Did you really hack a nuclear power plant? An industrial control mobile honeypot

Vasilomanolakis, Emmanouil; Srinivasa, Shreyas; Mühlhäuser, Max

doi:10.1109/cns.2015.7346907

Cited by 9 publications

(6 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…ICS-specific honeypots have been developed [7][8][9][10] to understand the origin, frequency, and sophistication of attacks on ICS services. ICS services are popular victims.…”

Section: A Glimpse Into Ics Protocol Securitymentioning

confidence: 99%

Industrial control protocols in the Internet core: Dismantling operational practices

2021

View full text Add to dashboard Cite

Industrial control systems (ICS) are managed remotely with the help of dedicated protocols that were originally designed to work in walled gardens. Many of these protocols have been adapted to Internet transport and support wide-area communication. ICS now exchange insecure traffic on an inter-domain level, putting at risk not only common critical infrastructure but also the Internet ecosystem (e.g., by DRDoS attacks). In this paper, we measure and analyze inter-domain ICS traffic at two central Internet vantage points, an IXP and an ISP. These traffic observations are correlated with data from honeypots and Internet-wide scans to separate industrial from non-industrial ICS traffic. We uncover mainly unprotected inter-domain ICS traffic and provide an in-depth view on Internet-wide ICS communication. Our results can be used (i) to create precise filters for potentially harmful non-industrial ICS traffic and (ii) to detect ICS sending unprotected inter-domain ICS traffic, being vulnerable to eavesdropping and traffic manipulation attacks. Additionally, we survey recent security extensions of ICS protocols, of which we find very little deployment. We estimate an upper bound of the deployment status for ICS security protocols in the Internet core.

show abstract

“…ICS-specific honeypots have been developed [7][8][9][10] to understand the origin, frequency, and sophistication of attacks on ICS services. ICS services are popular victims.…”

Section: A Glimpse Into Ics Protocol Securitymentioning

confidence: 99%

Industrial control protocols in the Internet core: Dismantling operational practices

2021

View full text Add to dashboard Cite

show abstract

“…• Network host information. In [28], a mobile honeypot system for industrial control systems was introduced. This system can be placed in many network locations to provide an additional layer of defense to disrupt attacker's reconnaissance activities.…”

Section: Topology Info Host Info Traffic Infomentioning

confidence: 99%

Cyber Deception for Computer and Network Security: Survey and Challenges

Lu¹,

Wang²,

Zhao³

2020

Preprint

View full text Add to dashboard Cite

Cyber deception has recently received increasing attentions as a promising mechanism for proactive cyber defense. Cyber deception strategies aim at injecting intentionally falsified information to sabotage the early stage of attack reconnaissance and planning in order to render the final attack action harmless or ineffective.Motivated by recent advances in cyber deception research, we in this paper provide a formal view of cyber deception, and review high-level deception schemes and actions. We also summarize and classify recent research results of cyber defense techniques built upon the concept of cyber deception, including gametheoretic modeling at the strategic level, network-level deception, in-host-system deception and cryptography based deception. Finally, we lay out and discuss in detail the research challenges towards developing full-fledged cyber deception frameworks and mechanisms.

show abstract

“…ICS specific honeypots have been developed [6]- [8] to understand the origin, frequency, and sophistication of attacks on ICS services. ICS services are popular victims.…”

Section: Background and Related Work A A Glimpse Into Ics Protocol Se...mentioning

confidence: 99%

Uncovering Vulnerable Industrial Control Systems from the Internet Core

Nawrocki¹,

Schmidt²,

Wählisch³

2019

Preprint

View full text Add to dashboard Cite

Industrial control systems (ICS) are managed remotely with the help of dedicated protocols that were originally designed to work in walled gardens. Many of these protocols have been adapted to Internet transport and support wide-area communication. ICS now exchange insecure traffic on an inter-domain level, putting at risk not only common critical infrastructure, but also the Internet ecosystem (e.g., DRDoS attacks).In this paper, we uncover unprotected inter-domain ICS traffic at two central Internet vantage points, an IXP and an ISP. This traffic analysis is correlated with data from honeypots and Internet-wide scans to separate industrial from non-industrial ICS traffic. We provide an in-depth view on Internet-wide ICS communication. Our results can be used (i) to create precise filters for potentially harmful non-industrial ICS traffic, and (ii) to detect ICS sending unprotected inter-domain ICS traffic, being vulnerable to eavesdropping and traffic manipulation attacks.

show abstract

Did you really hack a nuclear power plant? An industrial control mobile honeypot

Cited by 9 publications

References 4 publications

Industrial control protocols in the Internet core: Dismantling operational practices

Industrial control protocols in the Internet core: Dismantling operational practices

Cyber Deception for Computer and Network Security: Survey and Challenges

Uncovering Vulnerable Industrial Control Systems from the Internet Core

Contact Info

Product

Resources

About