## 4 Conducting the Cyber-Attack Scenario and Evaluating the Results
### Attack Platform  
Kali Linux [25] distribution was chosen to unleash the value-changing MITM attack. This platform allows for performing cyber-attack scenarios with the purpose of assessing its consequences. It offers a wide range of tools for information security and ethical hacking-related tasks, such as penetration testing, computer forensics and reverse engineering. In its inventory there are tools tailored exclusively for cyber-attacks against SCADA/ICS. For example, the Metasploit framework, which comes pre-installed by default on Kali, offers modules that can be used to find Modbus servers and clients; and read and write \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Name** & **Class** & **Type** & **Location** & **Description** \\ \hline PB1 & Local & BOOL & \({}^{\circ}\)XLX100.0 & Push button (attack ON) \\ PB2 & Local & BOOL & \({}^{\circ}\)XLX100.1 & Push button (attack OFF) \\ LAMP & Local & BOOL & \({}^{\circ}\)QX100.0 & Warning LED (attack ON) \\ Hccpspeedcmd & Local & UINT & \({}^{\circ}\)QW101 & CC\_PumpSpeedCmd (Higher Byte) \\ Lecpspeedcmd & Local & UINT & \({}^{\circ}\)QW102 & CC\_PumpSpeedCmd (Lower Byte) \\ Hccponoffcmd & Local & UINT & \({}^{\circ}\)QW103 & CC\_PumpOnOfCmd (Higher Byte) \\ Lecponoffcmd & Local & UINT & \({}^{\circ}\)QW104 & CC\_PumpOnOfCmd (Lower Byte) \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Rogue PLC ladder program local variables. Figure 15: Rogue PLC ladder program in OpenPLC Editor. Modbus registers [40]. For some equipment, it is even possible to upload, analyze, and then download and replace the PLC ladder logic (modicon_stux_transfer module) [41]. These Metasploit modules in particular, or exploits, as they are called, could have been used in our testbed to write constant values to the ModRSSim2 server registers and thus achieve the same results as those obtained by the simple Rogue PLC logic just described. As can be seen by the sequence of commands shown in Figure 16, it is possible to employ the \"modubscclient exploit\" to write the values 17,046 and 0000 (value 75) for the two bytes after the 224 address offset (variable CC_PumpSpeedCmd) of the ModRSSim2 Server at IP 10.0.0.2 (ANS VM). Instead, we preferred to demonstrate the HIL implementation capabilities of our testbed, and emphasized its potential for increased programming complexity, and scalability provided by the use of soft PLCs; which allows the developing of cyber-attacks that require a greater knowledge of the plant control system (not addressed in this study). For example, by the external cloning the logic of the internal controller being replaced, it would be possible to enable more subtle attacks to be carried out, with greater control of the manipulated variables and eventual return to normal control whenever desired. In  
Figure 16: Metasploit Modbus injection attack example (CC_PumpSpeedCmd = 75). principle, a well-informed Insider would know the implementation details necessary to perform this procedure. In any case, this point demonstrates the flexibility of the testbed and illustrates an alternative way to perform the same Modbus injection cyber-attack. As for the MITM attack itself, the specific tool used was Ettercap (also present by default on Kali Linux distributions) [26]. It allows us to snoop live TCP/IP connections and to filter content on the fly. In the validation experiment we performed the in-transit change of Modbus response packets from ANS to ScadaBR. This was done in two steps. First, Ettercap applied the ARP poisoning technique (sending unsolicited ARP replies simultaneously to both of its targets) to make ANS (10.0.0.2) believe that the ScabaBR (10.0.0.4) was located in the Kali VM IP address (10.0.0.5); and to make ScabaBR believe that ANS was in Kali address, as shown in Figure 17. Ettercap could now eavesdrop and pass on these packets in both directions. The second step consisted in filtering and changing the ANS responses to Modbus READ requests made by ScadaBR.