## 5 Attack Assumptions and Implementation
### Simulation and Verification  
To prove the validity of this novel method, we build a house temperature control system with an Arduino controller to witness this attack method's impact in the real world. The Arduino is open-source hardware for building digital devices and has installed the OpenPLC software to emulate an actual PLC device. The OpenPLC project was created following the IEC 61131-3 standard, which defines PLCs' basic software architecture and programming languages. Figure 5 has shown the simulation device.  
The house temperature control system will adjust the temperature based on the indoor average and expected temperatures. The average indoor temperature is affected by both the outdoor temperature and the temperature control system. This simulation will set the expected temperature constant (23 to 25 deg C). The knob emulates the outdoor temperature and will be changed in real time. The Arduino emulates the PLC (the controller) and LED lights to emulate the status of control signals. We assume the light is on with 1 and off with 0. All states of lights are shown in Table 3.  
A typical operating temperature control system is shown in Figure 6a, and the control signal is shown in Figure 7a. Normally, the indoor temperature fluctuates synchronously with the outdoor temperature change. When the indoor temperature is lower than expected, the heater will be turned on, and the LED light state is shown in Figure 8a.  
Figure 5: LED light 1 is Off without attacks.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **LED 1** & **LED 2** & **LED 3** & **State** \\ \hline Value & 1 & 1 & 1 & Initial State \\ Value & 0 & 1 & 1 & Heater is ON \\ Value & 1 & 0 & 1 & Heater is OFF \\ Value & 1 & 1 & 0 & Cooler is ON \\ \hline \hline \end{tabular}
\end{table}
Table 3: States of lights.  
Then, we deploy the ransomware attack into the system and set the delivery time to 60,000 s. Figure 6b shows the indoor temperature under attack, and the control signal under attack is shown in Figure 7b.  
Figure 8: The Arduino Under Regular and Attack. (**a**) LED light 2 is Off (Without Attack). (**b**) The attack result of the malicious code (Under Attack).  
Figure 6: The Temperature Under Regular and Attack. (**a**) The Indoor and Outdoor Temperature Without Attack. (**b**) The Indoor and Outdoor Temperature Under Attack.  
Figure 7: The Control Signal Under Regular and Attack. (**a**) The Control Signal Without Attack. (**b**) The Control Signal Under Attack.  
Before delivery time, the system operated as usual, but everything changed when the delivery time was exceeded. The indoor temperature no longer remains in a constant range close to the expected temperature. However, it drops rapidly, eventually approaching the outdoor temperature and synchronizing with it. The control signal no longer changes periodically but remains at zero, which means the controller has stopped working. To the Arduino, the knob can control LED lights as usual after injecting the malicious code before the delivery time expires. However, all LED lights will be turned on after delivery, and the knob can never control them again. The result has shown that our attack can work well in this evaluation, and the result is shown in Figure 8b.  
In this section, we have simulated the PLC by Arduino. The result shows that the novel method can compromise the target without physical knowledge. The next step is to evaluate a natural ICS environment and deploy the ICS-focused ransomware in a real PLC.