Journal of Robotics, Networking and Artificial Life
Vol. 8(1); June (2021), pp. 29–32
DOI: https://doi.org/10.2991/jrnal.k.210521.007; ISSN 2405-9021; eISSN 2352-6386
https://www.atlantis-press.com/journals/jrnal

Research Article

The Security Issue of ICS: The Use of IT Infrastructure
I-Hsien Liu, Kuan-Ming Su, Jung-Shian Li*
Department of Electrical Engineering / Institute of Computer and Communication Engineering, National Cheng Kung University,
No. 1, University Rd., East Dist., Tainan City 70101, Taiwan

ARTICLE INFOABSTRACT

Article History

With the trend of Industry 4.0, the communication established by Ethernet is becoming more and more common in the Industrial
Control System (ICS), and it brings not only pros but also cons like vulnerabilities from information technology. Furthermore,most devices in the ICS are not ready for cyberattacks, and it opens up opportunities for attackers. We generalized a procedureof attacking an Ethernet-enabled ICS and implemented it to the real industrial system we obtained. The procedure gets theinformation and access of the devices in the ICS, like identifying the manufacturer of Programmable Logic Controllers (PLCs)
and overwriting the configuration of PLCs.

Received 09 November 2020
Accepted 06 April 2021
Keywords
Industrial control systems
programmable logic controller
information technology
network security
Ethernet© 2021 The Authors. Published by Atlantis Press B.V.
This is an open access article distributed under the CC BY-NC 4.0 license (http://creativecommons.org/licenses/by-nc/4.0/).

1. INTRODUCTION
Because of Industry 4.0 [1], Information Technology (IT) is getting more and more widespread in the Operation Technology (OT)
field in the modern Industrial Control System (ICS), and serial
communication is becoming incompetent to meet the demands.
Therefore, in terms of communication of IT in ICS, Ethernet iscoming to the most popular one. Ethernet is commonly used inICS with IT. Comparing to serial connection, Ethernet has much
more flexibility and scalability. For example, to access and manage
multiple devices, all you need to do is connecting your Engineering
Workstation (EWS) to the network where devices are. Also,
Ethernet allows hundreds of devices to communicate with eachother. In addition, there have been many industrial protocols supporting Ethernet and Internet Protocol.
Although Ethernet meets the demands of IT and OT, it also bringsvulnerabilities to ICS. Considering the cost of building information
security, most ICS defense mechanisms only have an external firewall, isolation from the office network, or complete independence
from other networks. Moreover, for the purpose of operation stability, many running operation systems are not updated to the latest
version including the security patches. Therefore, those devices
are very vulnerable to malware. Let us take Taiwan Semiconductor
Manufacturing Company (TSMC) for example. TSMC is the mostadvanced integrated circuit manufacturer in the world, and they havethe top of cyber security standards to protect the intellectual property and factory operation. However, an accident occurred in 2018.
Because of the operational errors during the software installation on
the new equipment, after the new equipment hooked up to the internal network, the ransomware infected other computer systems andfab tools and caused about $170 million US dollars losses [2].
Corresponding author. Email: jsli@mail.ncku.edu.tw*In this paper, we show the weakness of information security
inside the ICS network by an attacking procedure we generalized and carrying the procedure out on an ICS which wasused in the real field before. Eventually, we compromised theProgrammable Logic Controllers (PLC) in the ICS network with
MODBUS Transmission Control Protocol (TCP) packets. We
successfully read and wrote the registers in the PLC and stopped
the running PLC.

2. BACKGROUND
Industrial control system is a universal term standing for thecontrol system of the automatic process in the industry, such as
supervisory control and data acquisition (SCADA) and distributed control system (DCS). The controller is used to receive andcontrol the information and motion of field equipment such as
the value of temperature and motion of the motor. One of thecommon controllers in ICS is the PLC. Generally, there are digital/analog inputs and outputs on a PLC, and the same model of
PLC can be applied to various scenarios with corresponding programs on it.
There are devices controlled in ICS, and there must be some methods for the controller to communicate with each other to makethose devices work together. We can divide it into the physicalconnection part and the communication protocol part. For thephysical connection in ICS, there are several standards like RS-232,RS-422, RS-485, and Ethernet. Among those standards, Ethernet
is the focus of this discussion due to the trend of IT. For the communication protocols in ICS, there are various protocols based ondifferent standards. Many relatively modern protocol versions arebased on Ethernet. Some of them are based on Internet Protocol,
such as MODBUS TCP and Ethernet/IP, and some of them are not,

I.-H. Liu et al. / Journal of Robotics, Networking and Artificial Life 8(1) 29–32

30

such as EtherCAT and PROFINET. For the following discussion,
we will focus on MODBUS TCP.

2.1. Industrial Ethernet
In addition to Ethernet interfaces on the ICS devices like PLC andHuman Machine Interface (HMI), Ethernet switches and cables arealso needed to build the network, and there are some differences
between common and industrial Ethernet products. Dependingon the different environments, the industrial cables may havehigh-quality foil and braid to protect data transmission from electromagnetic interference (EMI) [3], use cable jackets with different
materials like fluorinated ethylene propylene (FEP) and thermoplastic elastomer (TPE) for durability [4], or have M12 and M8connectors instead of common 8P8C (commonly called RJ45) to
be waterproof. Besides the difference of the connectors, the industrial Ethernet switches have other features comparing to commonswitches. Let us take Cisco industrial Ethernet 4000 series switches(IE-4000) [5] for example. IE-4000 can work in extreme environments and temperature range (−40 to 70°C), has a durable design,
support power over Ethernet up to 240 W, and so on.
To sum up, the main difference between industrial and common
Ethernet products is the durability in different environments andthe features in use and management. There is no change to the datatransmission standards.

2.2. MODBUS Messaging on TCP/IP
MODBUS is a popular communication protocol in industrial environments because it is opened and does not need a license fee. The
Protocol Data Unit (PDU) of MODBUS is simple. It only consistsof function code and data. Depending on the function codes andrequest or response, the following data structure is different. For
example, function code 03 is reading multiple holding registers, therequest data structure is composed of 2 bytes starting address and2 bytes quantity of registers, and the response data structure is composed of 1 byte following data size and the value of registers [6].
MODBUS Messaging on TCP/IP, or MODBUS TCP for short,as the name suggests, is MODBUS implemented on the Internet
Protocol Suite commonly known as TCP/IP (Figure 1), and theport number of it is 502. The data frame of MODBUS TCP is composed of six parts (Figure 2). Transaction identifier is for pairing
the request and response. Protocol identifier is used for internal
system multiplexing, and value 0 stands for MODBUS protocol.
The length field is the byte count of the rest part including unit

Figure 1 | MODBUS on TCP/IP.

Figure 2 | MODBUS TCP data frame.

identifier, function code, and data field. Unit identifier is used forthe internal system routing purpose. Function code and data field
are MODBUS PDU [7].

3. ATTACKING AN ETHERNET-ENABLED
ICS NETWORK
3.1. Scenario
Since ICS with IT brings vulnerabilities, the attacker could use
those vulnerabilities to inject a backdoor into the computers in theICS, bypass the information security protection measures, and perform malicious operations. For example, due to the vulnerabilities
from IT, an attacker could implant a Trojan horse into the EWS
in the ICS via social engineering to bypass the firewall and invade
into the ICS network. After the attacker gain the access to the ICS
network, the attacker can perform any malicious operations on theICS. Therefore, assuming that the attacker is able to access the ICS
network with some method like backdoor, we generalized a procedure to get the information of the ICS and attack it (Figure 3).

3.2. Procedure
The first thing to do is scanning the internal network. In most internal ICS networks, due to the weakness of IT security in ICS, there
is no protection method like intrusion detection system (IDS) andintrusion prevention system (IPS). Therefore, by scanning the network, the attacker can observe the information in the ICS network
such as enabled services, subnets’ range, the number of devices,manufacturer of devices, and so on. After obtaining the information of the ICS network, according to the information, the attacker
can formulate detailed attack methods such as man-in-the-middle
attack with Address Resolution Protocol (ARP) spoofing to compromise the information security and operation safety in the ICS.

4. CASE STUDY
The ICS that we are going to demonstrate the procedure on is thesame as our previous study [8]. The ICS is composed of tens ofPLCs to control the field equipment and one computer as the HMI
to gather data and control PLCs. All of them are connected to an
Ethernet switch.
First, we used a tool called Nmap to scan the ICS network. In theresult, we can see the information of online devices, such as IPaddress, enabled services, and MAC address, and we can identify
that the manufacture of PLC is Telemecanique Electrique whichis Schneider Electric from the MAC address. Therefore, we speculated that the communication protocol of the PLCs is MODBUS,
because MODBUS is widely used in products of Schneider.
We tried to read the holding registers with standard MODBUS

I.-H. Liu et al. / Journal of Robotics, Networking and Artificial Life 8(1) 29–32

31Figure 3 | The scenario and procedure of attack in an Ethernet-enabled ICS network.

knowledge of the ICS. As the widespread use of IT infrastructure inICS, we must pay more attention to the cyber security in ICS.

CONFLICTS OF INTEREST
The authors declare they have no conflicts of interest.

Figure 4 | The MODBUS TCP packets with function code 90.

function code 03 with the MODBUS TCP testing tool, and we succeeded to read the values. With this operation, the confidentialityof the system is compromised. Furthermore, the writing holding
registers’ function code 16 also works. We succeeded to change thevalues of registers. With this operation, the integrity of the system
is compromised, and the availability may be affected.
In our previous study, we used the integrated development environment (IDE) called TwidoSuite to perform some malicious operation on the PLC. This time, we use a tool called Wireshark to record
the MODBUS TCP packets between the IDE and the PLC, and thentry to repeat the attack. Unlike the standard MODBUS TCP, thefunction code of those packets is 90 (Figure 4), which is manufacturer defined. It is not able to just do the replay attack because of theauthentication mechanism in the data field of MODBUS PDU corresponding to the function code. However, we found some rules ofit. We successfully established the connection and commanded theonline PLC to stop. It cannot be restored to the online state through
HMI or restarting the PLC. With this operation, the availability ofthe system is severely compromised.

5. CONCLUSION
In this paper, we discussed the weakness of IT security in the ICS
network, generalized an attacking procedure for the ICS network,
and implemented it to the real industrial system to support theargument. It turns out that we can easily obtain the informationof the ICS with the procedure in the certain scenario without theACKNOWLEDGMENTS
This work was supported by the Ministry of Science and Technology(MOST) in Taiwan under contract numbers MOST 109-2218-E006-014- and MOST 109-2218-E-006-510-.

REFERENCES
[1]

[2]
[3]

[4]
[5]
[6]
[7]
[8]

M. Wollschlaeger, T. Sauter, J. Jasperneite, The future of industrial
communication: automation networks in the era of the internetof things and industry 4.0, IEEE Ind. Electron. Mag. 11 (2017),
17–27.
TSMC, TSMC details impact of computer virus incident, TSMC,Hsinchu, Taiwan, 2018.
Lapp Tannehill, LAPP ETHERLINE® 2 Pair: CAT5 Flexible - 22
AWG - Green, Lapp Tannehill, [Online]. Available from: https://www.lapptannehill.com/etherline-2pair-cat5e-flexible-22awggreen (accessed December 15, 2020).
BELDEN, Category 6 Cable - 7931A, BELDEN, [Online]. Available
from: https://www.belden.com/products/cable/ethernet-cable/industrial-ethernet-cable/7931a (accessed December 15, 2020).
Cisco, Cisco Industrial Ethernet 4000 Series Switches Data Sheet,
Cisco, 2020.
Modbus Organization, MODBUS application protocol specification V1.1b3, Modbus Organization, Hopkinton, 2012.
Modbus Organization, MODBUS messaging on TCP/IP implementation guide v1.0b, Modbus Organization, Hopkinton, 2006.
K.M. Su, I.H. Liu, J.S. Li, The risk of industrial control system:
programmable logic controller default configurations, 2020
International Computer Symposium (ICS), IEEE, Tainan,Taiwan, 2020.

32

I.-H. Liu et al. / Journal of Robotics, Networking and Artificial Life 8(1) 29–32

AUTHORS INTRODUCTION
Dr. I-Hsien Liu

Dr. Jung-Shian Li

He is a research fellow in the Taiwan
Information Security Center @ National
Cheng Kung University (TWISC@NCKU)
and department of Electrical Engineering,
National Cheng Kung University, Taiwan.
He obtained his PhD in 2015 in Computerand Communication Engineering fromthe National Cheng Kung University.
He interests are Cyber-Security, Wireless Network, Group
Communication and Reliable Transmission.

He is a full Professor in the department ofElectrical Engineering, National Cheng
Kung University, Taiwan. He graduatedfrom the National Taiwan University,Taiwan, with BS in 1990 and MS degrees
in 1992 in Electrical Engineering. He
obtained his PhD in 1999 in Computer
Science from the Technical University ofBerlin, Germany. He teaches communication courses and his research interests include wired and wireless network protocol design, network security, and network
management. He is currently involved in funded research projects dealing with optical network, VANET, Cloud security andresource allocation, and IP QoS architectures. He is the directorof Taiwan Information Security Center @ National Cheng Kung
University. He serves on the editorial boards of the International
Journal of Communication Systems.

Mr. Kuan-Ming Su
He was born in Kaohsiung, Taiwan in1997. He received his B.S. degree fromthe department of Electrical Engineering,
National Chung Cheng University,
Taiwan in 2019. He is acquiring the master’s degree in department of ElectricalEngineering / Institute of Computer andCommunication Engineering, National
Cheng Kung University in Taiwan.