TY - GEN
T1 - Compromising the Data Integrity of an Electrical Power Grid SCADA System
AU - Qassim, Qais Saif
AU - Jamil, Norziana
AU - Daud, Maslina
AU - Ja’affar, Norhamadi
AU - Kamarulzaman, Wan Azlan Wan
AU - Mahdi, Mohammed Najah
N1 - Publisher Copyright:
© 2021, Springer Nature Singapore Pte Ltd.
PY - 2021
Y1 - 2021
N2 - Supervisory Control and Data Acquisition (SCADA) systems perform monitoring and controlling services in critical national infrastructures such as electrical power generation and distribution, transportation networks, water supply and manufacturing, and production facilities. Cyber-attacks that compromise data integrity in SCADA systems such as an unauthorised manipulation of sensor or control signals could have a severe impact on the operation of the critical national infrastructure as it misleads system operators into making wrong decisions. This work investigates the man-in-the-middle (MITM) attack that aims explicitly at compromising data integrity of SCADA systems. The IEC 60870-5-104 tele-control communication protocol is used as the subject focus because it is a commonly used communication protocol in electrical power SCADA systems for tele-control and monitoring. We conducted several MITM attacks: covering the capturing, modification and injection of control commands, on IEC 60870-5-104 in our power grid SCADA system testbed. We described and performed the attacks in detail, together with several use cases. Based on the Proof-of-Concept (POC) conducted and data that we gathered, it shows that IEC 60870-5-104 is vulnerable against MITM attacks and it can be an entry point of cyberattacks, be it sophisticated or otherwise.
AB - Supervisory Control and Data Acquisition (SCADA) systems perform monitoring and controlling services in critical national infrastructures such as electrical power generation and distribution, transportation networks, water supply and manufacturing, and production facilities. Cyber-attacks that compromise data integrity in SCADA systems such as an unauthorised manipulation of sensor or control signals could have a severe impact on the operation of the critical national infrastructure as it misleads system operators into making wrong decisions. This work investigates the man-in-the-middle (MITM) attack that aims explicitly at compromising data integrity of SCADA systems. The IEC 60870-5-104 tele-control communication protocol is used as the subject focus because it is a commonly used communication protocol in electrical power SCADA systems for tele-control and monitoring. We conducted several MITM attacks: covering the capturing, modification and injection of control commands, on IEC 60870-5-104 in our power grid SCADA system testbed. We described and performed the attacks in detail, together with several use cases. Based on the Proof-of-Concept (POC) conducted and data that we gathered, it shows that IEC 60870-5-104 is vulnerable against MITM attacks and it can be an entry point of cyberattacks, be it sophisticated or otherwise.
KW - Cyber-security
KW - IEC 60870-5-104
KW - Man-in-the-middle
KW - SCADA
KW - Vulnerability
UR - https://www.scopus.com/pages/publications/85101575520
UR - https://www.scopus.com/pages/publications/85101575520#tab=citedBy
U2 - 10.1007/978-981-33-6835-4_40
DO - 10.1007/978-981-33-6835-4_40
M3 - Conference contribution
AN - SCOPUS:85101575520
SN - 9789813368347
T3 - Communications in Computer and Information Science
SP - 604
EP - 626
BT - Advances in Cyber Security - Second International Conference, ACeS 2020, Revised Selected Papers
A2 - Anbar, Mohammed
A2 - Abdullah, Nibras
A2 - Manickam, Selvakumar
PB - Springer Science and Business Media Deutschland GmbH
T2 - 2nd International Conference on Advances in Cyber Security, ACeS 2020
Y2 - 8 December 2020 through 9 December 2020
ER -