LICSTER – A Low-cost ICS Security Testbed for Education and Research

Unnoticed by most people, Industrial Control Systems (ICSs) control entire productions and critical infrastructures such as water distribution, smart grid and automotive manufacturing. Due to the ongoing digitalization, these systems are becoming more and more connected in order to enable remote control and monitoring. However, this shift bears significant risks, namely a larger attack surface, which can be exploited by attackers. In order to make these systems more secure, it takes research, which is, however, difficult to conduct on productive systems, since these often have to operate twenty-four-seven. Testbeds are mostly very expensive or based on simulation with no real-world physical process. In this paper, we introduce LICSTER, an open-source low-cost ICS testbed, which enables researchers and students to get hands-on experience with industrial security for about 500 Euro. We provide all necessary material to quickly start ICS hacking, with the focus on low-cost and open-source for education and research.

Content

Author and article information

Contributors

Felix Sauer

Matthias Niedermaier

Susanne Kießling

Dominik Merli

Conference

Publication date: September 2019

Publication date (Print): September 2019

Pages: 1-10

Affiliations

[0001]Hochschule Augsburg, Germany

www.hsainnos.de

Article

DOI: 10.14236/ewic/icscsr19.1

SO-VID: 4fa78131-80f5-4fca-b45a-bfd6a04ae2cc

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: 6th International Symposium for ICS & SCADA Cyber Security Research 2019

Conference acronym: ICS-CSR

Conference number: 6

Conference location: Athens, Greece

Conference date: 10th-12th September 2019

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: Cyber Security Research

History

Product

1477-9358 BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/icscsr19.1

Self URI (journal page): https://ewic.bcs.org/

REFERENCES

T. R. AlvesM. BurattoF. M. de SouzaT. V. Rodrigues 2014 Openplc: An Open Source Alternative to Automation IEEE Global Humanitarian Technology Conference (GHTC 2014) IEEE 585 589
D. AntonioliN. O. Tippenhauer 2015 MiniCPS: A Toolkit for Security Research on CPS Networks Proceedings of the First ACM workshop on cyber-physical systems-security and/or privacy ACM 91 100
P. Biondi 2011 Scapy
A. A. CárdenasS. AminS. Sastry 2008 Research Challenges for the Security of Control Systems HotSec
G. Combs 2008 Wireshark-network Protocol Analyzer Version 0.99 5
J. D. DayH. Zimmermann 1983 The OSI Reference Model Proceedings of the IEEE 71 12 1334 1340
Z. DurumericD. AdrianA. MirianM. BaileyJ. A. Halderman 2015 A Search Engine Backed by Internet-wide Scanning Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security ACM 542 553
S. N. FoleyF. AutrelE. BourgetT. CledelS. GrunenwaldJ. Rubio HernanA. KabilR. LarsenV. M. RooneyK. Vanhulst 2018 Science Hackathons for Cyberphysical System Security Research: Putting CPS testbed platforms to good use Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy ACM 102 107
D. FormbyM. RadR. Beyah 2018 Lowering the Barriers to Industrial Control System Security with {GRFICS} 2018 {USENIX} Workshop on Advances in Security Education ({ASE} 18)
O. GivehchiJ. ImtiazH. TrsekJ. Jasperneite 2014 Control-as-a-Service from the Cloud: A Case Study for using Virtualized PLCs 2014 10th IEEE Workshop on Factory Communication Systems (WFCS 2014) IEEE 1 4
A. GouglidisS. KönigB. GreenK. RosseggerD. Hutchison 2018 Protecting Water Utility Networks from Advanced Persistent Threats: A Case Study Game Theory for Security and Risk Management Springer 313 333
B. GreenA. LeeR. AntrobusU. RoedigD. HutchisonA. Rashid 2017 Pains, Gains and PLCs: Ten Lessons from Building an Industrial Control Systems Testbed for Security Research 10th {USENIX} Workshop on Cyber Security Experimentation and Test ({CSET} 17)
H. HolmM. KarresandA. VidströmE. Westring 2015 A Survey of Industrial Control System Testbeds Secure IT Systems Springer 11 26
International Electrotechnical Commission and others 2003 IEC 62264-1 Enterprise-control System Integration–Part 1: Models and Terminology IEC, Genf
V. JacobsonC. LeresS. McCanne 1989 The Tcpdump Manual Page Lawrence Berkeley Laboratory Berkeley, CA
L. KohnfelderP. Garg 1999 The threats to our products Microsoft Interface, Microsoft Corporation 33
G. Lyon 2009 Nmap–Free Security Scanner for Network Exploration & Security Audits
P. MaynardK. McLaughlinS. Sezer 2018 An Open Framework for Deploying Experimental SCADA Testbed Networks Proceedings of Proceedings of ICS & SCADA 92
S. McLaughlinC. KonstantinouX. WangL. DaviA.-R. SadeghiM. ManiatakosR. Karri 2016 The Cybersecurity Landscape in Industrial Control Systems Proceedings of the IEEE 104 5 1039 1057
T. H. MorrisW. Gao 2013 Industrial Control System Cyber Attacks Proceedings of the 1st International Symposium on ICS & SCADA Cyber Security Research 22 29
M. NiedermaierF. FischerA. von Bodisco 2017 PropFuzz - An IT-security Fuzzing Framework for Proprietary ICS Protocols 2017 International Conference on Applied Electronics (AE), Pilsen 1 4
M. NiedermaierJ.-O. MalchowF. FischerD. MarzinD. MerliV. RothA. von Bodisco 2018 You Snooze, You Lose: Measuring PLC Cycle Times under Attacks 12th USENIX Workshop on Offensive Technologies (WOOT 18)
C. QueirozA. MahmoodJ. HuZ. TariX. Yu 2009 Building a SCADA Security Testbed 2009 Third International Conference on Network and System Security IEEE 357 364
H. RenjieL. FengP. Dongbo 2010 Research on OPC UA Security 2010 5th IEEE Conference on Industrial Electronics and Applications
S. Sanfilippo 2005 Hping3 (8)-linux man page Online: https://linux.die.net/man/8/hping3
B. ZhuS. Sastry 2010 SCADA-specific Intrusion Detection/Prevention Systems: A Survey and Taxonomy Proceedings of the 1st workshop on secure control systems (SCS) 11 7

Comments

Comment on this article

[1] T. R. AlvesM. BurattoF. M. de SouzaT. V. Rodrigues 2014 Openplc: An Open Source Alternative to Automation IEEE Global Humanitarian Technology Conference (GHTC 2014) IEEE 585 589

[2] D. AntonioliN. O. Tippenhauer 2015 MiniCPS: A Toolkit for Security Research on CPS Networks Proceedings of the First ACM workshop on cyber-physical systems-security and/or privacy ACM 91 100

[3] P. Biondi 2011 Scapy

[4] A. A. CárdenasS. AminS. Sastry 2008 Research Challenges for the Security of Control Systems HotSec

[5] G. Combs 2008 Wireshark-network Protocol Analyzer Version 0.99 5

[6] J. D. DayH. Zimmermann 1983 The OSI Reference Model Proceedings of the IEEE 71 12 1334 1340

[7] Z. DurumericD. AdrianA. MirianM. BaileyJ. A. Halderman 2015 A Search Engine Backed by Internet-wide Scanning Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security ACM 542 553

[8] S. N. FoleyF. AutrelE. BourgetT. CledelS. GrunenwaldJ. Rubio HernanA. KabilR. LarsenV. M. RooneyK. Vanhulst 2018 Science Hackathons for Cyberphysical System Security Research: Putting CPS testbed platforms to good use Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy ACM 102 107

[9] D. FormbyM. RadR. Beyah 2018 Lowering the Barriers to Industrial Control System Security with {GRFICS} 2018 {USENIX} Workshop on Advances in Security Education ({ASE} 18)

[10] O. GivehchiJ. ImtiazH. TrsekJ. Jasperneite 2014 Control-as-a-Service from the Cloud: A Case Study for using Virtualized PLCs 2014 10th IEEE Workshop on Factory Communication Systems (WFCS 2014) IEEE 1 4

[11] A. GouglidisS. KönigB. GreenK. RosseggerD. Hutchison 2018 Protecting Water Utility Networks from Advanced Persistent Threats: A Case Study Game Theory for Security and Risk Management Springer 313 333

[12] B. GreenA. LeeR. AntrobusU. RoedigD. HutchisonA. Rashid 2017 Pains, Gains and PLCs: Ten Lessons from Building an Industrial Control Systems Testbed for Security Research 10th {USENIX} Workshop on Cyber Security Experimentation and Test ({CSET} 17)

[13] H. HolmM. KarresandA. VidströmE. Westring 2015 A Survey of Industrial Control System Testbeds Secure IT Systems Springer 11 26

[14] International Electrotechnical Commission and others 2003 IEC 62264-1 Enterprise-control System Integration–Part 1: Models and Terminology IEC, Genf

[15] V. JacobsonC. LeresS. McCanne 1989 The Tcpdump Manual Page Lawrence Berkeley Laboratory Berkeley, CA

[16] L. KohnfelderP. Garg 1999 The threats to our products Microsoft Interface, Microsoft Corporation 33

[17] G. Lyon 2009 Nmap–Free Security Scanner for Network Exploration & Security Audits

[18] P. MaynardK. McLaughlinS. Sezer 2018 An Open Framework for Deploying Experimental SCADA Testbed Networks Proceedings of Proceedings of ICS & SCADA 92

[19] S. McLaughlinC. KonstantinouX. WangL. DaviA.-R. SadeghiM. ManiatakosR. Karri 2016 The Cybersecurity Landscape in Industrial Control Systems Proceedings of the IEEE 104 5 1039 1057

[20] T. H. MorrisW. Gao 2013 Industrial Control System Cyber Attacks Proceedings of the 1st International Symposium on ICS & SCADA Cyber Security Research 22 29

[21] M. NiedermaierF. FischerA. von Bodisco 2017 PropFuzz - An IT-security Fuzzing Framework for Proprietary ICS Protocols 2017 International Conference on Applied Electronics (AE), Pilsen 1 4

[22] M. NiedermaierJ.-O. MalchowF. FischerD. MarzinD. MerliV. RothA. von Bodisco 2018 You Snooze, You Lose: Measuring PLC Cycle Times under Attacks 12th USENIX Workshop on Offensive Technologies (WOOT 18)

[23] C. QueirozA. MahmoodJ. HuZ. TariX. Yu 2009 Building a SCADA Security Testbed 2009 Third International Conference on Network and System Security IEEE 357 364

[24] H. RenjieL. FengP. Dongbo 2010 Research on OPC UA Security 2010 5th IEEE Conference on Industrial Electronics and Applications

[25] S. Sanfilippo 2005 Hping3 (8)-linux man page Online: https://linux.die.net/man/8/hping3

[26] B. ZhuS. Sastry 2010 SCADA-specific Intrusion Detection/Prevention Systems: A Survey and Taxonomy Proceedings of the 1st workshop on secure control systems (SCS) 11 7

Celebrating 65 years of The Computer Journal - free-to-read perspectives - bcs.org/tcj65