#HITBCyberWeek D2T2 - The Sum Of All Fears, When ICS/SCADA Are Compromised

## Overview This presentation addresses the escalating threat landscape for Industrial Control Systems (ICS) and SCADA infrastructure. The speaker, a security researcher from TECHWING (a joint venture company), demonstrates both attack and defense strategies for critical infrastructure protection. The talk emphasizes that ICS/SCADA compromise poses severe real-world consequences—power outages, water disruption, loss of life—and advocates for practical defense-in-depth approaches.

## Key Topics - **ICS Architecture Fundamentals**: Three-level Purdue Enterprise Architecture model spanning IT (levels 4-5) and OT (levels 0-3), with core components including HMI (human-machine interface), PLCs (programmable logic controllers), sensors, and actuators. - **Vulnerability Landscape**: 26% of ICS vulnerabilities are critical level, 50% high risk. Vulnerabilities rising annually. Many ICS protocols lack basic security: no authentication, no authorization, no encryption. - **Real-World Incidents**: Multiple documented attacks including 2015 Ukrainian power grid (BlackEnergy 3, phishing, malware, Master Boot Record erasure), 2016 Ukrainian power grid (ICS protocol-aware malware), 2017 Triton/Trisis system (first safety-system targeting malware), 2018 Taiwan factory ransomware ($250 million loss in 3 days), and Lockergoga ransomware. - **Protocol Research & Reverse-Engineering**: Researchers built ICS lab supporting Ethernet/IP, Modbus TCP, Siemens S7, Profinet, and other protocols. Discovered and reverse-engineered an undocumented protocol from a top-10 global PLC vendor; protocol contained 37 commands with multiple function codes.

## Technical Details **Attack Vectors Demonstrated**: - Remote PLC shutdown via function code injection - Unauthorized file modification/deletion via FTP access to PLC storage - Control logic manipulation by uploading malicious program files - Inducing physical oscillation/wear by rapidly modulating control parameters (e.g., changing device cycle time from 30 seconds to 2 seconds), simulating "stutter" attack scenarios.

**Honeypot Findings**: Global honeypot network detected actual reconnaissance traffic targeting ICS protocols from IPs traced to Chinese entities, indicating real-world active scanning and exploitation attempts on exposed ICS devices.

**Defense-in-Depth Strategy (5 Core Techniques)**: 1. Virtual/retroactive patching—detects and blocks attack signatures without modifying production systems. 2. Network access control—implements whitelisting, segmentation, and authentication for command execution (e.g., restrict PLC to accept commands only from authorized HMI devices). 3. Application lockdown—restrict processes and executables on HMI/workstations to authorized binaries only; prevents malware execution even if device is compromised. 4. Endpoint protection—detect anomalous behavior, unusual network traffic, C&C callbacks. 5. Wireless and wireless device security—mitigate rogue access points, unauthorized connectivity.

These five techniques are reported (per ICS-CERT) to prevent approximately 98% of documented ICS incidents.

## Key Takeaways - ICS/SCADA compromise is not theoretical; real incidents cause measurable damage (outages, financial loss, potential loss of life). - Many deployed ICS environments remain insecure: 40% of surveyed factories have internet-connected ICS; 69% lack basic password policy; 47% lack automated patching; 3% still run Windows XP; 84% have remote-access devices. - Attacking ICS systems is technically feasible and requires no zero-days; reverse-engineering of proprietary protocols is achievable. - Defense-in-depth, combining virtual patching, network segmentation, application lockdown, and endpoint detection, is practical and effective. - Vendor adoption of authentication, authorization, and encryption in ICS protocols remains incomplete; long-term security requires industry-wide protocol improvements.