A11 Your PLCs Belong to Me: ICS ransomware is realistic

Yipeng Zhang; Zhonghao Sun; Liqun Yang; Zhoujun Li; Qiang Zeng; Yueying He; Xiaoming Zhang

doi:10.1109/TrustCom50675.2020.00074

A11 Your PLCs Belong to Me: ICS ransomware is realistic

Yipeng Zhang
, Zhonghao Sun
, Liqun Yang
, Zhoujun Li
, Qiang Zeng
, Yueying He
, Xiaoming Zhang

Beihang University
CNCERT/CC
University of South Carolina

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

16 Scopus citations

Abstract

Ransomware is a new business model for cybercrime which mainly targets individual users and machines. Many events have shown how profitable the technique can be. Industrial control systems (ICS) are becoming the next domain. More and more researchers and attackers have become the focus on this field and presented some ICS ransomware. But existing ICS ransomware is theoretically feasible and has a limited effect on real ICS. In this work, we present ICS-BROCK, a full-fledged ICS ransomware that can compromise a real-world. To demonstrate the capability of ICS-BROCK, we use SIEMENS S7-300 PLC, one of the most widely used devices in ICSs, to build a real water treatment environment. The results empirically demonstrate the feasibility of launching ICS ransomware attacks in a practical setting. In the end, we give some suggestions on ICS ransomware to aid in future study and defenses.

Original language	English
Title of host publication	Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020
Editors	Guojun Wang, Ryan Ko, Md Zakirul Alam Bhuiyan, Yi Pan
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	502-509
Number of pages	8
ISBN (Electronic)	9781665403924
DOIs	https://doi.org/10.1109/TrustCom50675.2020.00074
State	Published - Dec 2020
Event	19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020 - Guangzhou, China Duration: 29 Dec 2020 → 1 Jan 2021

Publication series

Name	Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020

Conference

Conference	19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020
Country/Territory	China
City	Guangzhou
Period	29/12/20 → 1/01/21

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 16 Peace, Justice and Strong Institutions

Keywords

ICS protocol analysis
ICS security
PLC
Physical isolation
Ransomware

Access to Document

10.1109/TrustCom50675.2020.00074

Cite this

Zhang, Y., Sun, Z., Yang, L., Li, Z., Zeng, Q., He, Y., & Zhang, X. (2020). A11 Your PLCs Belong to Me: ICS ransomware is realistic. In G. Wang, R. Ko, M. Z. A. Bhuiyan, & Y. Pan (Eds.), Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020 (pp. 502-509). Article 9343036 (Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/TrustCom50675.2020.00074

Zhang, Yipeng ; Sun, Zhonghao ; Yang, Liqun et al. / A11 Your PLCs Belong to Me : ICS ransomware is realistic. Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020. editor / Guojun Wang ; Ryan Ko ; Md Zakirul Alam Bhuiyan ; Yi Pan. Institute of Electrical and Electronics Engineers Inc., 2020. pp. 502-509 (Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020).

@inproceedings{b3518b1f97df4e9e84d48977d329fb10,

title = "A11 Your PLCs Belong to Me: ICS ransomware is realistic",

abstract = "Ransomware is a new business model for cybercrime which mainly targets individual users and machines. Many events have shown how profitable the technique can be. Industrial control systems (ICS) are becoming the next domain. More and more researchers and attackers have become the focus on this field and presented some ICS ransomware. But existing ICS ransomware is theoretically feasible and has a limited effect on real ICS. In this work, we present ICS-BROCK, a full-fledged ICS ransomware that can compromise a real-world. To demonstrate the capability of ICS-BROCK, we use SIEMENS S7-300 PLC, one of the most widely used devices in ICSs, to build a real water treatment environment. The results empirically demonstrate the feasibility of launching ICS ransomware attacks in a practical setting. In the end, we give some suggestions on ICS ransomware to aid in future study and defenses.",

keywords = "ICS protocol analysis, ICS security, PLC, Physical isolation, Ransomware",

author = "Yipeng Zhang and Zhonghao Sun and Liqun Yang and Zhoujun Li and Qiang Zeng and Yueying He and Xiaoming Zhang",

note = "Publisher Copyright: {\textcopyright} 2020 IEEE.; 19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020 ; Conference date: 29-12-2020 Through 01-01-2021",

year = "2020",

month = dec,

doi = "10.1109/TrustCom50675.2020.00074",

language = "英语",

series = "Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "502--509",

editor = "Guojun Wang and Ryan Ko and Bhuiyan, \{Md Zakirul Alam\} and Yi Pan",

booktitle = "Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020",

address = "美国",

}

Zhang, Y, Sun, Z, Yang, L , Li, Z, Zeng, Q, He, Y & Zhang, X 2020, A11 Your PLCs Belong to Me: ICS ransomware is realistic. in G Wang, R Ko, MZA Bhuiyan & Y Pan (eds), Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020., 9343036, Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020, Institute of Electrical and Electronics Engineers Inc., pp. 502-509, 19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020, Guangzhou, China, 29/12/20. https://doi.org/10.1109/TrustCom50675.2020.00074

A11 Your PLCs Belong to Me: ICS ransomware is realistic. / Zhang, Yipeng; Sun, Zhonghao; Yang, Liqun et al.
Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020. ed. / Guojun Wang; Ryan Ko; Md Zakirul Alam Bhuiyan; Yi Pan. Institute of Electrical and Electronics Engineers Inc., 2020. p. 502-509 9343036 (Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - A11 Your PLCs Belong to Me

T2 - 19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020

AU - Zhang, Yipeng

AU - Sun, Zhonghao

AU - Yang, Liqun

AU - Li, Zhoujun

AU - Zeng, Qiang

AU - He, Yueying

AU - Zhang, Xiaoming

PY - 2020/12

Y1 - 2020/12

N2 - Ransomware is a new business model for cybercrime which mainly targets individual users and machines. Many events have shown how profitable the technique can be. Industrial control systems (ICS) are becoming the next domain. More and more researchers and attackers have become the focus on this field and presented some ICS ransomware. But existing ICS ransomware is theoretically feasible and has a limited effect on real ICS. In this work, we present ICS-BROCK, a full-fledged ICS ransomware that can compromise a real-world. To demonstrate the capability of ICS-BROCK, we use SIEMENS S7-300 PLC, one of the most widely used devices in ICSs, to build a real water treatment environment. The results empirically demonstrate the feasibility of launching ICS ransomware attacks in a practical setting. In the end, we give some suggestions on ICS ransomware to aid in future study and defenses.

AB - Ransomware is a new business model for cybercrime which mainly targets individual users and machines. Many events have shown how profitable the technique can be. Industrial control systems (ICS) are becoming the next domain. More and more researchers and attackers have become the focus on this field and presented some ICS ransomware. But existing ICS ransomware is theoretically feasible and has a limited effect on real ICS. In this work, we present ICS-BROCK, a full-fledged ICS ransomware that can compromise a real-world. To demonstrate the capability of ICS-BROCK, we use SIEMENS S7-300 PLC, one of the most widely used devices in ICSs, to build a real water treatment environment. The results empirically demonstrate the feasibility of launching ICS ransomware attacks in a practical setting. In the end, we give some suggestions on ICS ransomware to aid in future study and defenses.

KW - ICS protocol analysis

KW - ICS security

KW - PLC

KW - Physical isolation

KW - Ransomware

UR - https://www.scopus.com/pages/publications/85101201949

U2 - 10.1109/TrustCom50675.2020.00074

DO - 10.1109/TrustCom50675.2020.00074

M3 - 会议稿件

AN - SCOPUS:85101201949

T3 - Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020

SP - 502

EP - 509

BT - Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020

A2 - Wang, Guojun

A2 - Ko, Ryan

A2 - Bhuiyan, Md Zakirul Alam

A2 - Pan, Yi

PB - Institute of Electrical and Electronics Engineers Inc.

Y2 - 29 December 2020 through 1 January 2021

ER -

Zhang Y, Sun Z, Yang L , Li Z, Zeng Q, He Y et al. A11 Your PLCs Belong to Me: ICS ransomware is realistic. In Wang G, Ko R, Bhuiyan MZA, Pan Y, editors, Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020. Institute of Electrical and Electronics Engineers Inc. 2020. p. 502-509. 9343036. (Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020). doi: 10.1109/TrustCom50675.2020.00074

A11 Your PLCs Belong to Me: ICS ransomware is realistic

Abstract

Publication series

Conference

UN SDGs

Keywords

Access to Document

Other files and links

Fingerprint

Cite this