Practical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
summary
Penetration tests on seven real ICS/SCADA sites (oil/gas, power, water, manufacturing) find hundreds of firmware and protocol flaws — about 700 CVEs in 2020 with ~20% classified critical and ~40% high — and demonstrate concrete exploits: Modbus/TCP command injection via MITM (ethercap) and a custom Wireshark plugin to craft commands, PLC web UIs with default creds, USB backdoor implants, ransomware lateralization using Mimikatz, and GPS spoofing of time servers to disrupt historians. Defensive wins shown: network segmentation, virtual patching/whitelisting and asset hardening, all validated in lab demos.
AI-written summary · about
chapters (5)
- 0:00Introduction to ICS security
- 1:58ICS attack overview
- 14:00Practical attack demonstrations
- 22:24Energy sector case studies
- 29:02Defense and conclusion
related talks
58mIndustrial Control Systems : Pentesting PLCs 101 (Part 1/2)
47mWhy is SCADA Security an Uphill Battle?
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS Hacking
30mForced Digital Transformation and the Realities to ICS/OT Cybersecurity
49mWhat Hacking the Planet Taught Us About Defending Supply Chain Attacks
40mDefending Operational Frontlines with Industry Experts with...