous FS ensemble on both performance indicators. To gain broad insights, we used four (2:2) milling datasets obtained from our experiments and NASA’s repository, which differ in the operating conditions, sensors, SDR, number of classes, etc. For each dataset, the study was conducted for two individual sensors and their fusion. Among the conclusions: (1) Different FS methods can yield comparable macro-F1 yet considerably different FS stability values. (2) Fisher score (single and/or ensemble) is superior in most of the cases. (3) mRMR’s stability is overall the lowest, the most variable over different settings (e.g., sensor(s), subset cardinality), and the one that benefits the most from the ensemble.
Programmable logic controllers (PLCs) make up a substantial part of critical infrastructures (CIs) and industrial control systems (ICSs). They are programmed with a control logic that defines how to drive and operate critical processes such as nuclear power plants, petrochemical factories, water treatment systems, and other facilities. Unfortunately, these devices are not fully secure and are prone to malicious threats, especially those exploiting vulnerabilities in the control logic of PLCs. Such threats are known as control logic injection attacks. They mainly aim at sabotaging physical processes controlled by exposed PLCs, causing catastrophic damage to target systems as shown by Stuxnet. Looking back over the last decade, many research endeavors exploring and discussing these threats have been published. In this article, we present a flashback on the recent works related to control logic injection attacks against PLCs. To this end, we provide the security research community with a new systematization based on the attacker techniques under three main attack scenarios. For each study presented in this work, we overview the attack strategies, tools, security goals, infected devices, and underlying vulnerabilities. Based on our analysis, we highlight the current security challenges in protecting PLCs from such severe attacks and suggest security recommendations for future research directions.