Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected device functionality. Examples of DoS attacks include overwhelming the target device with a high volume of requests in a short time period and sending the target device a request it does not know how to handle. Disrupting device state may temporarily render it unresponsive, possibly lasting until a reboot can occur. When placed in this state, devices may be unable to send and receive requests, and may not perform expected response functions in reaction to other events in the environment.
Some ICS devices are particularly sensitive to DoS events, and may become unresponsive in reaction to even a simple ping sweep. Adversaries may also attempt to execute a Permanent Denial-of-Service (PDoS) against certain devices, such as in the case of the BrickerBot malware. [1]
Adversaries may exploit a software vulnerability to cause a denial of service by taking advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in software that can be used to cause a denial of service condition.
Adversaries may have prior knowledge about industrial protocols or control devices used in the environment through Remote System Information Discovery. There are examples of adversaries remotely causing a Device Restart/Shutdown by exploiting a vulnerability that induces uncontrolled resource consumption. [2] [3] [4]
| ID | Name | Description |
|---|---|---|
| C0028 | 2015 Ukraine Electric Power Attack |
During the 2015 Ukraine Electric Power Attack, power company phone line operators were hit with a denial of service attack so that they couldn’t field customers’ calls about outages. Operators were also denied service to their downstream devices when their serial-to-ethernet converters had their firmware overwritten, which bricked the devices. [5] |
| S0093 | Backdoor.Oldrea |
The Backdoor.Oldrea payload has caused multiple common OPC platforms to intermittently crash. This could cause a denial of service effect on applications reliant on OPC communications. [2] |
| S1157 | Fuxnet |
Fuxnet shut down remote access services such as SSH, HTTP, telnet, and SNMP to a device along with deleting the routing table for routing devices to inhibit system accessibility and communication.[6] |
| S0604 | Industroyer |
The Industroyer SIPROTEC DoS module exploits the CVE-2015-5374 vulnerability in order to render a Siemens SIPROTEC device unresponsive. Once this vulnerability is successfully exploited, the target device stops responding to any commands until it is rebooted manually. [7] Once the tool is executed it sends specifically crafted packets to port 50,000 of the target IP addresses using UDP. The UDP packet contains the following 18 byte payload: 0x11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E. [7] |
| S1006 | PLC-Blaster |
The execution on the PLC can be stopped by violating the cycle time limit. The PLC-Blaster implements an endless loop triggering an error condition within the PLC with the impact of a DoS. [8] |
| C0031 | Unitronics Defacement Campaign |
During the Unitronics Defacement Campaign, the CyberAv3ngers defaced controllers’ Human-Machine Interface (HMI), which prevented multiple entities from being able to operate their devices normally.[9][10][11][12] Additionally, the CyberAv3ngers caused a communications failure in a remote pumping station.[13] |
| ID | Mitigation | Description |
|---|---|---|
| M0815 | Watchdog Timers |
System and process restarts should be performed when a timeout condition occurs. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0723 | Detection of Denial of Service | AN1856 |
Real-time network monitoring identifies a sustained spike in malformed or high-volume Industrial Control System (ICS) protocol traffic directed at a single field device from a source not in the approved control server list, immediately followed by that device dropping out of the supervisory poll cycle. Documented precedent: Sandworm's Industroyer malware sent a crafted 18-byte proprietary User Datagram Protocol (UDP) packet to port 50000 on Siemens Protection Technology (SIPROTEC) relays (CVE-2015-5374), causing the device to hang and require a manual reboot. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation. |
| AN2121 |
Real-time monitoring identifies an Industrial Control System (ICS) Linux service process (historian daemon, Open Platform Communications (OPC) gateway) being killed or crashing following a sustained high-rate inbound connection pattern recorded by network monitoring, correlated with daemon log entries indicating connection limit exhaustion or out-of-memory conditions. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation. |
||
| AN2168 |
Real-time monitoring of switch/router interface counters identifies a sudden spike in discarded or errored packets on an Industrial Control System (ICS)-facing interface combined with Central Processing Unit (CPU) utilization climbing above baseline, correlated with loss of reachability to downstream field devices on that segment within the same window. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation. |
||
| AN2268 |
Real-time monitoring identifies an Industrial Control System (ICS) Windows service (Open Platform Communications (OPC) server, historian, Supervisory Control and Data Acquisition (SCADA) polling service) consuming abnormal Central Processing Unit (CPU)/memory resources and becoming unresponsive following receipt of a high volume of connections to its application port, correlated with watchdog timeout or service crash events. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation. |