TRUST, Autumn 2010 Conference, November 10-11, 2010 Simulation of Network Attacks on SCADA Systems Rohan Chabukswar, Bruno Sinopoli, Gabor Karsai, Annarita Giani, Himanshu Neema, Andrew Davis

TRUST, Autumn 2010 Conference, November 10-11, 2010 Outline Introduction – Security of SCADA Systems C2WindTunnel – Testbed Design – Testbed Implementaion Simulation Example – System Model and Attacks – Observations and Conclusions "Simulation of Network Attacks on SCADA Systems", Andrew Davis2

TRUST, Autumn 2010 Conference, November 10-11, 2010 SCADA Systems Supervisory Control and Data Acquisition – Manage and control critical infrastructure Gas utilities, power plants, oil refineries, power utilities, chemical plants, water management, traffic control systems "Simulation of Network Attacks on SCADA Systems", Andrew Davis3

TRUST, Autumn 2010 Conference, November 10-11, 2010 SCADA Security Potential damage to critical infrastructure and loss of life Components have decades-long lifetimes – Legacy systems designed without security as a priority Upgrades may cause unacceptable downtime Real life examples exist – Recent Stuxnet worm targeted SCADA systems monitoring nuclear facilities in Iran "Simulation of Network Attacks on SCADA Systems", Andrew Davis4

TRUST, Autumn 2010 Conference, November 10-11, 2010 Outline Introduction – Security of SCADA Systems C2WindTunnel – Testbed Design – Testbed Implementaion Simulation Example – System Model and Attacks – Observations and Conclusions "Simulation of Network Attacks on SCADA Systems", Andrew Davis5

TRUST, Autumn 2010 Conference, November 10-11, 2010 Testbed Design Goals Assess vulnerabilities of current SCADA systems in a realistic setting Allow testing of novel architectural and technological solutions for next generation SCADA Provide an open-source, highly flexible testbed for the industrial control community Should be modular, easily reconfigurable, and accurate "Simulation of Network Attacks on SCADA Systems", Andrew Davis6

TRUST, Autumn 2010 Conference, November 10-11, 2010 Simulation Integration "Simulation of Network Attacks on SCADA Systems", Andrew Davis7 Controller (Simulink) Process (Simulink) Network (OMNeT++) ??

TRUST, Autumn 2010 Conference, November 10-11, 2010 Integration Challenges Modeling network effects at packet level – Allows high fidelity simulation of network effects – Requires transferring time-stamped data among simulations with precise time synchronization – Requires discrete event model of network Different simulation time models – Network uses discrete event simulator – Control and process use continuous time simulators – Consistent global time must be maintained to prevent breach of causality "Simulation of Network Attacks on SCADA Systems", Andrew Davis8

TRUST, Autumn 2010 Conference, November 10-11, 2010 High Level Architecture Handles time-stamped data transfer – Defines a global object model – Uses publish and subscribe architecture to transmit time-stamped data Handles time management among diverse time models – Directs progression of each simulation’s local time – No simulation can receive events in its past "Simulation of Network Attacks on SCADA Systems", Andrew Davis9

TRUST, Autumn 2010 Conference, November 10-11, 2010 Simulation Integration "Simulation of Network Attacks on SCADA Systems", Andrew Davis10 Controller (Simulink) Process (Simulink) Network (OMNeT++) DoD/HLA Simulation Architecture Simulink glue code OMNeT++ glue code

TRUST, Autumn 2010 Conference, November 10-11, 2010 Integration Code Generation Integration of federates modeled with GME, a general purpose graphical modeling tool – Federates and object model – Publish and subscribe relationships – Timing parameters C2WindTunnel includes code generators to facilitate integration of federates – HLA FED file – Simulation engine to HLA glue code – Simplified interaction publish & subscribe "Simulation of Network Attacks on SCADA Systems", Andrew Davis11

TRUST, Autumn 2010 Conference, November 10-11, 2010 Recent Work Extended network integration – Endpoint nodes specified in integration model allowing transparent data flow from HLA to network – Code generated for data-type based routing of information through the network – Integrates with the INET framework to allow network modeling without concern for federation level details – Restructured HLA-to-network interface to support newest version of the poRTIco RTI New Windows installer simplifies setup – Available on project wiki "Simulation of Network Attacks on SCADA Systems", Andrew Davis12

TRUST, Autumn 2010 Conference, November 10-11, 2010 Outline Introduction – Security of SCADA Systems C2WindTunnel – Testbed Design – Testbed Implementaion Simulation Example – System Model and Attacks – Observations and Conclusions "Simulation of Network Attacks on SCADA Systems", Andrew Davis13

TRUST, Autumn 2010 Conference, November 10-11, 2010 Plant Model "Simulation of Network Attacks on SCADA Systems", Andrew Davis14

TRUST, Autumn 2010 Conference, November 10-11, 2010 Control Problem Objectives – Maintain production rate by controlling valves – Minimize operating cost (function of purge loss of A and C) Restrictions – Operating pressure below shutdown limit of 3 MPa – Flows have a maximum at their saturation points "Simulation of Network Attacks on SCADA Systems", Andrew Davis15

TRUST, Autumn 2010 Conference, November 10-11, 2010 Network Model "Simulation of Network Attacks on SCADA Systems", Andrew Davis16

TRUST, Autumn 2010 Conference, November 10-11, 2010 Attacks DDOS attacks are simulated on system, targeting various routers Saturated with external communication requests from large number of zombie nodes Process nodes connecting to attacked routers sustain 100% packet loss for the duration of the attack Controller, feed and product routers are attacked from 30-second mark to 60-second mark out of simulation time of 150 seconds "Simulation of Network Attacks on SCADA Systems", Andrew Davis17

TRUST, Autumn 2010 Conference, November 10-11, 2010 Attack on Feed Router "Simulation of Network Attacks on SCADA Systems", Andrew Davis18 Attack on Feed Router: Process remains stable throughout duration of attack

TRUST, Autumn 2010 Conference, November 10-11, 2010 Attack on Product Router "Simulation of Network Attacks on SCADA Systems", Andrew Davis19 Attack on Product Router: Process destabilizes during attack and begins to recover at its completion

TRUST, Autumn 2010 Conference, November 10-11, 2010 Conclusions Effects of each individual attack are hard to predict and compare analytically For a complicated system, calculating effects would require intensive analytical computations, could be intractable Simulation is the best way to estimate effects, to implement and compare network configurations and redundancies "Simulation of Network Attacks on SCADA Systems", Andrew Davis20

TRUST, Autumn 2010 Conference, November 10-11, 2010 Future Work Simulation can be used to develop and evaluate more robust control algorithms Extend testing to other common network security attacks Investigate distinguishing process faults from network attacks "Simulation of Network Attacks on SCADA Systems", Andrew Davis21

TRUST, Autumn 2010 Conference, November 10-11, 2010 Acknowledgements This work was supported in part by TRUST (Team for Research in Ubiquitous Secure Technology), which receives support from the National Science Foundation (NSF award number CCF ) and the following organizations: AFOSR (#FA ), BT, Cisco, DoCoMo USA Labs, EADS, ESCHER, HP, IBM, iCAST, Intel, Microsoft, ORNL, Pirelli, Qualcomm, Sun, Symantec, TCS, Telecom Italia and United Technologies. "Simulation of Network Attacks on SCADA Systems", Andrew Davis22