On the Significance of Process Comprehension for Conducting Targeted ICS Attacks

The exploitation of Industrial Control Systems (ICSs) has been described as both easy and impossible, where is the truth? Post-Stuxnet works have included a plethora of ICS focused cyber secu- rity research activities, with topics covering device maturity, network protocols, and overall cyber security culture. We often hear the notion of ICSs being highly vulnerable due to a lack of inbuilt security mechanisms, considered a low hanging fruit to a variety of low skilled threat actors. While there is substantial evidence to support such a notion, when considering targeted attacks on ICS, it is hard to believe an attacker with limited resources, such as a script kiddie or hacktivist, using publicly accessible tools and exploits alone, would have adequate knowledge and resources to achieve targeted operational process manipulation, while simultaneously evade detection. Through use of a testbed environment, this paper provides two practical examples based on a Man-In-The-Middle scenario, demonstrating the types of information an attacker would need obtain, collate, and comprehend, in order to begin targeted process manipulation and detection avoidance. This allows for a clearer view of associated challenges, and illustrate why targeted ICS exploitation might not be possible for every malicious actor

Analyses of the Xylem Sap Proteomes Identified Candidate <i>Fusarium virguliforme</i> Proteinacious Toxins

<div><p>Background</p><p>Sudden death syndrome (SDS) caused by the ascomycete fungus, <i>Fusarium virguliforme</i>, exhibits root necrosis and leaf scorch or foliar SDS. The pathogen has never been identified from the above ground diseased foliar tissues. Foliar SDS is believed to be caused by host selective toxins, including FvTox1, secreted by the fungus. This study investigated if the xylem sap of <i>F. virguliforme-</i>infected soybean plants contains secreted <i>F. virguliforme-</i>proteins, some of which could cause foliar SDS development.</p><p>Results</p><p>Xylem sap samples were collected from five biological replications of <i>F. virguliforme</i>-infected and uninfected soybean plants under controlled conditions. We identified five <i>F. virguliforme</i> proteins from the xylem sap of the <i>F. virguliforme-</i>infected soybean plants by conducting LC-ESI-MS/MS analysis. These five proteins were also present in the excreted proteome of the pathogen in culture filtrates. One of these proteins showed high sequence identity to cerato-platanin, a phytotoxin produced by <i>Ceratocystis fimbriata</i> f. sp. <i>platani</i> to cause canker stain disease in the plane tree. Of over 500 soybean proteins identified in this study, 112 were present in at least 80% of the sap samples collected from <i>F. virguliforme</i>-infected and -uninfected control plants. We have identified four soybean defense proteins from the xylem sap of <i>F. virguliforme</i>-infected soybean plants. The data have been deposited to the ProteomeXchange with identifier PXD000873.</p><p>Conclusion</p><p>This study confirms that a few <i>F. virguliforme</i> proteins travel through the xylem, some of which could be involved in foliar SDS development. We have identified five candidate proteinaceous toxins, one of which showed high similarity to a previously characterized phytotoxin. We have also shown the presence of four soybean defense proteins in the xylem sap of <i>F. virguliforme</i>-infected soybean plants. This study laid the foundation for studying the molecular basis of foliar SDS development in soybean and possible defense mechanisms that may be involved in conferring immunity against <i>F. virguliforme</i> and other soybean pathogens.</p></div

Classification of the 112 most abundant proteins identified from xylem saps of both <i>F. virguliforme-</i>infected and <i>F. virguliforme-</i>uninfected soybean plants based on molecular function.

<p>(A) Percentage of proteins in different functional categories at ontology level 2, with a cutoff of 5. (B) Secondary functional categories based on KEGG pathway. Only the prominent pathways with a sequence cutoff of 3 are reported here.</p

Soybean proteins differentially accumulated in the <i>F. virguliforme</i>-infected (A) or <i>F. virguliforme</i>-uninfected (B) soybean plants.

a<p><i>Glycine max</i> protein identification number from Phytozome database.</p>b<p>Number of times the peptides were identified among five biological replications.</p>c<p>Exponentially modified protein abundance index.</p

Soybean proteins identified from the xylem saps of both <i>F. virguliforme</i>-infected and -uninfected, healthy soybean plants.

a<p><i>Glycine max</i> protein identification number from Phytozome database (<a href="http://www.phytozome.net/search.php" target="_blank">http://www.phytozome.net/search.php</a>).</p>b<p>Exponentially modified protein abundance index.</p

<i>F. virguliforme</i> peptides identified from the xylem sap of <i>F. virguliforme-</i>infected soybean plants.

a<p>Protein identification numbers are same as the gene IDs of the <i>F. virguliforme</i> genome database (<a href="http://fvgbrowse.agron.iastate.edu" target="_blank">http://fvgbrowse.agron.iastate.edu</a>) <a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0093667#pone.0093667-Srivastava1" target="_blank">[56]</a>.</p>b<p>Number of times the peptides were identified from five biological replicates of xylem saps collected from <i>F. virguliforme</i>-infected soybean plants. The total number of times a peptide(s) was identified is presented in parentheses.</p>C<p>Exponentially modified protein abundance index. This equals to 10^PAI-1, which is proportional to the protein content in a protein mixture.</p

Collection of xylem sap from 14 to 21-day old <i>F. virguliforme-</i>infected or -uninfected soybean plants.

<p>The free end of a rubber tube attached to a 1 mL syringe was securely fasten to the cut soybean hypocotyl and sealed with Vaseline. Low pressure was created by pulling the plunger of the syringe to facilitate xylem sap accumulation.</p

Identification of <i>Fusarium virguliforme</i> FvTox1-Interacting Synthetic Peptides for Enhancing Foliar Sudden Death Syndrome Resistance in Soybean

<div><p>Soybean is one of the most important crops grown across the globe. In the United States, approximately 15% of the soybean yield is suppressed due to various pathogen and pests attack. Sudden death syndrome (SDS) is an emerging fungal disease caused by <i>Fusarium virguliforme</i>. Although growing SDS resistant soybean cultivars has been the main method of controlling this disease, SDS resistance is partial and controlled by a large number of quantitative trait loci (QTL). A proteinacious toxin, FvTox1, produced by the pathogen, causes foliar SDS. Earlier, we demonstrated that expression of an anti-FvTox1 single chain variable fragment antibody resulted in reduced foliar SDS development in transgenic soybean plants. Here, we investigated if synthetic FvTox1-interacting peptides, displayed on M13 phage particles, can be identified for enhancing foliar SDS resistance in soybean. We screened three phage-display peptide libraries and discovered four classes of M13 phage clones displaying FvTox1-interacting peptides. <i>In vitro</i> pull-down assays and <i>in vivo</i> interaction assays in yeast were conducted to confirm the interaction of FvTox1 with these four synthetic peptides and their fusion-combinations. One of these peptides was able to partially neutralize the toxic effect of FvTox1 <i>in vitro</i>. Possible application of the synthetic peptides in engineering SDS resistance soybean cultivars is discussed.</p></div

Diagrammatic representation of the workflow applied in affinity purification of M13 phage clones that displayed FvTox1-interacting synthetic peptides.

<p>(A), Bio-panning of the phage display libraries on plastic surface of a microtiter plates coated with 1.5 ml FvTox1 (30 ng/μl). Unbound phage particles were washed off; and M13 phage particles bound to FvTox1 were used to infect <i>E</i>. <i>coli</i> for starting a second round of panning. The process was repeated once more. (B), Plating of candidate M13 phage clones displaying FvTox1-interacting peptides. An eluate from the last panning in A was plated on X-gal/IPTG agar plates. (C), Identification of candidate M13 phage clones displaying FvTox1-interacting peptides. Phage clones were adsorbed onto nitrocellulose paper and hybridized to the His-tagged purified FvTox1 proteins. FvTox1-interacting clones were identified by detecting FvTox1 with the anti-His antibody. (D), Western blot analysis of the selected phage clones for interaction with FvTox1. Selected M13 phage particles from plates in C were transferred to nitrocellulose filters and hybridized to FvTox1, which was detected with an anti-His antibody. (E), Western blot analysis of the selected clones for interaction with FvTox1. Selected clones in D were reinvestigated for interaction with FvTox1, adsorbed onto a nitrocellulose membranes and detecting the interaction of individual clones to FvTox1 with an anti-M13 antibody (Details are presented in <a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.s002" target="_blank">S2 Fig</a>). (F), Electropherogram of a nucleotide molecule encoding an FvTox1-intearcting peptide is presented.</p

<i>In vitro</i> and <i>in vivo</i> interactions of putative FvTox1-interacting peptides with FvTox1.

<p>(A), Pull down assays of nine putative FvTox1-interacting peptides was conducted by binding the <i>E</i>. <i>coli</i> expressed fusion peptides (<a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.g002" target="_blank">Fig 2</a>) to FvTox1, which was immobilized on the GST-column. The FvTox1-interacting peptides pulled down by FvTox1 were detected with an anti-His antibody. The strengths of interactions between individual synthetic peptides with FvTox1 are presented in <a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.t004" target="_blank">Table 4</a>. (B), <i>In vivo</i> interactions of nine putative FvTox1-interacting fusion peptides with FvTox1 in a yeast two-hybrid system. Nine synthetic genes shown in Fig 3A, were cloned as fusion genes with the DNA activation domain of the pB42D plasmid. In nine additional constructs, two cysteine residues were added, one on each side the nine FvTox1-interacting peptides. β-galactosidase activities showing the extent of interaction of individual Fv-Tox1-interacting peptides with FvTox1 are presented in <a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0145156#pone.0145156.t004" target="_blank">Table 4</a>. Control 1, empty pB42AD vector. Control 2, soybean <i>GmTRX3</i> gene encoding a thioredoxin protein that interacts with FvTox1 (B. Wang and M.K. Bhattacharyya, unpublished). Control 3, soybean <i>GmGD1</i> gene encoding a glycine cleavage protein that interacts with FvTox1 (B. Wang and M.K. Bhattacharyya, unpublished).</p