On the Significance of Process Comprehension for Conducting Targeted ICS Attacks

The exploitation of Industrial Control Systems (ICSs) has been described as both easy and impossible, where is the truth? Post-Stuxnet works have included a plethora of ICS focused cyber secu- rity research activities, with topics covering device maturity, network protocols, and overall cyber security culture. We often hear the notion of ICSs being highly vulnerable due to a lack of inbuilt security mechanisms, considered a low hanging fruit to a variety of low skilled threat actors. While there is substantial evidence to support such a notion, when considering targeted attacks on ICS, it is hard to believe an attacker with limited resources, such as a script kiddie or hacktivist, using publicly accessible tools and exploits alone, would have adequate knowledge and resources to achieve targeted operational process manipulation, while simultaneously evade detection. Through use of a testbed environment, this paper provides two practical examples based on a Man-In-The-Middle scenario, demonstrating the types of information an attacker would need obtain, collate, and comprehend, in order to begin targeted process manipulation and detection avoidance. This allows for a clearer view of associated challenges, and illustrate why targeted ICS exploitation might not be possible for every malicious actor

Evans blue exclusion test.

<p>(A) Leaves of <i>im</i> and Col-0 were infiltrated with a <i>P</i>. <i>syringae</i> cell culture at a density of 10⁴ colony forming units (cfu), and bacterial growth was monitored daily for 4 days after infection (DPI). (B) Leaves were detached from 7 week-old Col-0 and <i>im</i> and stained with Evans blue. In some experiments, detached wild type leaves were infiltrated with a <i>P</i>. <i>syringae</i> cell culture (density of 10⁴ cfu) prior to staining. In the Evans blue exclusion test, living cells exclude the dye, while dead cells take it up.</p

Monosaccharide composition (mol%) of cell wall from immutans and <i>Col-0</i> rosette leaves.

<p>Monosaccharide composition (mol%) of cell wall from immutans and <i>Col-0</i> rosette leaves.</p

Tissue anatomy and plastid numbers.

<p>Leaves from 4- and 8-week-old Col-0 and <i>im</i> (white and green sectors) were fixed, stained and examined by light microscopy. (A, D, G) <i>im</i> white; (B, E, H) <i>im</i> green; (C, F, I) Col-0; (A, B, C) 1 month-old; (D–I) 2 month-old. (A-F) Sections were stained with toluidine blue and plastids were counted using Image J software (NCBI website); (J) the sections were 500 nm thick and approximately 150 cells were analyzed for each tissue-type. Asterisks indicate significant difference (t-test, p < 0.01). (G-I) Sections from 2-month-old leaf tissues were stained with Schiff’s reagent for starch. TEM images of representative plastids from fully-expanded <i>im</i> white (K) and wild type leaves (L).</p

Composition of cell wall polymers.

<p>(A) Lignin and cellulose contents in the cell walls of Col-0 and <i>im</i> (white and green sectors). The contents were determined on a per mg basis of cell wall extracts. (B) Callose accumulation in Col-0 and <i>im</i> (white and green sectors) before and after infection with <i>P</i>. <i>syringae</i>. Expanded leaves from 7 week-old plants were cleared with ethanol and stained with aniline blue. The images were captured via UV fluoresecence microscopy. Bars = 200 μm.</p

Impaired Chloroplast Biogenesis in <i>Immutans</i>, an Arabidopsis Variegation Mutant, Modifies Developmental Programming, Cell Wall Composition and Resistance to <i>Pseudomonas syringae</i>

<div><p>The <i>immutans</i> (<i>im</i>) variegation mutation of Arabidopsis has green- and white- sectored leaves due to action of a nuclear recessive gene. <i>IM</i> codes for PTOX, a plastoquinol oxidase in plastid membranes. Previous studies have revealed that the green and white sectors develop into sources (green tissues) and sinks (white tissues) early in leaf development. In this report we focus on white sectors, and show that their transformation into effective sinks involves a sharp reduction in plastid number and size. Despite these reductions, cells in the white sectors have near-normal amounts of plastid RNA and protein, and surprisingly, a marked amplification of chloroplast DNA. The maintenance of protein synthesis capacity in the white sectors might poise plastids for their development into other plastid types. The green and white <i>im</i> sectors have different cell wall compositions: whereas cell walls in the green sectors resemble those in wild type, cell walls in the white sectors have reduced lignin and cellulose microfibrils, as well as alterations in galactomannans and the decoration of xyloglucan. These changes promote susceptibility to the pathogen <i>Pseudomonas syringae</i>. Enhanced susceptibility can also be explained by repressed expression of some, but not all, defense genes. We suggest that differences in morphology, physiology and biochemistry between the green and white sectors is caused by a reprogramming of leaf development that is coordinated, in part, by mechanisms of retrograde (plastid-to-nucleus) signaling, perhaps mediated by ROS. We conclude that variegation mutants offer a novel system to study leaf developmental programming, cell wall metabolism and host-pathogen interactions.</p></div

Sector identity is maintained during im leaf expansion.

<p>Images of the same <i>im</i> leaf were captured by light microscopy every two days from early expansion (day 0) to the attainment of full expansion (day 8). Bar = 5 mm.</p

Expression of pathogen response genes.

<p>Real-time qPCR evaluation of pathogen-related genes involved in immune response in (A) non-infected and (B) infected plants at 4 DPI. The samples were as in <a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0150983#pone.0150983.g006" target="_blank">Fig 6B</a>, and the genes are described in the text.</p

Reduced expression levels of soybean genes following <i>F</i>. <i>virguliforme</i> infection as compared to the water control.

<p>A. Expression levels of four selected soybean genes following water treatment at early (S1: 3 and 5 d) and late time (S2: 10 and 24 d) periods and <i>F</i>. <i>virguliforme</i> infection at early (S3: 3 and 5 d) and late time (S4: 10 and 24 d) periods. B. RT-PCR analyses of the selected soybean genes. RT-PCR products of each of the four selected soybean amplified from RNAs of root tissues harvested 8 and 12 h, and 1, 2, 3, 5 days following (i) water treatment or (ii) infection with the <i>F</i>. <i>virguliforme</i> Mont-1. The results presented here are from one of three independent experiments showing similar results. <i>Glyma12g12470</i> is from the Glyma.Wm82.a1.v1.1 version of the soybean genome sequence. Other three genes are from the recent version of the soybean genome sequence (Glyma.Wm82.a2v1). <i>Elf1b</i>, elongation factor 1-β encoded by <i>Glyma02g44460</i>. C–F. Quantified expression levels of four selected genes. Gel pictures of the three biological replications are presented in <a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0163106#pone.0163106.s008" target="_blank">S8 Fig</a>.</p

Distribution of differentially expressed genes in soybean roots in response to <i>F</i>. <i>virguliforme</i> infection.

<p>A. Total number of genes differentially (with FC ≥ 10) regulated by <i>F</i>. <i>virguliforme</i> infection. B. Number of genes up-regulated in the infected roots at early and late time-periods. C. Number of genes repressed in the infected roots at early and late time-periods. S1, pooled RNA samples prepared from roots harvested 3 and 5 days following water treatment; S2, pooled RNA samples prepared from roots harvested 10 and 24 days following water treatment; S3, pooled RNA samples prepared from roots harvested 3 and 5 days following <i>F</i>. <i>virguliforme</i> infection; S4, pooled RNA samples prepared from roots harvested 10 and 24 days following <i>F</i>. <i>virguliforme</i> infection.</p