Cyber Stealth Attacks in Critical Information Infrastructures

IEEE Systems Journal

Volumn 12, Issue 2, 2018, Pages 1778-1792

  Cazorla, Lorena ^a   Alcaraz, Cristina ^a   Lopez, Javier ^a  

^a UNIVERSITY OF MÁLAGA   (Spain)

Author keywords

Control systems; countermeasures; critical infrastructures (CIs); detection and protection; stealth attacks

Indexed keywords

COMPLEX NETWORKS;

COMMERCIAL OFF-THE-SHELF COMPONENTS; CRITICAL SYSTEMS; INDUSTRIAL SYSTEMS; INFORMATION AND COMMUNICATIONS TECHNOLOGY; INFORMATION INFRASTRUCTURES; NETWORKS AND SYSTEMS; STEALTH ATTACKS; THREATS AND ATTACKS;

CRITICAL INFRASTRUCTURES;

EID: 84962499012     PISSN: 19328184     EISSN: 19379234     Source Type: Journal    
DOI: 10.1109/JSYST.2015.2487684     Document Type: Article

References (70)

1. C. Alcaraz, G. Fernandez, and F. Carvajal, "Security aspects of SCADA and DCS environments," in Proc. Crit. Infrastruct. Protect., 2012, vol. 7130, pp. 120-149.
2. C. Directive, "114/EC of 08 December 2008 on the identification and designation of European CIs and the assessment of the need to improve their protection," Official J. Eur. Union, vol. 345, 2008, pp. 75-82.
3. Congress of the United States of America, Washington, DC, USA, Public Law 107-56-Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA Patriot Act) Act of 2001, Oct. 2001. [Online]. Available: http://www.gpo.gov/ fdsys/pkg/PLAW-107publ56/content-detail.html
4. Homeland Security News Wire, Mineola, NY, USA, Black Hat Event Highlights Vulnerability of U.S. Critical Infrastructure, Online News, July 2013, last accessed: May 2014.
5. Computer News, Chinese Hacking Team Caught Taking Over Decoy Water Plant, Online News, Aug. 2013, last accessed: May 2014. [Online]. Available: http://www.technologyreview.com/news/517786/chinesehacking-team-caught-taking-over-decoy-water-plant/
6. J. Lopez, R. Setola, and S. Wolthusen, Critical Infrastructure Protection: Advances in Critical Infrastructure Protection: Information Infrastructure Models, Analysis, and Defenses. Berlin, Germany: Springer-Verlag, 2012, vol. 7130.
7. "Analysis of annual incident reports 2012," ENISA, Heraklion, Greece, Annu. Incident Rep., vol. 13, Aug. 2013, pp. 1-30.
8. US DHS ICS-CERT, Incident Response Summary Report, Sep. 2011, last accessed: Jul. 2013. [Online]. Available: http://www.uscert.gov
9. US DHS ICS-CERT, ICS-Monitor Malware Infections in the Control Environment, Dec. 2012, last accessed: Apr. 2014. [Online]. Available: http://www.uscert.gov
10. US DHS ICS-CERT, ICS-Monitor Brute Force Attacks on Internet-Facing Control Systems, Jun. 2013, last accessed: Apr. 2014. [Online]. Available: http://www.uscert.gov
11. European Commission, Directive 2009/140/EC of the European Parliament and of the Council, L337/37, Nov. 2009, last accessed: May 2014. [Online]. Available: https://resilience.enisa.europa.eu/article-13
12. B. Genge, I. Kiss, and P. Haller, "A system dynamics approach for assessing the impact of cyber attacks on critical infrastructures," Int. J. Critical Infrastruct. Protect., vol. 10, Sep. 2015, pp. 3-17.
13. M. Thompson, "Mariposa botnet analysis," Def. Intell., Ottawa, ON, Canada, Tech. Rep., Oct. 2009.
14. A. Matrosov, E. Rodionov, D. Harley, and J. Malcho, "Stuxnet under the microscope," ESET LLC, San Diego, CA, USA, Sep. 2010.
15. McAfee, "Global energy cyberattacks: Night Dragon," McAfee Foundstone Professional Serv., McAfee Labs, Santa Clara, CA, USA, Tech. Rep., Ver. 1.4, Feb. 2011.
16. E. Chien and G. OGorman, "The Nitro attacks: Stealing secrets from the chemical industry," Symantec Secur. Response, Mountain View, CA, USA, October 2011.
17. Kaspersky Lab Expert, Moscow, Russia, Duqu: Steal Everything, 2011, last accessed: Apr. 2014. [Online]. Available: http://www.kaspersky.com/ about/press/majormalwareoutbreaks/duqu
18. K. Munro, "Deconstructing Flame: The limitations of traditional defences," Comput. Fraud Secur., vol. 2012, no. 10, pp. 8-11, Oct. 2012.
19. US DHS ICS-CERT, "ICS-Monitor Incident Response Activity," Nat. Cybersecur. Commun. Integr. Center, Apr. 2014, last accessed: May 2014. [Online]. Available: https://ics-cert.us-cert.gov
20. M. Jakobsson, S. Wetzel, and B. Yener, "Stealth attacks on ad-hoc wireless networks," in Proc. IEEE 58th VTC-Fall, 2003, vol. 3, pp. 2103-2111.
21. C. Alcaraz and J. Lopez, "Wide-area situational awareness for critical infrastructure protection," IEEE Comput., vol. 46, no. 4, pp. 30-37, Apr. 2013.
22. B. Miller and D. Rowe, "A survey of SCADA and critical infrastructure incidents," in Proc. 1st Annu. Conf. Res. Inf. Technol., 2012, pp. 51-56.
23. B. Zhu, A. Joseph, and S. Sastry, "A taxonomy of cyber attacks on SCADA systems," in Proc. iThings/CPSCom, 2011, pp. 380-388.
24. C. Myers, S. Powers, and D. Faissol, "Taxonomies of cyber adversaries and attacks: A survey of incidents and approaches," Lawrence Livermore Nat. Lab., Livermore, CA, USA, Apr. 2009, vol. 7, pp. 1-22.
25. H. F. Lipson, "Tracking and tracing cyber-attacks: Technical challenges and global policy issues," Softw. Eng. Inst., Pittsburgh, PA, USA, DTIC Document, Tech. Rep., Nov. 2002.
26. ENISA, Heraklion, Greece, Existing Taxonomies, 2005-2013, last accessed: Aug. 2013. [Online]. Available: http://www.enisa.europa. eu/activities/cert/support/incident-management/browsable/incidenthandling-process/incident-taxonomy/existing-taxonomies
27. F. Skopik and Z. Ma, "Attack vectors to metering data in smart grids under security constraints," in Proc. IEEE 36th COMPSACW, 2012, pp. 134-139.
28. T. Tsao, R. Alexander, M. Dohler, V. Daza, and A. Lozano, Routing Over Low Power and Lossy Networks, Jan. 2012, pp. 1-50. [Online]. Available: https://datatracker.ietf.org/doc/charter-ietf-roll/. Last accessed: Aug. 2013.
29. E. Rescorla and B. Korver, Guidelines for Writing RFC Text on Security Considerationsm IETF RFC-3552, vol. 1, pp. 1-44, Jul. 2003. [Online]. Available: https://tools.ietf.org/html/rfc3552
30. V. Marinova-Boncheva, "A short survey of intrusion detection systems," Probl. Eng. Cybern. Robot., vol. 58, pp. 23-30, 2007.
31. G. Joy Persial, M. Prabhu, and R. Shanmugalakshmi, "Side channel attack-survey," Int. J. Adv. Sci. Res. Rev., vol. 1, no. 2, pp. 49-54, Sep. 2011.
32. J. Kong, O. Aciiçmez, J.-P. Seifert, and H. Zhou, "Hardware-software integrated approaches to defend against software cache-based side channel attacks," in Proc. IEEE 15th Int. Symp. High Perform. Comput. Archit., 2009, pp. 393-404.
33. N. Tomar and M. S. Gaur, "Information theft through covert channel by exploiting HTTP post method," in Proc. 10th Int. Conf. WOCN, 2013, pp. 1-5.
34. A. Hintz, "Covert channels in TCP and IP Headers," presented at the DEF CON Security Conf., Las Vegas, NV, USA, Aug. 2-4, 2002.
35. M. Jakobsson, X. Wang, and S. Wetzel, "Stealth attacks in vehicular technologies," in Proc. IEEE 60th Veh. Technol. Conf., 2004, vol. 2, pp. 1218-1222.
36. G. F. Lyon,Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. Insecure: Palo Alto, CA, USA, 2009.
37. C. Yin, M. Li, J.Ma, and J. Sun, "Honeypot and scan detection in intrusion detection system," in Proc. Can. Conf. Elect. Comput. Eng., 2004, vol. 2, pp. 1107-1110.
38. IBM, "IBM X-force trend and risk report," IBM, Armonk, NY, USA, Nov. 2013. [Online]. Available: http://xforce.iss.net/xforce/xfdb/405
39. U. Maimon, A. Kantor, and O. Dov, "Scan Detection," U.S. Patent 20 050 147 037 A1, Jul. 7, 2005.
40. A. Dainotti, A. King, K. Claffy, O. Papale, and A. Pescapé, "Analysis of a/0 stealth scan from a botnet," in Proc. ACM Conf. Internet Meas., 2012, pp. 1-14.
41. J. Fan et al., "State-of-The-art of secure ECC implementations: A survey on known side-channel attacks and countermeasures," in Proc. IEEE Int. Symp. Hardware-Oriented Secur. Trust, 2010, pp. 76-87.
42. M. M. Islam, R. Pose, and C. Kopp, "Suburban ad-hoc networks in information warfare," in Proc. 6th Aust. InfoWar Conf., Geelong, Australia, 2005, pp. 1-10.
43. Modbus Application Protocol Specification, Modbus-IDA, Denham Springs, LA, USA, Dec. 2006. [Online]. Available: http://www.modbus. org/docs/ModbusApplicationProtocolV11b.pdf
44. J. A. Ambrose, R. G. Ragel, and S. Parameswaran, "RIJID: Random code injection to mask power analysis based side channel attacks," in Proc. 44th Annu. Des. Autom. Conf., 2007, pp. 489-492.
45. D. Gollmann, "Securing web applications," Inf. Secur. Tech. Rep., vol. 13, no. 1, pp. 1-9, 2008.
46. A. Grasso and P. H. Cole, "Definition of terms used by the auto-ID labs in the anti-counterfeiting white paper series," Auto-ID Labs Univ. Adelaide, Adelaide, SA, Australia, Sep. 2006.
47. Z. Su and G. Wassermann, "The essence of command injection attacks in web applications," ACM SIGPLAN Notices, vol. 41, no. 1, pp. 372-382, Jan. 2006.
48. L. K. Shar and H. K. Tan, "Defending against cross-site scripting attacks," Computer, vol. 45, no. 3, pp. 55-62, Mar. 2012.
49. M. Van Gundy and H. Chen, "Noncespaces: Using randomization to enforce information flow tracking and thwart cross-site scripting attacks," in Proc. NDSS, 2009, pp. 1-13.
50. A. Barth, C. Jackson, and J. Mitchell, "Robust defenses for cross-site request forgery," in Proc. 15th ACM Conf. Comput. Commun. Secur., 2008, pp. 75-88.
51. T. Jim, N. Swamy, and M. Hicks, "Defeating script injection attacks with browser-enforced embedded policies," in Proc. 16th Int. Conf. World Wide Web, 2007, pp. 601-610.
52. OWASP,TheTenMost CriticalWebApplication SecurityRisks,Oct. 2010.
53. Symantec, Mountain View, CA, USA, TCP MODBUS-Unauthorized Read Request, last accessed: Apr. 2014. [Online]. Available: http://www. symantec.com/securityresponse/attacksignatures/detail.jsp?asid=20674
54. National Vulnerability Database, "Vulnerability summary for CVE-2013-0663," NIST, Gaithersburg, MD, USA, Apr. 2013. [Online]. Available: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0663
55. US DHS ICS-CERT, Washington, DC, USA, "ICSA-13-077-01A Schneider Electric PLCs Vulnerabilities," Jun. 2013, last accessed: Apr. 2014. [Online]. Available: http://ics-cert.us-cert.gov/node/642
56. Power Systems Management and Associated Information Exchange- Data and Communications Security-Part 8: Role-Based Access Control, IEC/TS Std. 62351-8, Sep. 2011.
57. J.-J. Quisquater and F. Koene, "Side channel attacks: State of the art," IPA, Tokyo, Japan, Project CRYPTREC, Oct. 2002.
58. J. Reeves, A. Ramaswamy, M. Locasto, S. Bratus, and S. Smith, "Intrusion detection for resource-constrained embedded control systems in the power grid," Int. J. Crit. Infrastruct. Protect., vol. 5, no. 2, pp. 74-83, Jul. 2012.
59. R. Berthier and W. H. Sanders, "Specification-based intrusion detection for advanced metering infrastructures," in Proc. IEEE 17th PRDC, 2011, pp. 184-193.
60. J. Deng, R. Han, and S. Mishra, "Countermeasures against traffic analysis attacks in wireless sensor networks," in Proc. 1st Int. Conf. SecureComm, 2005, pp. 113-126.
61. M. Roesch, "Snort-Lightweight intrusion detection for networks," in Proc. 13th USENIX Conf. Syst. Admin., Seattle, WA, USA, 1999, pp. 229-238.
62. M. Blum, L. Von Ahn, J. Langford, and N. Hopper, The CAPTCHA Project (Completely Automatic Public Turing Test to tell Computers and Humans Apart), 2000. [Online]. Available: http://www.captcha.net
63. P. Ratanaworabhan, V. Livshits, and B. Zorn, "NOZZLE: A defense against heap-spraying code injection attacks," in Proc. USENIX Security Symp., 2009, pp. 169-186.
64. S. Bologna and R. Setola, "The need to improve local self-awareness in CIP/CIIP," in Proc. 1st IEEE Int. Workshop Crit. Infrastruct. Protect., 2005, pp. 84-89.
65. S. Avallone, C. Mazzariello, F. Oliviero, and S. P. Romano, "Protecting critical infrastructures from stealth attacks: A closed-loop approach involving detection and remediation," in Proc. Crit. Inf. Infrastruct. Security, 2013, pp. 209-212.
66. S. D'Antonio, F. Oliviero, and R. Setola, "High-speed intrusion detection in support of critical infrastructure protection," in Proc. Crit. Inf. Infrastruct. Secur., 2006, pp. 222-234.
67. F. Pasqualetti, F. Dorfler, and F. Bullo, "Attack detection and identification in cyber-physical systems," IEEE Trans. Autom. Control, vol. 58, no. 11, pp. 2715-2729, Nov. 2013.
68. European Commission, "ENCOM(2011) 163-Achievements and next steps: Towards global cyber-security," Publications Office, COM(2011) 163, Mar. 2011. [Online]. Available: https://www.eumonitor.eu/9353000/ 1/j9vvik7m1c3gyxp/vio6acq9mbym
69. K. Scarfone and P. Mell, "Guide to Intrusion Detection and Prevention Systems (IDPS)," NIST Spec. Publ., Gaithersburg, MD, USA, Tech. Rep. SP 800-94, Feb. 2007.
70. Smart Grid Interoperability Panel Cyber Security Working Group and others, "Guidelines for Smart Grid Cyber Security vol. 1-3," NIST, Gaithersburg, MD, USA, NISTIR 7628, Sep. 2010.