1 Introduction

A cyber-physical system (CPS)  [30] consists of a physical process controlled through a computation and communication infrastructure. CPSs have become ubiquitous in modern life, e.g., software controlling cars, airplanes, and even critical public infrastructure such as water treatment plants and railways. A CPS is often a complex engineering system that integrates embedded computing technology into the physical phenomena. For example, in an energy storage system (ESS), a programmable logic controller (PLC)/embedded controller may start the charging process of the ESS during energy surplus. However, the charging process must be stopped when the ESS reaches a predetermined state-of-charge (SOC) limit. The SOC of the ESS is usually computed by the PLC using various sensors such as voltage, current, and temperature. The PLCs/controllers in a CPS can be viewed as a system that transforms the state of the process. At any instant, the PLCs receive data from sensors, compute the control actions, and apply these actions to specific devices. In an ESS, the actuators include bidirectional power electronic converters and circuit breakers, while the sensors include voltage, current, and temperature sensors.

Power systems and smart-grids are often geographically spread and require intelligent control to operate. Automation increases the vulnerability of the system to cyber-attacks  [6, 33]. Many government agencies such as Homeland security and ICS-CERT reported  [23] attacks against power systems. Researchers are investigating the current and future challenges in smart-grid security  [38] and focusing on the importance of cyber-security in smart-grid systems. Grid modernization to realize smart-grid scenarios could only be effective  [56] if the overall system’s safety from cyber-security perspective is satisfied. Many research efforts utilizing real-time digital simulators  [20] are being carried out across the world. However, in terms of implementation/translation of developed technologies, it is important to evaluate the defense mechanisms in a physical testbed  [4, 12].

The need for studying the inherent differences between the theoretical and actual industrial-grade systems motivated us to study the security of a physical smart-grid system developed based on modern industrial standards and contribute to the existing work. This work is an attempt to identify common vulnerabilities that may be overlooked due to a standard operating procedure in smart-grid domain. Note that a well-known vulnerability in network safety might be overlooked in a CPS environment as the upgrading process is usually less frequent. Hence, it is important to evaluate the impact of cyber-attacks and demonstrate these in a testbed.

Contributions: (a) Experimental investigation into the exploitation of vulnerabilities in the Electric Power and Intelligent Control (EPIC) testbed. (b) Design and launch of attacks using multiple procedures. (c) Analysis of the impact of attacks on EPIC.

Novelty: Attacks reported in the literature focus primarily on transmission systems, loss of a line that can create undesirable loading on remaining lines and generators, automatic generation controllers (AGC)   [31, 39], etc. Little attention has been paid to the distribution systems or the individual components that are more vulnerable than the highly secured transmission systems. For example, to the best of our knowledge, the possibility of attack scenarios on commonly used renewable energy inverters through a conventional home personal computer (PC) is not reported in the literature. This paper demonstrates that such overlooked common vulnerabilities could be effectively used to attack smart-grids, particularly the distribution systems having multiple energy sources.

Further, for an adversary to cause impact on the operation, it is essential to have both network and process vulnerabilities. Lack of anyone would result in an attack that does not benefit the attacker. For example, the popular Stuxnet  [29] was successful because the acceleration resulted in degradation of the centrifuges; if the acceleration were not to cause machine degradation, the attack would have been a harmless intrusion. In this paper, we investigate both network and process vulnerabilities to design attacks. Note that a network vulnerability might be a reported CVE (common vulnerabilities and exposures) or a never reported zero day vulnerability.

Organization The remainder of this work is organized as follows: Preliminaries and background details are discussed in Sect. 2. Attack design is described in Sect. 3. Section 4 presents the architecture of EPIC—an industrial-grade smart-grid testbed. Vulnerabilities in EPIC are detailed in Sect. 5. Attacks on circuit breakers and power settings are presented in Sects. 6 and 7, respectively. Section 8 presents the malicious power generation attack.Footnote 1 Discussion on experiments and analysis of reported attacks is presented in Sect. 9. Related work and conclusions are discussed in Sects. 10 and 11, respectively.

2 Preliminaries and background

This section introduces the context in which the problem is studied, smart-grid environment, the possibility of modifying control logic in PLCs and how to launch attacks using PLC logic manipulation, modification of SMA portal settings, modification of communication channel, and vulnerability assessment in an Industrial Control System (ICS).

2.1 Problem context

Power supply is crucial for the effective operation of many sectors such as manufacturing, health care, building management, and water systems. Furthermore, a major portion of the transportation network is already electrified, e.g., in metro rail systems or in the process of electrification, e.g., electric vehicles   [65]. Hence, an interruption in the power supply would have a hazardous impact on the overall operation of any residential, industrial, and commercial ecosystem  [60]. The impacts of power supply interruption attacks have been realized in the recent cyber incidents such as the Ukraine power blackout  [33] which affected over 200,000 civilians. The economic impact of power supply interruption on industrial sectors could be correlated from regular load shedding process in developing countries  [3, 9]. Though these interruptions are not due to cyber-attacks a similar, if not more, impact is expected.

Attacks on power supply availability could be even more fatal when they affect the health sector, as most of the medical devices as well as storage of medicines often need uninterrupted power supply  [19]. Other sectors such as water distribution, transportation, and communications are also inter-dependent on the power supply availability  [54]. Given the ability to interrupt the power supply, an attacker could either carry out attacks resulting in major blackout such as the Ukraine power blackout   [33] or can even target individual organizations. For example, a power supply interruption attack on the data centers  [24] serving a financial sector could cause chaos in finance and business sectors  [54].

A simple power supply interruption attack to a single high-rise residential building could affect the occupants with lack of water supply (operation of the overhead water pump needs electricity), communications, etc. This simple power supply interruption would result in approximately S$790Footnote 2 loss for the utility company for a single building in addition to any regulatory fines. Given the above scenarios, it is important to investigate the power supply interruption attacks on ICS found in common systems such as industries, commercial buildings, and residential buildings.

Malicious power generation It is a special class of attack which can be defined as the attack that affects the normal operation of power generation by a given set of generators, in such a manner that the balance is affected in multiple aspects. For example, if two generators are designed to supply equal power, the attack can target to modify the balance say to 75:25. In doing so, the attacker can (1) increase the losses (as higher current is flowing in one generator), (2) increase the aging factor of the overloaded generator, (3) increase the wear and tear of the overloaded generator and hence the maintenance schedule, and (4) finally, create an unexpected trip (power supply interruption) during peak load conditions.

Note that aging of any electrical equipment is linked to its loading level and has a nonlinear relationship; the higher the loading, the faster would be the aging. For example, IEEE standard C57.91-1995 and later versions provide detailed information on loading and its relation to the aging process for transformers.

2.2 Smart-grids

Though there is no widely agreed upon definition of smart-grid, a generally accepted description is “an electricity supply network that uses digital communication technologies to detect and react to local changes in usage.” Hence, a smart-grid would have components enabled with information and communication technologies (ICT). The ICT and intelligence could be effectively used to increase the robustness, efficiency, etc. For example, in a conventional grid, during peak hours, the only way to manage the generation-demand balance is to generate as much energy as needed, possibly resulting in higher losses. In the case of smart-grids, ICT together with intelligence could be used to shift the non-critical load to off-peak periods and hence reduce the losses. A high-level architecture of a smart-grid is shown in Fig. 1; it can be observed that the smart-grid contains multiple interacting components. The interactions between individual sources/loads at the residential level to the bulk power operation level introduce vulnerabilities that were nonexistent, or not common, prior to the advent of smart-grids.

Fig. 1
figure 1

Electric power distribution system architecture [15]. Aggregators for distributed generation and electric vehicles, bulk energy storage connected to distribution system operator, and its interaction with bulk power system operator can be observed

Full size image

Communication structure in smart-grids Smart grid usually consists of distributed control systems ranging from home energy management systems (HEMS) to distribution energy management system   [55]. The control system itself is a collection of PLCs, each controlling a specific portion of the physical process. State of the physical process is collected by sensors and sent to the controller (PLC). Based on the control logic in PLC, it takes the decision regarding actuator commands, which is forwarded to the actuators. Each PLC communicates with a set of sensors and actuators via a local network using a multilayer network that is also referred to as the field bus network  [61].

Power systems There are various terminologies in the study of power systems; however, for this study, it is important to know what are apparent power, real power, and reactive power, and their relationship with voltage and frequency. The choice of apparent power (\(S_n\)) is important in the design of electrical equipment; apparent power can be considered equivalent to the physical limit or maximum capacity. The apparent power has two components, namely real power (\(P_n\)) and reactive power (\(Q_n\)), represented as \(S_n=P_n+jQ_n\). This relationship among apparent, real, and reactive power is shown in Fig. 2 as the power triangle.

Fig. 2
figure 2

Power triangle relating apparent power to active (real) power and reactive power (Pythagorean theorem)

Full size image

Mismatch in power generated and consumed may lead to instability. Mismatch in real power causes frequency stability-related issues, whereas reactive power mismatch causes voltage stability-related issues  [59]. Decreasing the real power leads to frequency drop while increasing the real power leads to an increase in frequency. Reactive power consumption would result in a voltage drop, and reactive power injection would result in a rise in voltage.

2.3 Control logic modification

A PLC includes firmware and control logic, where changes to the firmware are protected with hashing algorithms and digital signatures. However, control logic modifications in most cases are not protected by any measure  [18]. Thus, an attacker could tamper with the PLC control logic either by gaining physical access to it or over the network.

Access to the PLC logic and the ability to modify the control logic offer an attacker direct physical access or access to a network. When an attacker has access to the development software, the attacker can upload the modified control logic into the PLC or download the original version from it  [69]. The intent of an attacker might be to launch a denial of service attack or to compromise the sensor and actuator readings  [18] in the PLC logic. Even though it might be considered straightforward to identify whether an attacker can get into the system, exploring the capabilities is essential for the design of defense strategies. Hence, using an operational smart-grid, this paper explores the capabilities of an attacker upon entry.

Denial of service attack By adding a piece of code in the ladder logic of a PLC program, the PLC could be thrown out of control or stopped. It eventually damages the process being controlled by the particular PLC. The malicious code sometimes brings the PLC state into an infinite loop; in this case, the PLC is inactive in controlling the concerned physical process.

Sensor, actuator manipulation By changing the PLC code in the ladder logic of a PLC program, one can change the data that are extracted from the remote input–output (RIO) unit and send the modified data to the control logic.

2.4 Modifying SMA settings

SMA portal  [62] is a web-based application protected by username and password. SMA portal is an essential component for defining the operation of converters used for solar photovoltaic (PV) systems and ESS. Though there are no reported cases of a security breach in SMA’s web portal, it is not impossible to do so. The attacker could either use the stored user name and password in a Supervisory Control and Data Acquisition (SCADA) workstation or may crack the password to get into the web application. The web application has many settings that control the overall operation of the inverters in the system. For example, the maximum power setting determines the maximum power supplied by the inverter, which could be used to create an imbalance if used at an appropriate time. The network-related settings are further protected with an additional password named as “GRID GUARD CODE”. Hence, the attacker should have access to the unique password to control the inverters using Modbus/TCP-IP.

In the above scenario, it is assumed that the attacker has access to a SCADA workstation and is capable of modifying the settings in the SMA portal. The attacker might have direct physical access or access through the network. In this case, the intent of an attacker is to change the settings in such a way that bidirectional power flow will affect the power balance in the system.

2.5 Modifying communication channel

The communication infrastructure of a smart-grid is often connected to an external network. Such connections render a smart-grid susceptible to cyber-attacks. The presence of wireless communications among the smart-grid infrastructure makes it even more vulnerable to cyber-attacks. Such attacks could compromise the communication links between sensors and PLCs, as well as the links among the PLCs. Once one or more such links have been compromised, an attacker could use one of the several strategies to send fake state data to one or more PLCs possibly leading to component damage.

Compromise through direct physical access An inside attacker with direct physical access has a range of additional options. In this case, the attacker could re-wire networking cables and manipulate the sensors. The attacks could be denial of service, MITM, and data injection.

2.6 Vulnerability assessment in ICS

Vulnerability assessment follows the steps:Footnote 3

  1. 1.

    listing assets and resources in the system,

  2. 2.

    assigning importance to the resources,

  3. 3.

    identifying security vulnerabilities in each asset and resource, and

  4. 4.

    proposing mitigation for the most serious vulnerabilities.

To understand the vulnerabilities in an ICS, it is also important to understand the processes/steps through which an attacker could exploit these. An attacker who wishes to attack an ICS may go through the following steps before launching the attack: gain access to the ICS network, perform reconnaissance and understand the process, and gain control of the ICS.

Kaspersky  [26] summarized the findings of their research on ICS vulnerabilities as follows: (1) The number of vulnerabilities in ICS components keeps growing, (2) vulnerabilities are exploitable, (3) ICS vulnerabilities are widely diversified, and (4) not all of the vulnerabilities found in 2015 are fixed. Over the years, the number of vulnerabilities being reported has increased. To be more specific, “19” vulnerabilities were reported in 2010, whereas the number of vulnerabilities reported in 2015 was “189.” Even though many vulnerabilities are removed by the product manufacturers, owing to operational reasons, the ICS management might postpone the upgrades. At least 5% of the vulnerabilities published by ICS-CERT were not fully fixed. Sometimes the vulnerable component might be removed from the market and vendor support may not be available for such components.

3 Attack design

Our focus is to investigate, in the context of a smart grid, capabilities of an attacker including access rights and the parameters an attacker could, and needs to, manipulate to achieve a specific goal. Though this work does not focus on complete threat modeling for smart grid systems, parameter manipulations discussed can be linked to various threat models. We describe the identification of parameters and the limits at which the physical process reaches vulnerable state. For example, a fully charged battery is vulnerable to damage under attack, but a battery with 50% state of charge, i.e., how full the battery is, still has time to reach the state where it is vulnerable to physical damage.

The focus in this work is on two kinds of vulnerabilities: (1) network vulnerabilities including all cyber vulnerabilities such as in PLCs and network and (2) process vulnerabilities including process interconnections and how an attacker can damage the physical process as, for example, in malicious power generation discussed in the later part of this section. The attacks designed and described in this work are based on the specific attacker goals such as power interruption and malicious power generation. The attacker can leverage on any of the existing or novel threat models to execute such attacks, i.e., the attack design is always applicable to the system and is independent to the network threat model employed.

Attacker’s capability We classify an attacker’s capability based on the type of access, namely: (1) access to control logic and the modification rights that are achieved through one of the vulnerabilities, (2) access to communication channels in the plant network and rights to modify them, (3) access to SMA settings in the SCADA PC and rights to modify them, and (4) access to perform a DDoS attack. Based on the above attacker capabilities, two classes of attacks were designed: power interruption and malicious power generation.

Power interruption attacks Two classes of power supply interruption attacks are demonstrated based on the observation from an experimental smart-grid operating under normal circumstances. This operational model is investigated under the following scenarios: (1) the attacker manipulates circuit breakers in different stages (generation, transmission, smart-home, and micro-grid; for example, an attacker might close or open one or more circuit breakers, and (2) the attacker manipulates power settings in different stages as for example, by modifying the maximum power settings in different power generation sources.

(1) Attacker manipulates circuit breakers in different stages Here we consider a smart-grid as consisting of four stages including generation, transmission, micro-grid, and smart-home. Each stage is controlled by its own PLC/controller, and communication channels exist between the SCADA, Distributed Control Systems (DCS), and Energy Management System (EMS) to each PLC/controller and between the PLCs/controllers. It is possible for an attacker to (a) enter into the communication network and manipulate the control tags that are being issued by PLCs/controllers, (b) target any one of the PLC/controllers to perform a DDoS attack and make it inactive, (c) manipulate the PLC/controller logic to perform different kinds of attacks, and (d) enter the SCADA workstation and manipulate the settings in the SMA portal. Based on the above four modes, an attacker can manipulate different actuators, circuit breakers in this case, in different parts of the smart-grid to perform power supply interruption attacks.

Fig. 3
figure 3

EPIC control room, 360-degree view. The picture shows different physical components including the SCADA workstation, IED and breaker panel, PLC panel, Historian server, advanced metering infrastructure (AMI), and the monitoring screen

Full size image

(2) Attacker manipulates the power settings in different stages By changing the power settings from the originally intended settings, an attacker could achieve power supply interruption. Power settings can be manipulated as follows: (a) Through PLC code alterations such as, for example, by adding malicious code that sends a higher speed, hence higher power, to the Variable Speed Drive (VSD) to affect the power balance and hence trip the system. (b) Setting portals, for example the maximum power, say in SMA web portal, of the bidirectional inverter could be set higher than the maximum load demand in the micro-grid which will cause the system to trip due to power imbalance. (c) Communication channel for example, the speed commands sent to the VSD from a PLC could be modified such that the VSD runs at a higher speed than required which will affect the power balance and hence trip the system. Based on the above three approaches, an attacker can manipulate the power settings to achieve an intent.

Malicious power generation Here an attacker’s intention is to manipulate the power generated by different generators. This can be achieved by loading a particular generator heavily in order to cause damage either in terms of accelerated aging or by affecting the maintenance schedule. In this work, for malicious power generation, we consider the attacks on Real Power Generation (P) and not Reactive Power Generation (V). It can be observed that the attack design focuses on disturbing the process before looking at the network vulnerabilities in detail. We believe that it is an important step in developing the defense mechanism for smart grid components which are geographically distributed and might be practically impossible to protect all the components at all instances. The choice of defense implementation has to be derived based on the existence of process vulnerabilities in addition to any from network vulnerabilities.

4 Architecture of EPIC

This section presents the structure of EPIC. Pictorial views of EPICFootnote 4 are shown in Fig. 3  [1]. EPIC is an electric power testbed which reflects the real world power system in a small-scale smart-grid. It consists of four stages, namely generation, transmission, micro-grid, and smart-home and is capable of generating 72 kVA of power.

Generation (G): In this stage, local generators produce the power required for the remaining stages. The motors connected to the generators are driven by the university grid supply where EPIC is housed. Transmission (T): With the help of transformers, this stage supplies/distributes power to the smart home stage.

Micro-grid (M): With the help of PV and batteries, this stage acts as an extra source of power generation and storage.

Smart Home (S): This stage has two load banks rated 15 kVA and 30 kVA. The other two water test beds, namely SWAT and WADI  [1], are also connected at this stage. EPIC is capable of simultaneously supplying power to both testbeds.

Fig. 4
figure 4

EPIC communication layout: programmable logic controllers (PLCs), intelligent electronic devices (IEDs), access points (APs), switches (SWs). PLC in generation is represented as GPLC, similarly transmission (TPLC), smart-home (SPLC), micro-grid (MPLC). All other components in the communication layout also prefixed with G, T, S, and M, respectively, for generation, transmission, smart-home, and micro-grid

Full size image

Communications layout The communication layout (Fig. 4) consists of High-availability Seamless Redundancy (HSR) and Media Redundancy Protocol (MRP) switches that are used in a ring network for redundancy. EPIC uses the IEC 61850  [37] standard as a communication protocol for the electrical substation and automation system. The communication layout (Fig. 4) consists of the SCADA workstation, Historian, PLCs, Intelligent Electric Devices (IEDs), Access points (APs), and Switches (SWs).

Fig. 5
figure 5

Electrical layout in EPIC. CB circuit breaker, VSD variable speed drive, M motor, IED intelligent electric device. Electrical connections are shown in red lines, and mechanical coupling is shown as ”MC” (color figure online)

Full size image

Component description (1) Two conventional generators, each 10 kVA, are run by 15-kW VSD-driven motors. (2) A-34kW PV system, together with an 18-kW battery system. (3) A-105 kVA 3-phase voltage regulator. (4) Two load banks capable of emulating 45 kVA load bank. (5) 10-kW motor–generator. (6) Molded Case Circuit Breakers. 7) A SCADA system and a historian. (8) PCvue  [53] is used for programming SCADA and CoDeSys [13] for programming the PLCs.

Electrical layout The electrical layout of EPIC is shown in Fig. 5. Main power supply for driving the prime mover motors (representing diesel engines), referred to as M1 and M2, is obtained from the university’s grid through the main circuit breaker (main CB). The generators referred to as G1 and G2, and the power supply from PV and battery system, are tied together in a bus, which opens the options for having grid-connected as well as an islanded mode of operations. The grid-connected mode is the mode where the sources and load demand are operated in the presence of the main grid, whereas in the islanded mode only the local generators supply power to load demand and the grid connection is disabled. Having a prime mover-based generator, instead of grid emulator  [12], opens up the possibility of studying the security issues related to AGC. AGC could be realized through variable speed drives VSD1 and VSD2.

Fig. 6
figure 6

Network flows in EPIC shows the different communication protocols employed between different components in the testbed

Full size image

Network flow Network flow in EPIC is shown in Fig. 6. It consists of data obtained from the IEDs which are then processed by PLCs. Based on the control logic in the PLCs, commands are issued to the end devices such as VSDs, load demand, and also to the SCADA system for monitoring and supervisory control. Client-server communication is used between SCADA, PLCs, and IEDs. EPIC uses different communication protocols including Modbus TCP/IP, Modbus serial, IEC 61850 standard, and GOOSE.Footnote 5 EPIC uses the IEC 61850 communication protocol for the electrical substation and automation system. GOOSE and MMSFootnote 6 are used in the ring network for data transfer between relays and the SCADA workstation. PLCs communicate to variable speed drives and load banks through the Modbus channel.

Table 1 Assets table
Full size table

5 Vulnerability assessment in EPIC

Vulnerability assessment is carried out by following the steps described in Sect. 2.6

List of assets and resources in the system The assets in EPIC are listed in Table 1. Note that vulnerability assessment depends on the components used in the system.

SCADA workstation is running on a windows machine in EPIC which has an EternalBlue exploit. It is possible for a remote attacker to access the system and manipulate or execute malicious commands.

In PLCs (Table 1:WAGO), the host is running on an outdated SSH server. This dropbear has multiple vulnerabilities and handles the client–server applications. It allows a remote attacker to upload arbitrary or malicious code and a local attacker to access the process memory. While PLC is communicating through Modbus, the attacker can use dropbear SSH (multiple vulnerabilities) to enter into PLC and manipulate the process.

IEDs are located in the control center and communicate with the rest of the system using IEC 61850 protocol. Different IEDs protect different parts of the system such as motors, generators, transformer, and loads. The firmware and control logic of the IEDs are updated through dedicated ports and limit the access to authorized personnel. There are no reported vulnerabilities in IEDs with respect to firmware and control logic. However, during the maintenance period, firmware or control logic can be modified by an attacker. Such modifications can have a serious impact on the physical safety of the process.

VSDs are used to control the speed of the motors (similar to a diesel engine in real cases) that are “mechanically coupled” to respective generators and hence are used to control the speed of the generators. The VSDs have a firmware and a control logic that could be updated/modified from the SCADA workstation. An insider, with access to the workstation, can upload malicious code/logic into the VSD, which eventually affects the physical process and the system. The VSDs also receive the speed settings via Modbus TCP/IP protocol. The Modbus protocol does not employ any security feature and hence is vulnerable to attacks on the communication channel.

The password sync  [42] feature in Hirschmann switches allows an attacker to obtain sensitive information by sniffing the network. This enables an attacker to intercept the packets in the network and modify them. The vulnerabilities  [47,48,49,50,51] in Hirschmann wifi access points and switches allow an attacker to hijack and manipulate the packets.

PV and battery inverters Network control option can only be enabled with a “GRID GUARD CODE.” Once it is enabled, MODBUS TCP/IP can be used for read/write operation. Malicious commands could be sent to the inverters through Modbus vulnerabilities. A firmware update can be carried out from SCADA PC (SMA’s Web portal). The EternalBlue vulnerability can also be exploited to obtain access to SCADA workstation and subsequently to the SMA web portal. This access could be used to change the maximum operating power of the inverters that can affect system stability.

Vulnerabilities ICS-CERT  [23] has identified many vulnerabilities in generic ICS/SCADA systems, and a subset relevant to the EPIC is listed in Table 2.

Table 2 Vulnerability information
Full size table

EternalBlue EternalBlue  [52] is a vulnerability in server message block (SMB) protocol and is mentioned in CVE-2017-0144  [14] catalog. SMB server mishandles the packets from remote attackers eventually allowing access to the system. Attacks similar to the “wannaCry” attack were studied in automotive sector   [72] and identified as an emerging threat to critical infrastructures and ICS.

Dropbear SSH 2016.74.0 with multiple vulnerabilities Dropbear is a client–server application. When a remote host is running an outdated SSH server, there exist multiple vulnerabilities that could be exploited. The common vulnerabilities are listed next. (1) When handling the usernames, format flaw exists  [43] and is triggered as a string format. This allows an attacker to execute arbitrary code. (2) Improved OpenSSH files allow a context-dependent attacker  [44] to execute malicious code. (3) Flaws in dbclient allow remote attacker  [45] to execute arbitrary code and, during compilation  [46], allow a local attacker to access process memory.

CoDeSysFootnote 7Unauthenticated Command-line access CoDeSys allows remote attackers to execute commands via the command-line interface and transfer files. This vulnerability allows an unauthorized attacker to obtain administrative access to PLC logic and modify the control logic  [41].

Default admin password on the web server: [21, 23] Usually manufacturers use a set of default passwords during installation and configuration of their hardware and software. If the operating management fails to change the default passwords, the attacker can use those default passwords provided by the manufacturer and exploit the concerned system. Later it could be used to modify the functions of the overall control system.

Table 3 Attack matrix on circuit breaker
Full size table

6 Attacks on circuit breakers

Based on the assessment carried out in EPIC, we identified the vulnerabilities described in Sect. 5. Information described above was used in the design and execution of power supply interruption attacks by manipulating the circuit breakers and their status.

6.1 Attack design

A total of 16 attacks that can be launched on EPIC were designed (Table 3). The attacks could be launched at different stages and using four different parameter manipulations.

Experiment A The attack for this experiment is designed based on the assumption that the attacker uses vulnerabilities such as EternalBlue, SMB, and CoDeSys to compromise the network and can modify and upload PLC code into different PLCs. During the attack, the adversary modifies the code such that when the respective CB is closed, the code automatically opens the CB and gives a false indication to the SCADA system and the operator. A prefix G is added to indicate that the attack is carried out on the PLC controlling the generator CBs and prefixes T, M, and S are used for transmission, micro-grid, and smart-home, respectively.

Experiment B The attack for this experiment is designed based on the assumption that the CB is open and the DDoS attack is launched on the corresponding PLC which disables closing of the CB. It could also be assumed that the attack is launched immediately after a trip operation such that the operator would not be able to close the CB. This could either be realized from the network or by using malicious code uploaded into the PLC forcing it to enter an infinite loop immediately after the trip operation. It is assumed that either the attacker has the same capabilities as in Experiment A or is already inside the network.

Experiment C The attack for this experiment is designed such that the packets sent from the SCADA workstation to the PLCs are modified such that a close operation is altered to an open operation and a false data indicating closed status is sent back to the SCADA system. It is assumed that the attacker is already inside the network.

Experiment D The attack in this experiment is designed based on the assumption that the attacker uses vulnerabilities such as EternalBlue, SMB, and CoDeSys to enter the network and can modify the power settings in the web portal. It is also assumed that the attacker either uses the stored password or has the capability to crack it. During the attack, the attacker waits until the trip operation and then executes a DDoS attack.

Combining Experiments A through D with four stages G–S, we derived 16 different attacks. For example, when Experiment A is conducted on the generation stage, it is labeled as Experiment GA. In Experiment GA, the attack is launched on the GPLC to either open CB, or CB1 and CB2, or all three circuit breakers. The attack matrix is shown in Table 3.

6.2 Attack execution

Vulnerabilities mentioned in Sect. 5 were exploited to enter the system and manipulate the respective control tags in different ways such as mutating data across communication channels, PLC logic manipulation, and DDoS.

Experiment A Dropbear SSH vulnerability and unauthenticated command-line access in CoDeSys allow the attacker to manipulate the PLC code. These two vulnerabilities were used to manipulate the PLC code.

Experiment B This experiment was conducted by sending 1 million UDP packets per second to the concerned PLC to render it non-responsive and/or inactive.

Experiment C In this experiment, the vulnerabilities in a communication channel were used to enter into the network and an MITM attack between the SCADA workstation and PLC was launched.

Experiment D This experiment exploited the vulnerabilities in Windows 7 OS to enter the SCADA workstation and perform DDoS and/or modifications on the web portal.

6.3 Results: experiment A (PLC code manipulation)

This subsection presents outcomes observed during the power supply interruption attack based on manipulation of the control code in PLCs. The attack can be correlated with experiments GA, TA, MA, and SA.

Original system During normal operation, in order to supply power to the critical loads, circuit breakers CB1, CB4, CB8, and CB12 (Circuit Breakers (CBx) shown in Fig. 5 ) should be closed. SPLC controls the opening and closing of CB12. Whenever power supply is required for the critical loads, a close command is issued from the SCADA to the SPLC. The SPLC has the control code (Control CodeX shown in Fig. 7) that issues a subsequent command to the SIED4 for closing CB12. SIED4 will eventually control the closing operation of the breaker and enables the power supply to the critical loads.

Fig. 7
figure 7

Power supply interruption attack, showing the process in which the attacker modifies the control code using one of the existing vulnerabilities

Full size image

Attack design The attacker’s intention is to interrupt power to the critical loads. An attacker can achieve this intent by opening the circuit breaker, e.g., CB12 and respective CBs in other cases, giving a false indication to the operator through SCADA and disabling further closing of the circuit breaker.

Fig. 8
figure 8

SCADA screenshot showing the status after the attack was launched, arrow 1 shows the closed indication of CB, but arrow 2 shows the voltage (zero) measured by the meter below, indicating that no power supply was available, i.e., CB is open

Full size image

Attack vector: In this experiment, EternalBlue exploit was used to enter the SCADA workstation and those in CoDeSys to upload malicious control code into the SPLC. The original and malicious control codes are shown as Control CodeX and Control CodeY, respectively, in Fig. 7. As a consequence, the circuit breaker opened immediately after a close command was executed, further close commands were disabled, and a false close status was displayed at the SCADA screen. Hence, the operator at the SCADA workstation was unable to control CB12. This resulted in a power supply interruption to the critical loads. This is observed from Fig. 8 where arrow 1 shows the “close” status of CB, but arrow 2 shows the voltage (zero) measured by the meter below, indicating that no power was available, i.e., the CB is open. This experiment was repeated for all the cells shown in the attack matrix in Table 3. The experiment was conducted using two scenarios, namely operation under the normal scenario, i.e., the power is supplied to the critical loads, and operation under malicious scenario, i.e., the power is not supplied to the critical loads.

Fig. 9
figure 9

Smart-home without DDoS attack: the circuit breaker is in normal operation, which can be observed from the control command being enabled and valid state, i.e., open status and AUTO mode displayed. Refer to Fig. 10

Full size image

6.4 Results: Experiments B and D (DDoS attack)

In this case, the attacker uses the vulnerabilities of the communication channels to enter the network and flood the PLCs with UDP packets. After the network was flooded with UDP packets, the circuit breaker was tripped; the operator was unable to control the tripped breaker.

Fig. 10
figure 10

Smart-home with DDoS attack: the circuit breaker was tripped and the system is in in-valid state, i.e., neither ON nor OFF and lack of control option; refer to Fig. 9.

Full size image
Table 4 Design of attacks on power settings
Full size table

The screenshots in Figs. 9 and 10 are from the SCADA workstation under normal scenario and when the attack was executed on SPLC, respectively. The results are identical for all PLCs, and hence, only the results corresponding to SPLC are presented.

7 Attacks on power settings

In this section, we describe how the knowledge of network vulnerabilities identified in Sect. 5 was used to manipulate the power settings of different energy sources to realize power supply interruption.

7.1 Attack design

The attacks are similar to those in the attack matrix in Table 3 and presented in Table 4. A brief description of the attacks is as follows.

Experiment A The difference from the previous attack matrix in Table 3 is that an attacker modifies the PLC code such that the speed settings sent to VSD are modified to a higher value, say, by 1%.

Experiment B A static setting is sent to the VSD, following which the PLC becomes inactive as a result of DDoS. Hence, the VSD/generator will not respond to changes in load demand.

Experiment C In this attack, the attacker modifies the commands issued by PLC before they arrive at the VSD.

Experiment D The attacker modifies the power settings in SMA portal to trip the entire system.

Table 4 shows that there are few cells where “Not applicable as there are no generators” is mentioned. This is due to the fact that there were no generators available for manipulation in such cases. For example, the transmission stage does not have any generator and is shown in Fig. 5. Hence, there are no components for modifying speed/power settings. Web portal- based power settings are only available for PV/battery inverters, and hence, “web portal”-based settings are not applicable in other stages such as transmission and smart-home.

7.2 Attack execution for selected cases

Experiment GA In this experiment, the power setting at which the speed of VSD should accelerate to enable equal power sharing among the two generators G1 and G2 was modified.Footnote 8 In this case, the control logic was modified such that G2 could not take over power when it is synchronized as the second generator.Footnote 9 Vulnerabilities  [14] of Windows 7 OS were exploited to enter the SCADA workstation. Dropbear SSH vulnerability and unauthenticated command-line access in CoDeSys allow an attacker to manipulate the PLC code. These two vulnerabilities were exploited to manipulate the PLC code.

Fig. 11
figure 11

Normal operation during which the load is share equally between generators 1 and 2 can be observed from L1–L3 being approximately same on MIED1 and MIED2

Full size image
Fig. 12
figure 12

Apparent power during load sharing between generators G1 and G2. When G2 is unable to share the power, the vulnerability of G1 to trip under overload, i.e., during peak load conditions, increases dramatically. The time-domain representation of power sharing before the attack was launched is shown and marked as normal. Observe that before attack launch at around 1900 s, G1 and G2 shared power irrespective of the condition, whereas after the attack launch, G2 was unable to share the power, i.e., between 2400 and 4300 s

Full size image

Experiment MD The maximum power setting in the SMA web portal for the PV/battery inverters was changed to a value higher than the maximum load demand of critical loads. Vulnerabilities  [14] of Windows 7 OS were exploited to enter the SCADA workstation which is the authorized location for modifying SMA portal settings.

7.3 Results from selected experiments

Experiment GA This subsection presents the impact of the power supply interruption attack based on the power settings of the generator’s PLC code and can be correlated with attack experiment GA in Table 4.

Original system As an example, during normal operation, to supply power to the critical loads, generators G1 and G2 will share the power equally. The SPLC has the control code that issues a subsequent command to the VSDs to run at a specific speed (1500RPM in this case), for enabling equal power sharing among the two generators. The normal operation is shown in Fig. 11, i.e., the apparent power is equally shared between the generators. The time-domain representation of power sharing before the attack was launched is shown in Fig. 12 and marked as normal.

After the attack was launched on generator G1, i.e., the speed of the prime mover of G2 reduced by 0.2 RPM when generator G1 is supplying more power and hence disabling the power sharing process. This attack scenario is marked in Fig. 12 where it can be observed that whenever G2 is supplying more power than G1, G1 takes over until equal power is shared among the two. However, when G1 is supplying more power, G2 fails to take over even after synchronization. This resulted in G1 supplying more power under scenarios where G2 is synchronized as the second generator. The above condition will eventually result in tripping of G1 due to prolonged overload condition.Footnote 10

Experiment MD This section presents the power supply interruption attack based on power settings in the SMA web portal and can be correlated with experiment MD in Table 4.

Original system Under normal operation, in order to supply power to the critical loads, CB1, CB4, CB8, and CB12 ( CBx in Fig. 5) must be closed. Assuming that the power is supplied only to the critical loads, the maximum power from the inverter as set in the SMA portal should be less than or equal to the power consumed by the critical loads. If the power generated from the PV + battery system is greater than the power consumed, it will result in tripping of the entire system due to power imbalance.

In this experiment, EternalBlue exploit was used to enter the SCADA workstation and used the default username/password to login into the SMA portal. The power setting was at 125% for critical loads. This is a deliberate setting as the power generated from PV + battery system would be intermittent and will not trip the system immediately, such as at night or when the battery is not fully charged. But, under certain conditions, say during daytime and the battery is fully charged, it will result in frequent tripping as and when the power generation increases beyond the load demand due to increasing solar irradiance. Figure 13 shows the tripping event in the SMA portal “external grid disconnected due to excess freq. at phase L1 (505)”. Figure 14 shows the time-domain response of the process when there is a negative real power flow. The tripping event occurred because the battery was charged fully and the power generated by PV was higher than the power consumption in critical loads.

Fig. 13
figure 13

Zoomed SMA portal showing the exit grid events, i.e., termination of power supply from PV + battery systems

Full size image

8 Malicious power generation attack

The attacker’s intention, in this case, is to manipulate the power generated from a particular generator to achieve a different set of goals. For example, the attack focuses on overloading one generator higher than the other, so that the maintenance schedule is offset as the overloaded generator needs more frequent maintenance due to additional wear and tear. This eventually leads to accumulated damage in the long run, as the overloaded generator was not serviced at the appropriate times due to malicious operation. The attack could be further classified into two types: attacks on the real power generation and attacks on reactive power generation. A detailed information of attacks on the real power is mentioned in Table 5 and attacks on reactive power is out of the scope of this paper.

Fig. 14
figure 14

Reverse power and tripping event from Historian, i.e., termination of power supply from generator indicated with zero power. Y-axis is the real power

Full size image

8.1 Prime mover attack or attack on real power generation

Controlling the speed of the motor can change the frequency of the generator as per the following equation:

$$\begin{aligned} n = {120/p} * f, \end{aligned}$$
(1)

where n = shaft rotation speed (rev/min, rpm), f = frequency, and p = number of poles.

Fig. 15
figure 15

Normal operation showing equal load sharing: The equal power supply is shown at MIED1 and MIED2 with respect to two generators which can be observed for approximately equal value on L1–L3 of both the IEDs

Full size image
Fig. 16
figure 16

Steady-state equal load sharing among G1 and G2, from around 200s to 500 s

Full size image
Fig. 17
figure 17

Ramping power to enable equal sharing among G1 and G2; G1 ramps up the power around 280s and G2 around 580 s

Full size image
Fig. 18
figure 18

Load sharing among generators G1 and G2 during the attack period. No attack scenario can be observed around 250 s, and the attack scenario can be observed around 2100 s

Full size image
Fig. 19
figure 19

Synchronization process during attack period: Here generator G1 supplying entire load, when we want the second generator G2 to supply power along with G1, it checks the sync process as shown in figure and shares the load with generator G1

Full size image

Generators are required to be maintained at a fixed frequency, 50 Hz or 60 Hz, in order to ensure the stability of the system as explained in Sect. 2.2. If the load remains constant and the power input increases due to the accelerated speed of the rotor, the frequency will increase or the real power shared by the generator will increase. This will shift the load from the other generators to the generator under attack thus overloading it, i.e., with reference to normal operation and not the actual overload. Such attacks do not cause any immediate impact but increase the aging process of the attacked generator in the long run.

Attack design Two attacks were designed and launched on EPIC using this mode as the attack could be launched in two different ways.

Experiment A The adversary modifies the code such that the speed is always mutated by factor \(+\delta \). This would result in excessive real power generated/shared by the generator under attack.

Experiment B The attack is designed such that the packets sent from PLC to the VSD are modified by factor \(+\delta \). It is assumed that the attacker is already inside the network.

Normal operation In this experiment, both generators G1 and G2 shown in Fig. 5 are connected to the load and hence should share the required real and reactive power equally during normal operation. The normal operation is shown in Fig. 15, i.e., the apparent power is equally shared by both the generators, and the time series representation is shown in Fig. 16. Ramping of power (both up and down) by the generators G1 and G2 is shown in Fig. 17. The following observations are noted. (1) Initially generator G2 was supplying the entire power to the load when G1 was not available. (2) After 201 s when the generator G1 was available, power was shared equally among two generators. (3) When generator G2 was not available after 401 s, generator G1 was supplying the entire power to the load. (4) After 600 s, the power is equally shared among the two generators. The two cases in Figs. 16 and 17 are a representation of the normal scenario.

Attack execution The attack is launched on generator G1, i.e., the speed of the prime mover of G2 is reduced by 0.2 RPM when generator G1 is supplying more power and hence disabling the power sharing process.Footnote 11 The attack scenario is shown in Fig. 18 where it can be observed that whenever G2 is supplying more power than G1, G1 takes over the power until equal power is shared by the two. However, when G1 is supplying more power, G2 fails to take over even after synchronization.Footnote 12 This will result in G1 supplying more power under the scenarios when G2 is synchronized as the second generator when G1 is already supplying power. It was also observed that the synchronization process took much longer than usual after the attack was launched. The corresponding SCADA screenshots are shown in Figs. 19 and 20. In fact, this delay itself could be considered as an attack as this disables the availability of G2 when there is a sudden/instantaneous power requirement. However, we are not focusing on the attack on the synchronization process in this paper.

Table 6 shows a summary of the attacks analyzed in this work.

Fig. 20
figure 20

Generator G1 is supplying the entire load: This situation occurs after an attack. However, though two generators are running as shown, only generator G1 is supplying the entire load which can be observed from L1–L3 values of MIED1 and MIED2

Full size image
Table 5 Malicious power generation attacks
Full size table

9 Discussion

In this section, we revisit the attacks and the attack matrices in Tables 3 and 4. Factors considered here include (i) the difficulty level of launching the attack on EPIC, (ii) impact of the attack with respect to the stage at which it is launched and the type of attack launched, (iii) time at which the attack could be launched, (iv) the time required to realize the attack, and (v) the capabilities of the attacker required to launch the attacks.

Difficulty in launching an attack: The difficulty in launching an attack depends on various factors such as the stage at which the attacker intends to launch the attack, the component targeted for the attack, etc. For example, the likelihood of a PLC controlling a generator that is secured or the likelihood that the measures implemented for minimizing the vulnerabilities, is usually high considering the fact that these subsystems are managed by professionals. However, such measures are less likely to be implemented when the PLC/controller is intended to control a smart-home or individual loads as these are often managed by non-professionals. Also, the physical access to the concerned PLCs is less protected in a consumer environment than in other parts of the grid. With respect to the targeted component, given that the attacker has access to the PLC, the information required for modifying the code to change breaker status, which is only one line in the control code, is less than the information required to modify the speed settings, requiring modifications on multiple lines of code. Hence, it is easier to launch an attack on a circuit breaker compared to an attack for changing the power settings of a generator.

Table 6 Analyzed attacks
Full size table

Impact with respect to a stage in the power grid The impact of an attack launched on the generation stage is much higher than the impact of an attack launched on the smart-home. This is because the attack on the smart-home affects only the concerned loads, i.e., say critical loads (refer to Fig. 5 critical loads), whereas an attack on the generator affects the overall system, i.e., non-critical loads and other connected systems (other testbeds in the environment where the experiments are conducted). An attack on the micro-grid can also affect the stability of the system (Experiment GD from Table 3) and leads to overall system trip due to power imbalance. A similar impact was also observed on the transmission stage, i.e., it affects a larger portion of the grid.

Time to perform an attack Irrespective of the time at which the attack was launched, the attack on the generator and transmission stages resulted in a complete blackout. The impact of an attack on individual loads depends on the operating pattern and the time at which electric power is needed. For example, refrigerator and freezer units have ON and OFF periods that cycle one after the other  [25]. An attack targeted (Experiment SA in Table 3) at power supply interruption during an ON interval will increase the vulnerability of the products stored in the refrigerator or freezer, whereas a random attack will most likely have a lesser impact.

Time to realize an attack The impact of an attack could be realized immediately as in case of Experiment GA described in Table 3. Alternately, it could be sufficiently long as in case of Experiment MD described in Table 4, where the impact is directly linked to the inherent intermittent nature of the solar PV. Among the different types of attacks in Tables 3 and 4, the attacker should have the highest capability for successfully launching MITM attacks. This is due to high computation needs of the MITM attacks, considering the time-critical nature of the system. To launch other types of attacks, the attacker should have the ability to identify the usernames and passwords.

The feasibility of an attack, i.e., realizing the attacker’s intent, depends on whether the targeted entity uses the standard cyber-security protocols or not. For example, in the case of EPIC, vendors were asked to design the system with state-of-the-art components. Vulnerabilities were evaluated after the testbed was deployed. It was observed that the system satisfied all Operation Technology-related standards. However, it could not fulfill the security requirements based on recently reported vulnerabilities, e.g., EternalBlue. Such conditions are applicable to all legacy systems as well. Hence, it is realistic that an adversary could use these vulnerabilities together with social engineering to launch such attacks.

Studies, such as the one reported here, could be useful for the operators of ICSs to re-evaluate cyber-security scores with respect to Information Technology-related standards. For example, in the case of attacks on power settings, the SMA portal itself follows the hierarchy of cyber-security measures such as suggestions to have customized passwords, unique code for changing control settings, etc. However, under weak password scenario, or through social engineering, the adversary could get access to this critical information and execute the attack.

Even though state-of-the-art ICT is used for power system operation and control, it is highly likely that there would be unexplored and unfixed vulnerabilities as pointed out by ICS-CERT. The ICS used for the power system operation and control should be frequently evaluated against the ever-evolving vulnerabilities in the ICT domain. This paper would be helpful for researchers in exploring the possible vulnerabilities and respective attack scenarios (as new as EternalBlue on SMA power setting, which was not believed to exist before). It is also useful to develop defense mechanisms for the existing vulnerabilities.

10 Related work

Previous work in this area can be divided into two groups as presented as follows:

Attack modeling and analysis Attacks have been modeled as noise in sensor data  [28]. Attack models designed specifically for CPS  [2] often include a variety of deception attacks such as surge, bias, and geometric  [10]. Further, attack models reported in the literature are a modified version of attack models designed for network security  [64] and rarely consider the physical aspects of a CPS. Recent surveys on ICS privacy, safety, and security indicate  [27, 40] the different areas of focus in ICS security.

Resilient control is an essential requirement for the control system that manages a Smart Grid. For example, resilient interconnection requirements for cyber-physical control systems are reported in  [8] where the authors describe the policy enforcement system to incorporate optimal self-healing services by considering control structural capacities, the super-node theory, and the IEC-62351 standard. Furthermore, resilience can also be improved by using an architecture that is specifically designed for such requirements. One such resilient architecture for the Smart Grid is presented in  [36]. Researchers have reported case studies on power substation networks  [16] where the authors studied detailed characterization of an ICS to determine its behavior either from the perspective of traditional IT networks or from the basic principles of ICS operation. It can be observed from the above cited studies that understanding the physical process limitations is a key step toward deriving the trade-off between resilience and security. Hence, the attack design from physical vulnerability stand point, described in this work, is an essential approach for improving the resilience of a Smart Grid.

Two virtual testbeds, created for investigating cyber-attacks, are described in  [57]. However, results presented in this paper clearly demonstrate the importance of investigating the attacks in an operational industrial-grade system. In  [35], the authors describe the design of a system to respond to cyber-security breach incidents when different areas of the network are totally unprotected against cyber-attacks. Detection of anomalies, response to incidents, tests of accuracy, and maintenance, as well as recovery of states and control in crisis situations, have been studied  [7].

Attacks on power systems Data integrity attacks on smart-grid systems are studied extensively in the literature. One such study  [66] presented a detailed analysis on the impact of a data integrity attack on real-time pricing (RTP) in smart-grids. False data injection attacks on AGC were studied and validated with experimental results in  [63, 67]. The authors in  [67] show that with eavesdropped sensor data, it is possible to derive system constants and launch an optimal attack on AGC. A similar study was presented in  [70] focusing on false data injection attacks on the state estimation to create load redistribution (LR). The authors also presented a quantitative analysis of the damage to power systems because of LR attacks. The authors in  [58] presented a control frame work using digital signature and time stamping for authenticating the control commands issued to renewable energy source inverters that provide reactive power support.

A survey of the conceptual expansion of real-time monitoring systems, detecting the anomalies, analyzing the impact of attacks, and mitigation framework appears in  [68]. Physical impact assessment, carried out for cyber-physical systems, particularly a boiler system using hardware-in-loop (HIL) simulations, is reported in  [22]. Potential exploits in substation have been explored followed by studies on attacks such as malicious fault injection attacks and hardware Trojans that can be employed for compromising substation-level IEDs  [11]. The impact of SCADA system’s vulnerabilities on the overall power system reliability is an important factor to be considered  [71]. Earlier studies focused on false data injection attacks on power systems  [34]. The use of invariants for detecting attacks on CPS has been proposed in  [5, 17, 32].

11 Conclusions

An experimental investigation into vulnerability assessment was undertaken on an operational 72-KVA electric power testbed. It is shown that an attacker could compromise various smart-grid controllers and gain full control of the grid and thus alter its operation. More specifically, this work reports on an investigation into power supply interruption attacks and malicious power generation attacks with a focus on network and process vulnerabilities.

Ongoing work focuses on the implementation of additional cyber-security measures to mitigate different risks, launching systematic attacks to evaluate the resilience of EPIC and conduct experiments to understand the cascading effects across critical infrastructure such as water systems and electric power systems.