Towards Understanding Man-In-The-Middle Attacks on IEC 60870-5-104 SCADA Networks

Peter Maynard; Kieran McLaughlin; Berthold Haberler

doi:10.14236/ewic/ics-csr2014.5

Towards Understanding Man-In-The-Middle Attacks on IEC 60870-5-104 SCADA Networks

Peter Maynard, Kieran McLaughlin, Berthold Haberler

Research output: Contribution to conference › Paper › peer-review

Abstract

This paper investigates cyber attacks on ICS which rely on IEC 60870-5-104 for telecontrol communications. The main focus of the paper is on man-in-the-middle attacks, covering modification and injection of commands, it also details capture and replay attacks. An initial set of attacks are preformed on a local software simulated laboratory. Final experiments and validation of a man-in-the-middle attack are performed in a comprehensive testbed environment in conjunction with an electricity distribution operator.

Original language	English
DOIs	https://doi.org/10.14236/ewic/ics-csr2014.5
Publication status	Published - 12 Sept 2014
Event	International Symposium for ICS & SCADA Cyber Security Research (ICS-CSR) - Austria, St Polten, Austria Duration: 11 Sept 2014 → …

Conference

Conference	International Symposium for ICS & SCADA Cyber Security Research (ICS-CSR)
Country/Territory	Austria
City	St Polten
Period	11/09/2014 → …

Access to Document

10.14236/ewic/ics-csr2014.5

Cite this

@conference{417fe0c4db58466b9091a2cd242f2f5e,

title = "Towards Understanding Man-In-The-Middle Attacks on IEC 60870-5-104 SCADA Networks",

abstract = "This paper investigates cyber attacks on ICS which rely on IEC 60870-5-104 for telecontrol communications. The main focus of the paper is on man-in-the-middle attacks, covering modification and injection of commands, it also details capture and replay attacks. An initial set of attacks are preformed on a local software simulated laboratory. Final experiments and validation of a man-in-the-middle attack are performed in a comprehensive testbed environment in conjunction with an electricity distribution operator.",

author = "Peter Maynard and Kieran McLaughlin and Berthold Haberler",

year = "2014",

month = sep,

day = "12",

doi = "10.14236/ewic/ics-csr2014.5",

language = "English",

note = "International Symposium for ICS & SCADA Cyber Security Research (ICS-CSR) ; Conference date: 11-09-2014",

}

TY - CONF

T1 - Towards Understanding Man-In-The-Middle Attacks on IEC 60870-5-104 SCADA Networks

AU - Maynard, Peter

AU - McLaughlin, Kieran

AU - Haberler, Berthold

PY - 2014/9/12

Y1 - 2014/9/12

N2 - This paper investigates cyber attacks on ICS which rely on IEC 60870-5-104 for telecontrol communications. The main focus of the paper is on man-in-the-middle attacks, covering modification and injection of commands, it also details capture and replay attacks. An initial set of attacks are preformed on a local software simulated laboratory. Final experiments and validation of a man-in-the-middle attack are performed in a comprehensive testbed environment in conjunction with an electricity distribution operator.

AB - This paper investigates cyber attacks on ICS which rely on IEC 60870-5-104 for telecontrol communications. The main focus of the paper is on man-in-the-middle attacks, covering modification and injection of commands, it also details capture and replay attacks. An initial set of attacks are preformed on a local software simulated laboratory. Final experiments and validation of a man-in-the-middle attack are performed in a comprehensive testbed environment in conjunction with an electricity distribution operator.

UR - http://www.cse.dmu.ac.uk/~heljanic/icscsr/dl/ics-csr-Programme14.pdf

U2 - 10.14236/ewic/ics-csr2014.5

DO - 10.14236/ewic/ics-csr2014.5

M3 - Paper

T2 - International Symposium for ICS & SCADA Cyber Security Research (ICS-CSR)

Y2 - 11 September 2014

ER -

Towards Understanding Man-In-The-Middle Attacks on IEC 60870-5-104 SCADA Networks

Abstract

Conference

Access to Document

Other files and links

Fingerprint

R6358ECI: PRECYSE

R1118ECI: Centre for Secure Information Technologies (CSIT)

Kieran McLaughlin

Modelling Duqu 2.0 Malware using Attack Trees with Sequential Conjunction

Cite this

Towards Understanding Man-In-The-Middle Attacks on IEC 60870-5-104 SCADA Networks

Abstract

Conference

Access to Document

Other files and links

Fingerprint

Projects

R6358ECI: PRECYSE

R1118ECI: Centre for Secure Information Technologies (CSIT)

Profiles

Kieran McLaughlin

Research output

Modelling Duqu 2.0 Malware using Attack Trees with Sequential Conjunction

Cite this