# Down the Rabbit Hole: Fostering Active Learning through Guided Exploration of a SCADA Cyber Range
## 4 Guided Learning, Hands-On: Course Plan and Execution Strategy
### Attack Planning and Deployment  
This constitutes the final course module, being structured around a \"what if?\" perspective on attack execution and outcome analysis (see Figure 18). Instead of focusing on providing theoretical knowledge about attack techniques, trainees are allowed to execute attacks by themselves and observe the results. For this purpose, the CANVAS framework constitutes an ideal platform, as it was designed for easy recoverability in case of failure. This is further reinforced by the existence of Out-of-Band management mechanisms, as well as the introduction of STONITH (an acronym for _Shoot The Other Node In The Head_, a term commonly used in active-passive cluster setups to designate remotely controlled power sockets that allow to cut off the power or power cycle a specific node) modules the allow to remotely cycle or power up any device in the physical process testbed. This module starts with a review of the classic Layer 2/3 attack flooding techniques. While experience acquired from the IT field may have provided trainees with an intuition about the effects of targeting a specific network node, both in terms of network performance or communications/service degradation, the effects on ICS automation devices may be more radical, causing resource exhaustion or even equipment crashes. The fundamental principles behind most of the attacks hereby described are documented in past work from the authors [38], which is also suggested as reading material. To properly understand the potential effects of the aforementioned flooding attacks, students are introduced to the _hping3_[39] tool, which is used to generate ICMP, SYN or  
Figure 18: Organization of the third training module (5.5 h). UDP floods against cyber range nodes, using combinations of different transmission rates, spoofed source addresses (or even random source IPs), specific TCP flags, variable payload sizes and large windows. The _nping_[40] tool is also used for similar purposes, with other attack profiles also being tested (such as _Smurf_ or _Land_ attacks [41]). Once attacks start, students are asked to check both the traffic mirror interface and the physical process HMI to analyze and observe the attack effects. Quite often, traffic floods are enough to blind the HMI (see Figure 19), causing loss of process visibility due to communications channel exhaustion, or even device unavailability. The latter case may be triggered quite easily due to the fact the M340 PLC tends to crash and become permanently unavailable (until the next power cycle) due to weaknesses in the TCP/IP stack implemented in the specific firmware version in use. Besides layer 2/3, layer 7 flooding attacks are also analyzed, with a special focus on Modbus API abuse through means of variable frequency read and write operations (using the _smod_ tool or the _metasploit modbusclient_[42] module). Due to the lack of authentication of access control mechanisms, Modbus devices are often vulnerable to these sort of attacks, with unpredictable results. Moreover, and for similar reasons (lack of authentication), Metasploit can also be used to download the project running on M340 PLCs, by using the _modicon_stux_transfer_[43] module. The next stage is dedicated to the review of the ARP protocol. The protocol state machine is analyzed, with a main concern in mind: bring to evidence its stateless nature, as well as the absence of security mechanisms, something that can be traced back to its roots. This step is also valuable to familiarize the trainees with the main vulnerabilities which are implicit to the protocol design, namely, the possibility of abusing it to deploy a MiTM attack (see Figure 20). Such attacks can be used both as part of a scouting procedure (to better understand the nature of the communications between nodes) or to corrupt in-flight process data, by manipulating Modbus ADUs. For this purpose, trainees are introduced to the _ettercap_[44] and _bettercap_[45] tools, which are used to prepare and deploy the ARP MiTM attacks.