Vulnerability Discovery Method Based on Control Protocol Fuzzing for a Railway SCADA System

Abstract

Key Words : Fuzzing, DNP3, Vulnerability Assessment, Control System Security, SCADA Security ABSTRACT A railway SCADA system is a control systems that provide the trains with the electricity. A railway SCADA system sends commands to the RTUs(remote terminal unit) and then it gathers status information of the field devices in the RTUs or controls field devices connected with the RTUs . The RTU can controls input output modules directly, gathers the status information of the field devices connected with it, and send the information to the control center. In this way, a railway SCADA system monitors and controls the electricity power for running trains. The cyber attackers may use some vulnerabilities in the railway SCADA system software to attack critical infrastructures. The vulnerabilities might be created in the railway software development process.Therefore it need to detect and remove the vulnerabilities in the control system. In this paper we propose a new control protocol fuzzing method to detect the vulnerabilities in the DNP3 protocol based application running on VxWorks in RTU(Remote Terminal Unit) that is a component of the centralized traffic control system for railway. Debug-channel based fuzzing method is required to obtain process status information from the VxWorks

A Test Cases Generation Method for Industrial Control Protocol Test

“…At present, the commonly used vulnerability mining techniques are divided into static analysis, dynamic analysis, binary comparison, fuzzy testing, and so on [6][7][8][9][10][11][12]. Fuzzy testing has the advantages of high automation, low system consumption, low false-alarm rate, and being independent of the source code of the object program [7].…”

The Design of Vulnerability Analysis for Secure Coding of Open Source Software

“…Fuzzing is used in dynamic stage and has two methods in which the data is entered: randomly and orderly. When choosing the data in regards to the software, it is suggested that the data is chosen by considering the characteristics of the related field and the usage of the software as well as the process [5].…”