Chapter 20 — OT, IoT and cyber-physical security: foundational cases
Lesson map
Lesson 20 published. Map, example, EX058.
flowchart TD
N0["Learning outcomes"]
N1["20.1 Ukraine power grid, December 2015"]
N2["20.2 Mirai, 2016"]
N3["20.3 Water treatment facility, February 2021"]
N4["20.4 Reading cases carefully"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX058"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["20.1 Ukraine power grid, December 2015"]
N2["20.2 Mirai, 2016"]
N3["20.3 Water treatment facility, February 2021"]
N4["20.4 Reading cases carefully"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX058"]
[Learning outcomes]
|
v
[20.1 Ukraine power grid, December 2015]
|
v
[20.2 Mirai, 2016]
|
v
[20.3 Water treatment facility, February 2021]
|
v
[20.4 Reading cases carefully]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX058]
Learning outcomes
You will (1) summarise three documented incidents from primary sources; (2) extract the attack path and the defensive lesson from each; (3) distinguish what is publicly confirmed from speculation; and (4) relate each case to LDHP.
20.1 Ukraine power grid, December 2015
The US ICS-CERT alert IR-ALERT-H-16-056-01 reports that three Ukrainian regional electric power distribution companies suffered coordinated cyber attacks causing outages that affected about 225,000 customers. The alert reports that the actors probably used legitimate credentials acquired beforehand for remote access, wiped systems with KillDisk malware, overwrote some HMIs and corrupted the firmware of serial-to-Ethernet devices at substations. Power was restored, but the companies continued under constrained operations. Lesson: stolen credentials and remote access were the path, and recovery depended on being able to run without the damaged automation.
20.2 Mirai, 2016
Antonakakis et al. ("Understanding the Mirai Botnet", USENIX Security 2017) measured a botnet that infected hundreds of thousands of IoT devices, largely by logging in with factory-default credentials over Telnet, and then launched large denial-of-service attacks. Lesson: universal default passwords at scale are an infrastructure risk — which is exactly what ETSI EN 303 645 provision 5.1 prohibits.
LDHP's analogue is its meter gateways: if they shipped with one default password across the fleet, a Mirai-style scan would find every one of them reachable from the internet. Chapter 30's MTR-B, which fails provision 5.1, is the meter model in that position.
20.3 Water treatment facility, February 2021
CISA advisory AA21-042A describes unauthorised access to a US drinking-water treatment plant's SCADA system through remote-access software, with an attempt to raise sodium hydroxide levels. Plant personnel noticed and corrected the change before the SCADA software alarmed. The advisory names desktop-sharing software and an end-of-life operating system as likely weaknesses. Lesson: operator vigilance matters, and remote-access tools are part of the attack surface.
LDHP's analogue is its own always-on vendor remote-desktop tool, which Maya replaced with brokered four-hour sessions.
20.4 Reading cases carefully
Each source documents some facts and not others. Write what the source says, cite it, and mark everything else as inference. Popular retellings often add certainty the primary report does not have.
Maya's case table follows this rule. For the 2021 water facility she records only what AA21-042A states, remote-access software, desktop-sharing and an end-of-life operating system, and marks her LDHP analogue, the always-on vendor remote-desktop tool, as her own inference. For Mirai, the infection method comes from Antonakakis et al.'s measurement, not from press summaries. For Ukraine, the lesson she draws, keeping documented manual boiler-start procedures, is labelled as an LDHP recommendation rather than a finding of the source.
Worked example (synthetic LDHP)
Maya builds a table: case, initial access, effect, what stopped it, LDHP analogue. For the 2021 water case the analogue is LDHP's always-on vendor remote-desktop tool (Chapter 13); for Mirai, the meter gateways' default passwords; for Ukraine, the need to operate after automation is damaged — LDHP keeps documented manual boiler-start procedures.
Synthetic case — Lakeside District Heating Plant. Only the LDHP analogues are synthetic; the three cases come from the cited public sources.
Errors and limits
Attribution claims in news reports are not part of this chapter's evidence. Case lessons generalise only where the conditions match.
Exercises
- EX058 — Primary source details. From the 2016 ICS-CERT alert, state the approximate number of customers affected and one action the actors took against field devices. Rubric: 3 = ~225,000 and corrupted serial-to-Ethernet firmware (or KillDisk on HMIs); 2 = one; 1 = wrong figure; 0 = none.
- EX059 — Mirai's entry method. What did Mirai mainly exploit to infect devices and which ETSI provision addresses it? Rubric: 3 = default credentials over Telnet; provision 5.1; 2 = one; 1 = "a zero-day"; 0 = none.
- EX060 — Fact versus inference. Mark as fact-from-source or inference: (a) "an operator reversed the sodium hydroxide change" (b) "the intruder intended mass poisoning". Rubric: 3 = (a) fact from AA21-042A, (b) inference; 2 = one; 1 = both facts; 0 = none.
Synthesis
Read incidents from primary sources, separate fact from story, and turn each into a concrete question about your own plant.
Continue studying — chapter 20 of 40
← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →