# A Simple Experimental Stand for Studying the Network Security Level of Power Electronic Devices
## 2 Types of Cyber-Attacks and Vulnerabilities Applicable to Power Electronic Devices
### Attacks Specific to PEDs
#### 2.2.1 Attacks Aimed at Blocking Access to the PED  
Denial-of-service (DoS) are attacks in which a device's resources are overloaded and it cannot respond to the received requests. Distributed denial-of-service (DDoS) is the same attack as DoS, except that the source of the attack is not a single device, but multiple devices that are infected with malware controlled by the attacker. **TCP SYN flood attack:** in this attack, the attacker exploits the working principle of the TCP protocol. TCP is connection oriented, i.e., before the data exchange between the client and the web server of the PED is started, an exchange procedure of service packets is started during which the way of the real data exchange is determined. During this session establishment process between the client and the server, the attacker device (the client) floods the attacked device (the web server of the PED) with connection requests (TCP SYN packets). The server responds to the sent requests, but the attacking device does not. This causes the attacked system (web server of the PED) to wait. While it waits for a response from the attacker device (it waits for the TCP ACK packets), the attacker continues to continuously send new requests (TCP SYN packets) to which the web server of the PED responds. This causes the web server of the PED to crash or become unusable when the connection request queue fills up--Figure 1.  
There are many other TCP DoS attacks such as TCP ACK attack, TCP FIN attack, TCP RST attack, which aim to restrict legitimate access to the corresponding PED. **Teardrop attack:** this is a type of denial of service (DoS) attack that uses fragmented data packets to flood the web server of the PED or the victim's network. The attack results in overlapping length compensation fields and fragmentation in successive packets in the attacked device. The attacked device attempts to reconstruct the packets but fails. This causes the connection to the device to crash. These attacks typically target servers that have existing TCP/IP vulnerabilities. Ultimately, they exploit the way IP packets are fragmented and reassembled to bypass traditional security controls. **Smurf attack:** this attack involves using IP spoofing and ICMP to saturate the attacked device with traffic. This attack method uses ICMP echo requests directed to broadcast IP addresses. First, the attacker uses malware to create spoofed packets whose source address is set as the IP address of the attacked device--the PED. The packet is then sent to the IP broadcast address of a router. The router sends requests to every device in the broadcast network, with the number of requests increasing with the number of devices in the network. Each device in the network receives the request from the router and then responds to the spoofed address with ICMP Echo Reply packets. The PED receives a stream of ICMP Echo Reply packets. As a result, the PED's embedded web server can be overloaded and cause a denial of service. This process is repetitive and can be automated to generate huge amounts of traffic, which can also lead to network congestion--Figure 2.  
**Ping of dead:** this type of attack uses IP packets to \"ping\" the PED with an IP packet size above the maximum of 65,535 bytes. IP packets of this size are not allowed, so the attacker fragments the IP packet into smaller packets. Once the attacked device (the web server of the PED) assembles the packet, it may experience buffer overflows and other crashes. Figure 1: TCP SYN flood attack. **Botnets:** botnets are systems infected with malware that are under foreign control for the purpose of carrying out DDoS attacks. These bots or zombie systems are used to carry out attacks against various devices and networks. For example, an attack can be built like this to attack a PED. As a result of the bot attacks, the attacked PED is rendered inoperable due to overloading its embedded web server or taking up all the bandwidth on the network where it is installed.