论文标题
要了解SCADA网络中的人类攻击（MOT）
Towards Understanding Man-on-the-Side Attacks (MotS) in SCADA Networks
论文作者
论文摘要
我们描述了一类新的包数据包注射攻击，称为人类攻击（MOTS），此前仅在国家演员“妥协”了许多电信公司的地方才看到。尽管新闻媒体和安全博客讨论了MOTS注射攻击，但在科学文献中并未广泛研究。爱德华·斯诺登（Edward Snowden）的启示之后，莫特斯（Mots）引起了人们的关注，该启示描述了对互联网基础设施的大规模普遍监测。对于试图干扰IT连接系统的高级对手，下一个逻辑步骤是将此类攻击适应较小的规模，例如企业或关键基础架构网络。与中间人（MITM）相比，MOT是一种较弱的攻击形式。 MOTS攻击使对手可以阅读和注入数据包，但不能修改其他主机发送的数据包。本文提出了实践实验，我们通过将受害者重定向到受对手控制的主机来实施并对两个测试台进行了MOT攻击：1）在HTTP连接上； 2）在一个工业控制网络上，我们向受害者注入伪造的命令响应。在这两种情况下，受害者都接受注入的数据包，而不会在网络上产生大量不寻常的数据包。然后，我们对三个领先的网络ID进行分析，以确定是否检测到攻击，并讨论缓解方法。
We describe a new class of packet injection attacks called Man-on-the-Side Attacks (MotS), previously only seen where state actors have "compromised" a number of telecommunication companies. MotS injection attacks have not been widely investigated in scientific literature, despite having been discussed by news outlets and security blogs. MotS came to attention after the Edward Snowden revelations, which described large scale pervasive monitoring of the Internet's infrastructure. For an advanced adversary attempting to interfere with IT connected systems, the next logical step is to adapt this class of attack to a smaller scale, such as enterprise or critical infrastructure networks. MotS is a weaker form of attack compared to a Man-in-the-Middle (MitM). A MotS attack allows an adversary to read and inject packets, but not modify packets sent by other hosts. This paper presents practical experiments where we have implemented and performed MotS attacks against two testbeds: 1) on HTTP connections, by redirecting a victim to a host controlled by an adversary; and 2) on an Industrial Control network, where we inject falsified command responses to the victim. In both cases, the victims accept the injected packets without generating a suspiciously large number of unusual packets on the network. We then perform an analysis of three leading Network IDS to determine whether the attacks are detected, and discuss mitigation methods.
