Cyber-Physical Attacks: A Growing Invisible Threat

261 Pages·2015·6.65 MB·English

by  George Loukas PhD in Network Security Imperial College UK, MEng in Electrical Engineering and Computer Science NTUA Greece

CYBER-PHYSICAL
ATTACKS
CYBER-PHYSICAL
ATTACKS
A Growing Invisible Threat
GEORGE LOUKAS
AMSTERDAM • BOSTON • HEIDELBERG • LONDON • NEW YORK • OXFORD
PARIS • SAN DIEGO • SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO
Butterworth-Heinemann is an imprint of Elsevier
Acquiring Editor: Tom Stover
Editorial Project Manager: Hilary Carr
Project Manager: Punithavathy Govindaradjane
Designer: Matthew Limbert
Butterworth-Heinemann is an imprint of Elsevier
The Boulevard, Langford Lane, Kidlington, Oxford OX5 1GB, UK
225 Wyman Street, Waltham, MA 02451, USA
Copyright r 2015 Elsevier Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means, electronic or
mechanical, including photocopying, recording, or any information storage and retrieval system, without
permission in writing from the publisher. Details on how to seek permission, further information about the
Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance
Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the Publisher
(other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience broaden
our understanding, changes in research methods, professional practices, or medical treatment may
become necessary.
Practitioners and researchers must always rely on their own experience and knowledge in evaluating and
using any information, methods, compounds, or experiments described herein. In using such information
or methods they should be mindful of their own safety and the safety of others, including parties for
whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any
liability for any injury and/or damage to persons or property as a matter of products liability, negligence or
otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the
material herein.
ISBN: 978-0-12-801290-1
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library
Library of Congress Cataloging-in-Publication Data
A catalog record for this book is available from the Library of Congress
For Information on all Butterworth-Heinemann publications
visit our website at http://store.elsevier.com/
Dedication
For Georgia
1
A CYBER-PHYSICAL WORLD
CHAPTER OUTLINE
Basic Concepts and Definitions of a Cyber-Physical World 3
Transducers 4
Controllers 5
Embedded Systems 6
Cyber-Physical Systems 7
The Internet of Things 9
Defining Cyber-Physical Attacks 11
Who Should Read This Book 16
Outline 16
Chapter 1: A Cyber-Physical World 16
Chapter 2: A History of Cyber-Physical Security Incidents 16
Chapter 3: Cyber-Physical Attacks on Implants and Vehicles 17
Chapter 4: Cyber-Physical Attacks on Industrial Control Systems 17
Chapter 5: Cyber-Physical Attack Steps 17
Chapter 6: Protection Mechanisms and Secure Design Principles 17
Chapter 7: Physical-Cyber Attacks 17
Summary 18
Follow-Up Questions and Exercises 18
Chapter Summary
Conventional cyber attacks affect primarily the confidential-
ity, integrity, and availability of data and services in cyberspace.
Cyber-physical attacks are the particular category of cyber
attacks that, whether intentionally or not, also adversely affect
physical space by targeting the computational and communica-
tion infrastructure that allows people and systems to monitor
and control sensors and actuators. This chapter provides a brief
introduction to the concepts and components that bridge
cyberspace with physical space, and defines what is and what is
not a cyber-physical attack in relation to its impact on sensing
and actuation.
Cyber-Physical Attacks.
© 2015 Elsevier Inc. All rights reserved. 1
2 Chapter 1 A CYBER-PHYSICAL WORLD
Key Terms: Actuator; sensor; wireless sensor network; controller;
embedded system; cyber-physical system; Internet of Things;
cyber-physical attack
In the past, it was safe to assume that the primary aim of a
cyber attack would be to cause damage in cyberspace, and of a
physical attack to cause damage in physical space. This is no
longer the case.
Our increasing dependence on computerized and highly net-
worked environments is generating considerable new threats
where the two spaces overlap. For clarity, by physical space, we
refer to the space governed by the laws of physics. Cyberspace
cannot be defined as succinctly. For our purposes, it is a metaphor
referring to the electronic transmission, manipulation, storage,
and retrieval of information in computer systems and networks.
Modern automobiles, smart buildings, wireless implants,
intelligent traffic lights, full-body scanners, and industrial con-
trol systems are realistic targets for an attacker who wants to
cause damage in physical space. An autonomous vehicle that
has been compromised electronically can be used to intercept
communications, transmit false data, launch a cyber attack
from a convenient location, or even drive or fly itself into a
crowd. Because documentation and code for exploiting weak-
nesses of widely used industrial control systems are available
online, a cyber attack against a gas pipeline or water manage-
ment facility may require considerably less planning and
resources than a physical attack with the same aim.
Note that an attack in cyberspace can affect one or more of the
three basic information security attributes collectively known as
the CIA triad: confidentiality, integrity, and availability. In broad
terms, confidentiality ensures that information can be accessed
only by those authorized to access it; integrity ensures that infor-
mation or a system’s configuration can be modified only by those
authorized to modify it; and availability ensures that those autho-
rized to access particular information or a service can indeed
access it when necessary. To these, it is common to add authentic-
ity, accountability, nonrepudiation, and other increasingly
1
overlapping attributes. For the sake of simplicity, throughout
this book we will refer mainly to the CIA triad and occasionally to
authenticity. We will also frequently use five information
security terms: adversary, threat, vulnerability, attack, and
1
Maconachy, W. V., Schou, C. D., Ragsdale, D., and Welch, D. (2001). A model for
information assurance: An integrated approach. In Proceedings of the 2001 IEEE
Workshop on Information Assurance and Security, Volume 310, New York, USA.
Chapter 1 A CYBER-PHYSICAL WORLD 3
Box 1.1 Basic Information Security Terminology
Vulnerability: A flaw or weakness in a system’s design, implementation, operation, or management that could
be exploited to violate the system’s confidentiality, integrity, or availability.
Threat: Any circumstance or event with the potential to exploit a vulnerability and adversely affect a system
through unauthorized access, destruction, disclosure, or modification of data, or denial of service.
Attack: An intentional assault on system security that derives from an intelligent threat. An active attack is
one that attempts to alter system resources or affect their operation, while a passive attack is one that
attempts to learn or make use of information from a system but does not affect that system.
Adversary: An entity that attacks a system or is a threat to a system. The terms “intruder,” “attacker,”
“cyber attacker,” “cracker,” and “hacker” can also be used.
Countermeasure: An action, device, procedure, or technique that meets or opposes (i.e., counters) a threat, a
vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause, or by discovering
and reporting it so that corrective action can be taken.
countermeasure, for which the explanations (following the
2
Internet Engineering Task Force’s Internet Security glossary ) can
be seen in Box 1.1, Basic Information Security Terminology.
Basic Concepts and Definitions
of a Cyber-Physical World
Few like definitions. They can be too specific and limiting, or
so general and vague as to be of little use in practice. Different
schools of thought lead to distinctly different definitions, which
are almost always incomplete. More than anything, definitions
show what the industrial or research team behind each one
considers a challenge and where it has focused its attention.
But that is precisely why they are useful for areas of science and
technology that are new and rapidly changing, currently
expanding their real-world applications and impact to society.
To appreciate and understand how an attack in cyberspace can
have an impact in physical space, it is useful to have a basic
understanding of the devices and systems involved, including
sensors, actuators, controllers, embedded systems, cyber-
physical systems, and recent computing paradigms such as the
Internet of Things. We will use some of the most popular
2Shirey, R. W. (2007). RFC 4949, Internet security glossary, Version 2, IETF.
4 Chapter 1 A CYBER-PHYSICAL WORLD
definitions proposed to describe these, although it is possible
that some of these terms will be out of fashion in the near
future. Nevertheless, they all point toward a world where cyber
and physical spaces meet and new security threats appear
where the two overlap.
Transducers
Computers are designed to generate, manipulate, transmit,
and receive information in the form of pulses of electrical
energy. (For example, a 0 may be represented as a low-voltage
pulse and a 1 as a high-voltage pulse.) To be able to cross the
cyber-physical boundary from information to physical effect
and vice versa, they need transducers, which are devices that
3
can convert between different forms of energy. Within the
scope of this book, we are interested in transducers that can be
classified as sensors or actuators.
Sensors are devices “that transform real-world data into
4
electrical form” for the purpose of measurement or observation
of the physical environment. The quantity, property, or condi-
tion measured is called stimulus or measurand, and can be
acoustic, biological, chemical, electric, magnetic, mechanical,
optical, radiation, or thermal. They may involve a number of
transducers converting energy from one form into another until
one produces an electrical signal that can be interpreted by an
information processing system, such as a computer.
Strictly speaking, a sensor does not need to be a man-made
object. Natural sensors on living organisms can also be
included. For example, at the back of the human eye’s retina
there is a layer of photoreceptors (light-sensitive nerve cells),
5
whose job is to convert light rays into an electrical signal. This
signal is then transmitted through the optic nerve to the brain,
where it is processed and converted into an image. From our
point of view, natural sensors should not be outright excluded
from a discussion on cyber-physical attacks, as it is possible for
an information security breach to lead to a stimulus that can be
intentionally damaging to a human being (see the section,
Health, in Chapter 2).
3
Song, E. Y. and Lee, K. (2008). Understanding IEEE 1451-Networked smart
transducer interface standard—What is a smart transducer? Instrumentation and
Measurement Magazine, IEEE, Volume 11, No. 2, pp. 11 17.
4
Richard, W. M. (1987). A sensor classification scheme. IEEE Transactions on
Ultrasonic, Ferroelectrics, and Frequency Control, Volume 34, No. 2, pp. 124 126.
5
Atchison, D. A. and Smith, G. (2000). Optics of the human eye, Butterworth-
Heinemann.
Chapter 1 A CYBER-PHYSICAL WORLD 5
Thanks to advances in low-cost electronics and a variety of
energy-efficient communication technologies, it is possible to
deploy large numbers of inexpensive sensors that can commu-
nicate and report their measurements through a wireless net-
work. Wireless sensor networks were originally conceived for
military applications, where the sensors would be airdropped
on an otherwise inaccessible terrain and would remotely report
information about the battlefield. Today, they are commonly
used in disaster response, detecting pollutants in the environ-
6
ment, monitoring a smart home, and so on.
Electric actuators are in a sense the reverse of sensors, as
their job is to initiate a physical action when instructed to do so
7
by an electrical signal. For example, in wheeled vehicles, a
rotary encoder is a sensor that measures position or speed by
converting the angular motion of a wheel into an electrical sig-
nal. On the other hand, the electric motor that moves the vehi-
cle is an actuator because it converts electrical energy into
torque (the rotary force) that rotates the wheel. For simplicity in
discussing cyber-physical attacks, we will consider as sensor
any device that can gather information about its physical envi-
ronment (hear a sound, see an image, measure temperature,
detect motion, etc.) and as actuator any device that can initiate
a physical action in its environment (move a lever, close a valve,
switch on a light, turn off a heater, etc.).
Sensors are of interest to cyber attackers because by gaining
access to a computer that controls them, one is able to observe a
remote physical environment. Actuators possibly are of even
greater interest because they allow that physical environment to be
altered.
Controllers
Think of a simple heater with a thermostat. The user sets a tar-
get temperature (the setpoint) and then the thermostat compares
it to the actual temperature sensed and switches the heating on or
off as appropriate. In engineering and mathematics, such devices
that monitor and adjust the operating conditions of dynamical sys-
tems are called controllers. They are the devices that ensure that
an aircraft stays on the predefined flight path set on its autopilot, a
refrigerator maintains a specific temperature, a DVD player’s spin-
ning motor rotates at a precise speed, and an industrial robot
6
Akyildiz, I. F., Su, W., Sankarasubramaniam, Y., and Cayirci, E. (2002). Wireless sensor
networks: a survey. Computer Networks, Volume 38, pp. 393 422.
7
Janocha, H. (2004). Actuators: Basics and Applications, Springer Berlin Heidelberg.
6 Chapter 1 A CYBER-PHYSICAL WORLD
faithfully carries out the same action without losing accuracy and,
above all, safely. Depending on the requirements of the system
that they are tasked to balance, controllers can be on/off (aptly
8
also called bang-bang ), as in the simple thermostat example
above, or continuous, where actuation is not abrupt but depends
on how different the measured value is to the setpoint. An example
of continuous control is a car’s cruise control system, which may
be based on a proportional control scheme, adjusting the throttle
proportionally to the error (the slower the car the more throttle is
needed to reach the desired speed), or more commonly based on a
9
scheme called proportional-integral-derivative control, taking
into account also distance and acceleration.
In practice, controllers create a direct link between sensing
and actuation, which can be exploited by an adversary. An error
in the sensing process, whether natural or the result of an
intentional attack, can lead to undesirable actuation. While
many controllers are mechanical, hydraulic, or pneumatic, our
focus here is on electronic ones based on computers and
embedded systems, where it is software that constantly pro-
cesses the measurements coming from the sensors and deter-
mines the parameters of the actuation.
Embedded Systems
Steve Heath has described an embedded system as “a
microprocessor-based system that is built to control a function
or range of functions and is not designed to be programmed by
10
the end user in the same way that a PC is.” However, techni-
cally every modern PC is based on a microprocessor (a single
chip) as its central processing unit (CPU), and more and more
devices that are not PCs can now be programmed extensively.
(Especially, smart phones and tablets have blurred the lines of
what is and what is not a computer.) Instead, Berkeley’s Edward
A. Lee has focused on the software that they run: “Embedded
software is software that is integrated with physical pro-
11
cesses,” where the technical problem is to cope with
8
LaSalle, J. P. (1960). The “Bang-bang” principle. In Proceedings of the First
International Congress of the International Federation of Automatic Control, Moscow,
Volume 1, pp. 493 497.
9
Ioannou, P., Xu, Z., Eckert, S., Clemons, D., and Sieja, T. (1993). Intelligent cruise
control: theory and experiment. In Proceedings of the 32nd IEEE Conference on
Decision and Control, pp. 1885 1890, IEEE.
10
Heath, S. (2002). Embedded systems design. Newnes.
11
Lee, E. A. (2006). The future of embedded software. In ARTEMIS Conference, Graz,
Austria, May 2006.