Day 23: Common SCADA Attacks

Network Attacks

• Service & Application Vulnerabilities
• Brute-force Attacks (Logins and Hashes)
• Pass-the-hash
• Sniffing cleartext password exchanges
• MITM
• Denial of Service incl. Distributed Attacks
• Packet Injection
• Route Spoofing
• DNS Poisoning
• Session Hijacking
• VLAN hopping
• Spanning Tree Attacks
• VLAN Trunking Attacks

Web Attacks

• Source code modification
• Plugin & Extension Attacks
• Remote and Local File Inclusion
• XSS
• SQLi
• CSRF
• Browser Attacks

Workstations and Servers

• Device driver attacks
• Cold Boot Attacks
• Password & hash extraction/cracking
• Sinkhole Attacks

Binary and Application Attacks

• Buffer & Stack Overflows
• Format String Exploits
• Input Validation Attacks
• Use-After-Free
• Integer Overflow/Underflow
• Dangling Pointer Attacks
• Off by one attacks
• Ret 2 attacks

User Attacks

• Spear Phishing & Phishing
• Social Engineering

We will be digging into a lot of these topics over the coming weeks so if you are unfamiliar with a few of them don’t worry, try googling in the mean time. My favourites are binary/application and network attacks. To learn more about the basics of these kinds of attacks on SCADA systems, I recommend the following book to get you started:

Hacking Exposed Industrial Control Systems: ICS and SCADA Security Secrets & Solutions