On the Significance of Process Comprehension for Conducting Targeted ICS Attacks

The exploitation of Industrial Control Systems (ICSs) has been described as both easy and impossible, where is the truth? Post-Stuxnet works have included a plethora of ICS focused cyber secu- rity research activities, with topics covering device maturity, network protocols, and overall cyber security culture. We often hear the notion of ICSs being highly vulnerable due to a lack of inbuilt security mechanisms, considered a low hanging fruit to a variety of low skilled threat actors. While there is substantial evidence to support such a notion, when considering targeted attacks on ICS, it is hard to believe an attacker with limited resources, such as a script kiddie or hacktivist, using publicly accessible tools and exploits alone, would have adequate knowledge and resources to achieve targeted operational process manipulation, while simultaneously evade detection. Through use of a testbed environment, this paper provides two practical examples based on a Man-In-The-Middle scenario, demonstrating the types of information an attacker would need obtain, collate, and comprehend, in order to begin targeted process manipulation and detection avoidance. This allows for a clearer view of associated challenges, and illustrate why targeted ICS exploitation might not be possible for every malicious actor

Identification of <i>Fusarium virguliforme</i> FvTox1-Interacting Synthetic Peptides for Enhancing Foliar Sudden Death Syndrome Resistance in Soybean

<div><p>Soybean is one of the most important crops grown across the globe. In the United States, approximately 15% of the soybean yield is suppressed due to various pathogen and pests attack. Sudden death syndrome (SDS) is an emerging fungal disease caused by <i>Fusarium virguliforme</i>. Although growing SDS resistant soybean cultivars has been the main method of controlling this disease, SDS resistance is partial and controlled by a large number of quantitative trait loci (QTL). A proteinacious toxin, FvTox1, produced by the pathogen, causes foliar SDS. Earlier, we demonstrated that expression of an anti-FvTox1 single chain variable fragment antibody resulted in reduced foliar SDS development in transgenic soybean plants. Here, we investigated if synthetic FvTox1-interacting peptides, displayed on M13 phage particles, can be identified for enhancing foliar SDS resistance in soybean. We screened three phage-display peptide libraries and discovered four classes of M13 phage clones displaying FvTox1-interacting peptides. <i>In vitro</i> pull-down assays and <i>in vivo</i> interaction assays in yeast were conducted to confirm the interaction of FvTox1 with these four synthetic peptides and their fusion-combinations. One of these peptides was able to partially neutralize the toxic effect of FvTox1 <i>in vitro</i>. Possible application of the synthetic peptides in engineering SDS resistance soybean cultivars is discussed.</p></div

Diagrammatic representation of the workflow applied in affinity purification of M13 phage clones that displayed FvTox1-interacting synthetic peptides.

<p>(A), Bio-panning of the phage display libraries on plastic surface of a microtiter plates coated with 1.5 ml FvTox1 (30 ng/μl). Unbound phage particles were washed off; and M13 phage particles bound to FvTox1 were used to infect <i>E</i>. <i>coli</i> for starting a second round of panning. The process was repeated once more. (B), Plating of candidate M13 phage clones displaying FvTox1-interacting peptides. An eluate from the last panning in A was plated on X-gal/IPTG agar plates. (C), Identification of candidate M13 phage clones displaying FvTox1-interacting peptides. Phage clones were adsorbed onto nitrocellulose paper and hybridized to the His-tagged purified FvTox1 proteins. FvTox1-interacting clones were identified by detecting FvTox1 with the anti-His antibody. (D), Western blot analysis of the selected phage clones for interaction with FvTox1. Selected M13 phage particles from plates in C were transferred to nitrocellulose filters and hybridized to FvTox1, which was detected with an anti-His antibody. (E), Western blot analysis of the selected clones for interaction with FvTox1. Selected clones in D were reinvestigated for interaction with FvTox1, adsorbed onto a nitrocellulose membranes and detecting the interaction of individual clones to FvTox1 with an anti-M13 antibody (Details are presented in <a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.s002" target="_blank">S2 Fig</a>). (F), Electropherogram of a nucleotide molecule encoding an FvTox1-intearcting peptide is presented.</p

<i>In vitro</i> and <i>in vivo</i> interactions of putative FvTox1-interacting peptides with FvTox1.

<p>(A), Pull down assays of nine putative FvTox1-interacting peptides was conducted by binding the <i>E</i>. <i>coli</i> expressed fusion peptides (<a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.g002" target="_blank">Fig 2</a>) to FvTox1, which was immobilized on the GST-column. The FvTox1-interacting peptides pulled down by FvTox1 were detected with an anti-His antibody. The strengths of interactions between individual synthetic peptides with FvTox1 are presented in <a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.t004" target="_blank">Table 4</a>. (B), <i>In vivo</i> interactions of nine putative FvTox1-interacting fusion peptides with FvTox1 in a yeast two-hybrid system. Nine synthetic genes shown in Fig 3A, were cloned as fusion genes with the DNA activation domain of the pB42D plasmid. In nine additional constructs, two cysteine residues were added, one on each side the nine FvTox1-interacting peptides. β-galactosidase activities showing the extent of interaction of individual Fv-Tox1-interacting peptides with FvTox1 are presented in <a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.t004" target="_blank">Table 4</a>. Control 1, empty pB42AD vector. Control 2, soybean <i>GmTRX3</i> gene encoding a thioredoxin protein that interacts with FvTox1 (B. Wang and M.K. Bhattacharyya, unpublished). Control 3, soybean <i>GmGD1</i> gene encoding a glycine cleavage protein that interacts with FvTox1 (B. Wang and M.K. Bhattacharyya, unpublished).</p

Reduced foliar SDS symptom development by cell-free <i>Fv</i> culture filtrates, pre-adsorbed with the FvTox1-interacting PEP1.

<p>(A), Chlorotic and necrotic leaf symptoms were recorded on day 8 following feeding of cut soybean seedlings with cell-free <i>Fv</i> culture filtrates that were pre-adsorbed with individual M13 phage displayed peptides (<a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.t005" target="_blank">Table 5</a>). (B), Reduced foliar SDS symptoms were induced in seedlings that were fed with cell-free <i>Fv</i> culture filtrates pre-adsorbed with PEP1 as compared to cell-free <i>Fv</i> culture filtrates (CF), or CF, pre-adsorbed with any of the other three peptides, PEP2, PEP3 or PEP4. (C), Reduced chlorophyll contents in all treatments except water control and CF pre-adsorbed with PEP1. (D), <i>In vitro</i> pull down assays of FvTox1 from CF using His-tagged FvTox1-interacting peptides (<a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.t005" target="_blank">Table 5</a>). FvTox1 was detected using anti-FvTox1 antibody [<a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.ref007" target="_blank">7</a>]. Error bars indicate the standard errors calculated from means of three biological replications.</p

Expression of putative FvTox1-interacting peptides in <i>Escherchia coli</i>.

<p>(A), Schematic representation of nine fusion synthetic genes developed from four putative FvTox1-interacting peptide encoding genes isolated from the recombinant M13 phages (<a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.s006" target="_blank">S2 Table</a>). L represents linker. P1, P2, P3, and P4 are four peptides, PEP1, PEP2, PEP3, and PEP4, respectively, identified from four classes of phages, Classes 1, II, III and IV, respectively (<a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.t002" target="_blank">Table 2</a>). L, linker sequence GGGSGGGSGGGS. (B), Purified nine putative FvTox1-interacting proteins expressed from the nine synthetic genes (A) in <i>E</i>. <i>coli</i> (<a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.s006" target="_blank">S2 Table</a>). Arrows show the respective proteins.</p

Expression of <i>GmARP1</i> enhances SDS resistance in transgenic soybean plants.

<p>R₁ plants were tested for resistance to <i>F</i>. <i>virguliforme</i> under growth chamber conditions. A. Root phenotype of a resistant (R) and a susceptible (S) R₁ progeny of a transformant, Prom2-ARP1-7, carrying the <i>Prom2-GmARP1</i> fusion gene. B. Enhanced foliar SDS resistance among R₁ progenies. W82, the SDS susceptible line Williams 82; MN1606, the SDS resistant line. C. Chlorophyll content per individual R₁ progeny carrying <i>GmARP1</i> of three independent transformants. ‘Resistant’ and ‘Susceptible’ classes are defined as in (A). D. Average root weight of R₁ progeny of three independent transformants. ‘Resistant’ and ‘Susceptible’ classes are defined as in A. E. Enhanced root resistance among R₁ progenies. Extent of root resistance to the pathogen was expressed in percent; e.g., 100%, healthy roots with no obvious blackening caused by necrosis and rotting due to infection of <i>F</i>. <i>virguliforme</i>. F. Expression of <i>GmARP1</i> transgenes. Two random SDS resistant and susceptible R₁ progenies from each R₀ line were analyzed. Top panel, resistant plants (two representatives from each line). Bottom panel, susceptible plants (two representatives from each line). Red arrow, <i>GmARP1</i>; black arrow, <i>ELF1b</i> internal control. *, significantly different at <i>p<0</i>.<i>01</i>. Results are means ±SE of three independent experiments.</p

Reduced expression levels of soybean genes following <i>F</i>. <i>virguliforme</i> infection as compared to the water control.

<p>A. Expression levels of four selected soybean genes following water treatment at early (S1: 3 and 5 d) and late time (S2: 10 and 24 d) periods and <i>F</i>. <i>virguliforme</i> infection at early (S3: 3 and 5 d) and late time (S4: 10 and 24 d) periods. B. RT-PCR analyses of the selected soybean genes. RT-PCR products of each of the four selected soybean amplified from RNAs of root tissues harvested 8 and 12 h, and 1, 2, 3, 5 days following (i) water treatment or (ii) infection with the <i>F</i>. <i>virguliforme</i> Mont-1. The results presented here are from one of three independent experiments showing similar results. <i>Glyma12g12470</i> is from the Glyma.Wm82.a1.v1.1 version of the soybean genome sequence. Other three genes are from the recent version of the soybean genome sequence (Glyma.Wm82.a2v1). <i>Elf1b</i>, elongation factor 1-β encoded by <i>Glyma02g44460</i>. C–F. Quantified expression levels of four selected genes. Gel pictures of the three biological replications are presented in <a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0163106#pone.0163106.s008" target="_blank">S8 Fig</a>.</p

Genes down-regulated at late time period in soybean roots infected with <i>F</i>. <i>virguliforme</i>.

<p>Genes down-regulated at late time period in soybean roots infected with <i>F</i>. <i>virguliforme</i>.</p

Genes down-regulated (with FC >10) in soybean roots during early time period following infection with <i>F</i>. <i>virguliforme</i>.

<p>The full list is reported in <a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0163106#pone.0163106.s014" target="_blank">S2 Dataset</a>.</p