EC-Council Certified Ethical Hacker (CEH) v12Mobile Platform, IoT, and OT HackingMedium
A penetration tester is evaluating the security of a Supervisory Control and Data Acquisition (SCADA) system in a water treatment facility. They gain access to the human-machine interface (HMI) and discover that it directly communicates with remote terminal units (RTUs) using an unencrypted, proprietary protocol over a wide area network (WAN). The RTUs control critical pumps and valves. Which of the following attack types is the most significant threat due to this specific communication vulnerability?
- ASQL injection against the SCADA database
- BDenial of Service (DoS) on the HMI web server
- CMan-in-the-Middle (MITM) attack
- DCross-site scripting (XSS)
Show answer & explanationAnswer & explanation
Correct answer: C. Man-in-the-Middle (MITM) attack
An unencrypted, proprietary protocol over a WAN connecting HMI to RTUs is highly vulnerable to a Man-in-the-Middle (MITM) attack. An attacker could intercept, read, and potentially modify commands sent to the RTUs or data received from them, directly impacting physical operations.
Why the other options are wrong
- A. SQL injection targets databases and is not directly related to the unencrypted proprietary protocol used for operational control.
- B. DoS on the HMI web server is a general web vulnerability, not specifically targeting the unencrypted proprietary protocol between HMI and RTUs.
- D. XSS targets web applications and is not directly related to the unencrypted proprietary protocol between HMI and RTUs.
OT Man-in-the-Middle
An attack where an adversary intercepts and potentially alters communication between two OT components, such as an HMI and a PLC/RTU, often leveraging unencrypted or unauthenticated protocols.
- Allows eavesdropping on critical industrial commands and data.
- Enables modification of commands to cause physical disruption.
- Often facilitated by lack of encryption and strong authentication in OT protocols.
Memory trick: Unencrypted OT talks, the 'middle' listens and lies.