隨著工業4.0的趨勢，資訊科技與營運科技的融合，使得乙太網路於工業控制系統中越來越普遍，由於如水壩等影響力極大的關鍵基礎設施也廣泛使用了工業控制系統，然而工業控制系統羸弱的資訊安全能力為其帶來嚴重資安威脅，因此其中的資安議題不容忽視。本研究先介紹了當前的工業控制系統與可程式邏輯控制器之相關知識與研究，對可程式邏輯控制器中的安全功能提出看法，再來透過國內某水壩所汰換下來的設備組建了一個水資源關鍵基礎設施資安測試平台，並在其中進行了可程式邏輯控制器的攻擊實驗，先藉由偵查攻擊得出了可程式邏輯控制器的製造商、型號以及服務，並透過MODBUS TCP協定對可程式邏輯控制器進行命令注入攻擊，最後是利用可程式邏輯控制器未啟用安全功能的弱點，讀取其軟硬體配置資訊以及當中的程式碼，覆寫其暫存器、輸入、輸出的值，甚至能線上修改其程式碼。

This paper first introduces the relevant knowledge and research of current industrial control system(ICS) and programmable logic controllers(PLC), and sorts out the related research on the attack, defense, and testbed of ICS. Besides, this paper plans and builds a water crucial infrastructure testbed based on a reservoir’s equipment obtained from Water Resources Agency in Taiwan. This paper also proposes the possible attacks and risks on PLC, and then implements and analyzes the possible attacks and risks on PLC on the testbed.

[1] Alp Ustundag, Emre Cevikcan, Industry 4.0: Managing The Digital Transformation, Springer International Publishing, 2017.
[2] Alex Marquardt, Eric Levenson, Amir Tal, “Florida water treatment facility hack used a dormant remote access software, sheriff says,” 2021. [Online]. Available: https://edition.cnn.com/2021/02/10/us/florida-water-poison-cyber/index.html. [Accessed 2 6 2021].
[3] Cybersecurity and Infrastructure Security Agency, “Cyber-Attack Against Ukrainian Critical Infrastructure,” 2018. [Online]. Available: https://us-cert.cisa.gov/ics/alerts/IR-ALERT-H-16-056-01. [Accessed 7 5 2021].
[4] TSMC, “TSMC Details Impact of Computer Virus Incident,” 2018. [Online]. Available: https://pr.tsmc.com/english/news/1969. [Accessed 15 12 2020].
[5] Keith Stouffer, Victoria Pillitteri, Suzanne Lightman, Marshall Abrams, Adam Hahn, “Guide to Industrial Control Systems (ICS) Security (NIST Special Publication 800-82 Revision 2),” 2015. [Online]. Available: http://dx.doi.org/10.6028/NIST.SP.800-82r2. [Accessed 24 6 2021].
[6] Theodore J.Williams, “The Purdue enterprise reference architecture,” Computers in Industry, vol. 24, no. 2-3, pp. 141-158, 1994.
[7] International Society of Automation, “ISA95, Enterprise-Control System Integration,” 2021. [Online]. Available: https://www.isa.org/standards-and-publications/isa-standards/isa-standards-committees/isa95. [Accessed 8 6 2021].
[8] International Electrotechnical Commission, Industrial communication networks - Network and system security - Part 1-1: Terminology, concepts and models (IEC 62443-1-1), International Electrotechnical Commission, 2009.
[9] William Knowles, Daniel Prince, David Hutchison, Jules Ferdinand Pagna Disso, Kevin Jones, “A survey of cyber security management in industrial control systems,” International Journal of Critical Infrastructure Protection, vol. 9, pp. 52-80, 6 2015.
[10] Paul Didier, Fernando Macias, James Harstad, Rick Antholine, Scott A. Johnston, Sabina Piyevsky, Mark Schillace, Gregory Wilcox, Dan Zaniewski, Steve Zuponcic, “Converged Plantwide Ethernet (CPwE) Design and Implementation Guide,” 2011. [Online]. Available: https://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td001_-en-p.pdf. [Accessed 15 6 2021].
[11] Daniel DesRuisseaux, “Practical Overview of Implementing IEC 62443 Security Levels in Industrial Control Applications,” 2018. [Online]. Available: https://download.schneider-electric.com/files?p_Doc_Ref=998-20186845. [Accessed 23 6 2021].
[12] 維基百科, “可程式化邏輯控制器,” 2020. [Online]. Available: https://zh.wikipedia.org/zh-tw/可编程逻辑控制器. [Accessed 12 6 2021].
[13] Mordor Intelligence, “PROGRAMMABLE LOGIC CONTROLLER (PLC) MARKET - GROWTH, TRENDS, COVID-19 IMPACT, AND FORECASTS (2021 - 2026),” 2021. [Online]. Available: https://www.mordorintelligence.com/industry-reports/programmable-logic-controller-plc-market. [Accessed 20 6 2021].
[14] Ladder Logic World, “PLC Manufacturers: The Latest PLC Brands, Rankings & Revenues,” 2021. [Online]. Available: https://ladderlogicworld.com/plc-manufacturers/. [Accessed 14 6 2021].
[15] Siemens, “SIMATIC S7-1500, ET 200MP Automation system,” Siemens, 5 11 2019. [Online]. Available: https://support.industry.siemens.com/cs/attachments/59191792/s71500_et200mp_system_manual_en-US_en-US.pdf. [Accessed 15 9 2020].
[16] Mitsubishi Electric, “MELSEC iQ-F FX5U User's Manual (Hardware),” 2021. [Online]. Available: https://no3a.mitsubishielectric.com/fa/no/dl/11209/JY997D55301-F.pdf. [Accessed 24 6 2021].
[17] Siemens, “SIMATIC NET: Industrial Ethernet/PROFINET Industrial Ethernet,” Siemens, 9 2019. [Online]. Available: https://support.industry.siemens.com/cs/attachments/27069465/SYH_IE-Net_76.pdf. [Accessed 15 9 2020].
[18] C.-L. P. Association, “CC-Link IE TSN Installation Manual,” 4 2019. [Online]. Available: https://www.cc-link.org/en/support/material/documents/bap-c3007eng-001-a.pdf. [Accessed 15 9 2020].
[19] DELTA, “EtherNet/IP Operation Manual,” DELTA, 13 5 2019. [Online]. Available: https://filecenter.deltaww.com/Products/download/06/060301/Manual/DELTA_IA-PLC_EtherNet-IP_OP_EN_20190513.pdf. [Accessed 15 9 2020].
[20] Modbus Organization, “MODBUS MESSAGING ON TCP/IP IMPLEMENTATION GUIDE v1.0b,” Modbus Organization, Hopkinton, 2006.
[21] Modbus Organization, “MODBUS APPLICATION PROTOCOL SPECIFICATION V1.1b3,” Modbus Organization, Hopkinton, 2012.
[22] Sajid Nazir, Shushma Patel, Dilip Patel, “Assessing and augmenting SCADA cyber security: A survey of techniques,” Computers & Security, vol. 70, pp. 436-454, 2017.
[23] Amin Hassanzadeh, Shimon Modi, Shaan Mulchandani, “Towards effective security control assignment in the Industrial Internet of Things,” 2015 IEEE 2nd World Forum on Internet of Things (WF-IoT), Milan, Italy, 14-16 Dec, 2015.
[24] CYBERX, “2019 GLOBAL ICS & IIoT RISK REPORT,” CYBERX, Waltham, USA, 2019.
[25] Chen Fradkin, “CLAROTY BIANNUAL ICS RISK & VULNERABILITY REPORT: 1H 2020,” Claroty, New York City, USA, 2020.
[26] Chen Fradkin, “CLAROTY BIANNUAL ICS RISK & VULNERABILITY REPORT: 2H 2020,” Claroty, New York City, USA, 2021.
[27] Derui Ding, Qing-Long Han, Yang Xiang, Xiaohua Ge, Xian-Ming Zhang, “A survey on security control and attack detection for industrial cyber-physical systems,” Neurocomputing, vol. 275, pp. 1674-1683, 2018.
[28] Bonnie Zhu, Anthony Joseph, Shankar Sastry, “A Taxonomy of Cyber Attacks on SCADA Systems,” 2011 International Conference on Internet of Things and 4th International Conference on Cyber, Physical and Social Computing, Dalian, China, 19-22 Oct. , 2011.
[29] Thomas H. Morris, Wei Gao, “Industrial Control System Cyber Attacks,” 1st International Symposium for ICS & SCADA Cyber Security Research 2013 (ICS-CSR 2013) (ICSCSR), Leicester, UK, 16-17 Sep., 2013.
[30] Chih-Ta Lin, Sung-Lin Wu and Mei-Lin Lee, “Cyber attack and defense on industry control systems,” 2017 IEEE Conference on Dependable and Secure Computing, Taipei, Taiwan, 7-10 Aug., 2017.
[31] Saurabh Amin, Xavier Litrico, Shankar Sastry, Alexandre M. Bayen, “Cyber Security of Water SCADA Systems—Part I: Analysis and Experimentation of Stealthy Deception Attacks,” IEEE Transactions on Control Systems Technology, vol. 21, no. 5, pp. 1963-1970, 2013.
[32] Andres Robles-Durazno, Naghmeh Moradpoor, James McWhinnie, Gordon Russell, Inaki Maneru-Marin, “PLC memory attack detection and response in a clean water supply system,” International Journal of Critical Infrastructure Protection, vol. 26, 2019.
[33] Zachry Basnight, Jonathan Butts, Juan Lopez Jr., Thomas Dube, “Firmware modification attacks on programmable logic controllers,” International Journal of Critical Infrastructure Protection, vol. 6, no. 2, pp. 76-84, 2013.
[34] Marco Caselli, Emmanuele Zambon, Frank Kargl, “Sequence-aware Intrusion Detection in Industrial Control Systems,” CPSS '15: Proceedings of the 1st ACM Workshop on Cyber-Physical System Security, Singapore, Republic of Singapore, 14 Mar., 2015.
[35] Hamid Reza Ghaeini, Nils Ole Tippenhauer, “HAMIDS: Hierarchical Monitoring Intrusion Detection System for Industrial Control Systems,” CPS-SPC '16: Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy, Vienna, Austria, 28 Oct., 2016.
[36] Jeyasingam Nivetha, ‪Mauricio Papa‬, “On the use of open-source firewalls in ICS/SCADA systems,” Information Security Journal: A Global Perspective, vol. 25, no. 1-3, pp. 83-93, 2016. ‬‬‬‬
[37] Jeyasingam Nivethan, Mauricio Papa, “A Linux-based firewall for the DNP3 protocol,” 2016 IEEE Symposium on Technologies for Homeland Security (HST), Waltham, MA, USA, 10-11 May, 2016.
[38] Dong Li, Huaqun Guo, Jianying Zhou, Luying Zhou, Jun Wen Wong, “SCADAWall: A CPI-enabled firewall model for SCADA security,” Computers & Security, vol. 80, pp. 134-154, 2019.
[39] Qais Qassim, Norziana Jamil, Izham Zainal Abidin, Mohd. Ezanee Rusli, Salman Yussof, Roslan Ismail, Fairuz Abdullah, Norhamadi Ja’afar, Hafizah Che Hasan, Maslina Daud, “A Survey of SCADA Testbed Implementation Approaches,” Indian journal of science and technology, vol. 10, no. 26, 2017.
[40] Yangyang Geng, Yi Wang, Wenwen Liu, Qiang Wei1, Ke Liu, Haolan Wu, “A survey of industrial control system testbeds,” IOP Conference Series: Materials Science and Engineering, vol. 569, no. 4, 2019.
[41] Kenneth Barnes, Briam Johnson, “National SCADA Test Bed Substation Automation Evaluation Report,” 2009. [Online]. Available: https://doi.org/10.2172/968658. [Accessed 13 6 2021].
[42] Aditya P. Mathur, Nils Ole Tippenhauer, “SWaT: a water treatment testbed for research and training on ICS security,” 2016 International Workshop on Cyber-physical Systems for Smart Water Networks (CySWater), Vienna, Austria, 11-11 Apr., 2016.
[43] Siemens, “Security with SIMATIC S7-Controller,” Siemens, 2016. [Online]. Available: https://support.industry.siemens.com/cs/attachments/90885010/77431846_Security_SIMATIC_DOKU_V20_en.pdf. [Accessed 15 9 2020].
[44] Mitsubishi Electric, “GX Works3 Operating Manual,” 2021. [Online]. Available: https://dl.mitsubishielectric.com/dl/fa/document/manual/plc/sh081215eng/sh081215engad.pdf. [Accessed 20 6 2021].
[45] Schneider Electric, “EcoStruxure Machine Expert Programming Guide,” 2021. [Online]. Available: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000002854.02.pdf&p_Doc_Ref=EIO0000002854. [Accessed 21 6 2021].
[46] Gordon Lyon, “Nmap: the Network Mapper - Free Security Scanner,” 2021. [Online]. Available: https://nmap.org/. [Accessed 23 4 2021].
[47] Gerald Combs, “Wireshark,” 2021. [Online]. Available: https://www.wireshark.org/. [Accessed 23 3 2021].
[48] Dug Song, “dsniff,” 2000. [Online]. Available: https://www.monkey.org/~dugsong/dsniff/.
[49] 南樺電機有限公司, “Modbus TCP 1.2.5 測試軟體,” 2008. [Online]. Available: https://ebook.yourplc.net/modules/wfdownloads/singlefile.php?cid=11&lid=104. [Accessed 16 11 2020].
[50] Salvatore Sanfilippo, “Hping - Active Network Security Tool,” 2006. [Online]. Available: http://www.hping.org/. [Accessed 29 6 2021].
[51] Schneider Electric, “TwidoSuite,” 2020. [Online]. Available: https://www.se.com/il/en/product-range/1453-twidosuite/. [Accessed 25 7 2020].
[52] Kuan-Ming Su, I-Hsien Liu, Jung-Shian Li, “The Security Challenges with The Widespread Use of IT Infrastructure in ICS,” The 2021 International Conference on Artificial Life and Robotics (ICAROB2021), Hiroshima, Japan, 21-24 Jan., 2021.
[53] I-Hsien Liu, Kuan-Ming Su, Jung-Shian Li, “The Security Issue of ICS: The Use of IT Infrastructure,” Journal of Robotics, Networking and Artificial Life, vol. 8, no. 1, pp. 29-32, 2021.
[54] Kuan-Ming Su, I-Hsien Liu, Jung-Shian Li, “The Risk of Industrial Control System: Programmable Logic Controller Default Configurations,” 2020 International Computer Symposium (ICS), Tainan, Taiwan, 17-19 Dec., 2020.