SimaticScan: Towards A Specialised Vulnerability Scanner for Industrial Control Systems
SimaticScan: Towards A Specialised Vulnerability Scanner for Industrial Control Systems
复制标题
DOI：
10.14236/ewic/ics2016.2
复制
发表时间：
2016-08
期刊：
影响因子：
--
通讯作者：
Rob Antrobus;Sylvain Frey;A. Rashid;B. Green
中科院分区：
文献类型：
--
作者：
Rob Antrobus;Sylvain Frey;A. Rashid;B. Green
多年来，现代工业控制系统 (ICS) 已广泛计算机化并通过互联网连接，因此很容易受到网络攻击。目前缺乏专门针对 ICS 设置的漏洞扫描程序。 PLCScan 和 ModScan 等系统从可编程逻辑控制器 (PLC) 输出相关信息。然而，他们没有提供任何关于 PLC 容易受到攻击的信息。在本文中，我们解决了这些限制并提出了 SimaticScan，这是一种专门针对西门子 SIMATIC PLC 的漏洞扫描器。通过在综合水处理测试台上进行实验，我们证明了 SimaticScan 在确定三个不同 PLC 中的一系列漏洞方面的有效性，其中包括其中一个 PLC 中以前未知的漏洞。我们的实验还表明，SimaticScan 的性能优于广泛使用的 Nessus 漏洞扫描器（部署了相关的 ICS 特定插件）。
Over the years, modern Industrial Control Systems (ICS) have become widely computerised and connected via the Internet and are, therefore, potentially vulnerable to cyber attacks. Currently there is a lack of vulnerability scanners specialised to ICS settings. Systems such as PLCScan and ModScan output pertinent information from a Programmable Logic Controller (PLC). However, they do not offer any information as to how vulnerable a PLC is to an attack. In this paper, we address these limitations and propose SimaticScan, a vulnerability acanner specialised to Siemens SIMATIC PLCs. Through experimentation in a comprehensive water treatment testbed, we demonstrate SimaticScan's effectiveness in determining a range of vulnerabilities across three distinct PLCs, including a previously unknown vulnerability in one of the PLCs. Our experiments also show that SimaticScan outperforms the widely used Nessus vulnerability scanner (with relevant ICS-specific plugins deployed).