Work-in-Progress: Compromising Security of Real-time Ethernet Devices by means of Selective Queue Saturation Attack

The industrial control systems (ICS) are using Real-Time Ethernet (RTE) protocols for many years. Today, Ethernet based control systems are widely used in industries. The Time Sensitive Networking (TSN) initiative will definitely push their further diffusion. With the introduction of Industry 4.0, production machines and their components have been connected to the Internet. Currently adopted RTE protocols do not require authentication, and hence may exchange data also with potentially malicious partners. In this paper, a selective Denial of Service (DoS) attack is presented. The proposed Selective Queue Saturation Attack (SQSA) is aimed to jam the message queue of the RTE communication stack in selected devices. The SQSA minimizes the chances of being detected by keeping its requirements (in term generated traffic) as low as possible. The SQSA has been applied to a real scenario based on PROFINET. The results of the use case demonstrate: the feasibility of the proposed attack; the reduced footprint compared to known DoS attacks (more than one thousand times less); and the selectivity of the attack, which can disrupt the realtime behavior of even a single target node inside the RTE network.