Towards Understanding Man-on-the-Side Attacks (MotS) in SCADA Networks

Peter Maynard, Kieran McLaughlin

2020

Abstract

We describe a new class of packet injection attacks called Man-on-the-Side (MotS), previously only seen where state actors have “compromised” a number of telecommunication companies. MotS injection attacks have not been widely investigated in scientific literature, despite having been discussed by news outlets and security blogs. MotS came to attention after the Edward Snowden revelations, which described large scale pervasive monitoring of the Internet’s infrastructure. For an advanced adversary attempting to interfere with IT connected systems, the next logical step is to adapt this class of attack to a smaller scale, such as enterprise or critical infrastructure networks. MotS is a weaker form of attack compared to a Man-in-the-Middle (MitM). A MotS attack allows an adversary to read and inject packets, but not modify packets sent by other hosts. This paper presents practical experiments where we have implemented and performed MotS attacks against two testbeds: 1) on HTTP connections, by redirecting a victim to a host controlled by an adversary; and 2) on an Industrial Control network, where we inject falsified command responses to the victim. In both cases, the victims accept the injected packets without generating a suspiciously large number of unusual packets on the network. We then perform an analysis of three leading Network Intrusion Detection Systems (IDSs) to determine whether the attacks are detected, and discuss mitigation methods.

Paper Citation

in Harvard Style

Maynard P. and McLaughlin K. (2020). Towards Understanding Man-on-the-Side Attacks (MotS) in SCADA Networks.In Proceedings of the 17th International Joint Conference on e-Business and Telecommunications - Volume 3: SECRYPT, ISBN 978-989-758-446-6, pages 287-294. DOI: 10.5220/0009782302870294

in Bibtex Style

@conference{secrypt20,
author={Peter Maynard and Kieran McLaughlin},
title={Towards Understanding Man-on-the-Side Attacks (MotS) in SCADA Networks},
booktitle={Proceedings of the 17th International Joint Conference on e-Business and Telecommunications - Volume 3: SECRYPT,},
year={2020},
pages={287-294},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0009782302870294},
isbn={978-989-758-446-6},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 17th International Joint Conference on e-Business and Telecommunications - Volume 3: SECRYPT,
TI - Towards Understanding Man-on-the-Side Attacks (MotS) in SCADA Networks
SN - 978-989-758-446-6
AU - Maynard P.
AU - McLaughlin K.
PY - 2020
SP - 287
EP - 294
DO - 10.5220/0009782302870294