Adversaries may repetitively or successively change I/O point values to perform an action. Brute Force I/O may be achieved by changing either a range of I/O point values or a single point value repeatedly to manipulate a process function. The adversary's goal and the information they have about the target environment will influence which of the options they choose. In the case of brute forcing a range of point values, the adversary may be able to achieve an impact without targeting a specific point. In the case where a single point is targeted, the adversary may be able to generate instability on the process function associated with that particular point.
Adversaries may use Brute Force I/O to cause failures within various industrial processes. These failures could be the result of wear on equipment or damage to downstream equipment.
| ID | Name | Description |
|---|---|---|
| S1157 | Fuxnet |
Fuxnet repeatedly wrote arbitrary data over the Meter-Bus channel from impacted devices to connected sensors to render sensor data acquisition useless.[1] |
| S0604 | Industroyer |
The Industroyer IEC 104 module has 3 modes available to perform its attack. These modes are range, shift, and sequence. The range mode operates in 2 stages. The first stage of range mode gathers Information Object Addresses (IOA) and sends select and execute packets to switch the state. The second stage of range mode has an infinite loop where it will switch the state of all of the previously discovered IOAs. Shift mode is similar to range mode, but instead of staying within the same range, it will add a shift value to the default range values. [2] |
| S1072 | Industroyer2 |
Industroyer2 can iterate across a device’s IOAs to modify the ON/OFF value of a given IO state.[3][4] |
| ID | Mitigation | Description |
|---|---|---|
| M0937 | Filter Network Traffic |
Allow/denylists can be used to block access when excessive I/O connections are detected from a system or device during a specified time period. |
| M0807 | Network Allowlists |
Utilize network allowlists to restrict unnecessary connections to network devices (e.g., comm servers, serial to ethernet converters) and services, especially in cases when devices have limits on the number of simultaneous sessions they support. |
| M0930 | Network Segmentation |
Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment. [5] [6] [7] [8] |
| M0813 | Software Process and Device Authentication |
Devices should authenticate all messages between master and outstation assets. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0737 | Detection of Brute Force I/O | AN1870 |
Real-time network monitoring identifies a source issuing write commands to the same Input/Output (I/O) point or register address at a rate significantly exceeding the device's configured scan cycle. The write rate itself is the signature, with source identity retained as corroborating context; treat the rate deviation as suspicious only after excluding tuning, commissioning, failover, and fault-recovery activity. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
| AN2130 |
Real-time monitoring identifies an Industrial Control System (ICS) Linux service process making write Application Programming Interface (API) calls to field device Input/Output (I/O) at a rate exceeding the configured scan rate, from a User Identifier (UID) associated with the Supervisory Control and Data Acquisition (SCADA)/control application but exhibiting anomalous write volume. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
||
| AN2207 |
Real-time monitoring identifies an Industrial Control System (ICS) Windows application such as a Supervisory Control and Data Acquisition (SCADA) server or Distributed Control System (DCS) interface generating anomalously high-frequency write Application Programming Interface (API) calls to field devices, exceeding the configured scan rate baseline for that point. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |