Man-in-the-middle attack on SCADA/ICS system
What is SCADA/ICS?
SCADA stands for supervisory control and data acquisition, and it is a software and hardware solution that enables industrial enterprises to:
- Control industrial processes from a central location or from afar.
- Real-time data is monitored, gathered, and processed.
- Human-machine interface (HMI) software allows you to communicate directly with equipment including sensors, valves, pumps, motors, and more.
- Create a log file to keep track of events.
What is a Man-in-the-middle attack?
A man-in-the-middle attack is a form of eavesdropping attack in which an attacker intercepts a conversation or data transfer in progress. The attackers pose as both genuine participants after inserting themselves in the “middle” of the transfer. This allows an attacker to intercept data and information from both parties and perform a variety of malicious tasks.
Now let us come to ICS/SCADA systems and see how this attack can cause widespread damage. Basically, every device is monitored and controlled by an HMI system. You can imagine an HMI like a Computer with a Graphical interface that can change the pressure level of a pump, turn ON/OFF any device, and so on.
Now imagine a scenario where HMI sends a signal to turn OFF any device but the signal is sniffed midway by any attacker and changed the signal to turn ON and then transmitted. This attack can cause mass destruction too.
Lab Setup for the Attack
We are going to simulate an HMI, PLC, and attacker machine on our Local Host. We will be attacking Modbus communication in this practical. Read about Modbus from here (https://en.wikipedia.org/wiki/Modbus).
The setup is shown in the image below.
- HMI: Windows — We have a Windows 7 operating system with Modbus master installed (https://sourceforge.net/projects/qmodmaster/). With this tool, we will be changing the values of the PLC.
- Attacker machine — We will use the Kali Linux machine and Ettercap tool for this demonstration.
- PLC — We can use any distribution for Modbus simulation but we will use an easy pathway. Control Things VM (https://www.controlthings.io/platform) comes with a pre-installed tool called Modbus Pal which helps in the Simulation of Modbus.
Starting the Practical
Get Aijaz Khan’s stories in your inbox
Join Medium for free to get updates from this writer.
Before beginning with the practical make sure that all 3 machines are in the same subnet. Let’s start with setting up our Modbus Simulator which is in our Control Things VM.
- Open your Control Things VM and search for ModbusPal and start it.
2. The Modbus port is usually set to 502 by default. However, we will modify the port to something other than 1000 because the Control Things VM does not operate with root privileges by default, making port 502 inaccessible. Here, we’ll modify the port to 1080. We’ll now add Slaves.
3. We add 3 Coils and add values to the Coil. “1” implies ON and “0” implies OFF.
4. Let’s start the simulator
5. Now that we have set up our Modbus Simulator, we need to connect with it using our HMI. Open your Windows machine and start the Modbus Master application. The Unit ID is set to “1”. Function Code is set to“Write Single Coil (0x05)” and Start Address is set to “0”. The configuration is set up in order to have permission to change the value of Coils.
6. Click on Options > Modbus TCP
7. Connect to the PLC
8. Send Packet to make the value of coil from “1” to “0”.
9. Now let us start our Kali Linux machine for performing the MiTm attack. We will intercept the packet using Ettercap and change it using suitable filters. Start your Ettercap and sniff the traffic and start scanning for Hosts.
10. Now our 2 targets are set. The Attacker workstation then sent falsified ARP packets over a LAN using the MAC addresses obtained from the Ettercap scan for a MITM with ARP poisoning (ARP spoofing). The attacker’s MAC address was linked to the IP address of a genuine machine or server on the network as a result of the ARP spoofing. The Ettercap tool was then used to modify Modbus TCP communications originating from the Master workstation with a destination of the PLC workstation using an Ettercap filter.
11. The below script does 3 things. Isolate TCP protocol with 1080 as the destination port. Search Payload for the Modbus TCP command with the hex value ff00. Modify the Modbus TCP command ff00’s payload to the hex value 0000. We save the file as “mod.filter”. Now we need to use another command to make it Ettercap ready “
12. Now add the Filter that we have created by navigating to Filter > Load a Filter and then select OK.
13. Come over to the HMI machine and send the command to make the value of coil from “0” to “1”. We can see that now the value does not change. This completes our Man in the middle attack on ICS.
