Stealthy Deception Attacks Against SCADA Systems

SCADA protocols for Industrial Control Systems (ICS) are vulnerable to network attacks such as session hijacking. Hence, research focuses on network anomaly detection based on meta--data (message sizes, timing, command sequence), or on the state values of the physical process. In this work we present a class of semantic network-based attacks against SCADA systems that are undetectable by the above mentioned anomaly detection. After hijacking the communication channels between the Human Machine Interface (HMI) and Programmable Logic Controllers (PLCs), our attacks cause the HMI to present a fake view of the industrial process, deceiving the human operator into taking manual actions. Our most advanced attack also manipulates the messages generated by the operator's actions, reversing their semantic meaning while causing the HMI to present a view that is consistent with the attempted human actions. The attacks are totaly stealthy because the message sizes and timing, the command sequences, and the data values of the ICS's state all remain legitimate. We implemented and tested several attack scenarios in the test lab of our local electric company, against a real HMI and real PLCs, separated by a commercial-grade firewall. We developed a real-time security assessment tool, that can simultaneously manipulate the communication to multiple PLCs and cause the HMI to display a coherent system--wide fake view. Our tool is configured with message-manipulating rules written in an ICS Attack Markup Language (IAML) we designed, which may be of independent interest. Our semantic attacks all successfully fooled the operator and brought the system to states of blackout and possible equipment damage

Quantum state-independent contextuality requires 13 rays

We show that, regardless of the dimension of the Hilbert space, there exists no set of rays revealing state-independent contextuality with less than 13 rays. This implies that the set proposed by Yu and Oh in dimension three [Phys. Rev. Lett. 108, 030402 (2012)] is actually the minimal set in quantum theory. This contrasts with the case of Kochen-Specker sets, where the smallest set occurs in dimension four.Comment: 8 pages, 2 tables, 1 figure, v2: minor change

Properties of the unusual galaxy PSC 09104+4109

The IRAS source PSC 09104+4109 is tentatively identified with a faint emission line galaxy having z = 0.442. Assuming this identification is correct, the total infrared luminosity of this galaxy is estimated to be 5 x 10 to the 12th power L sub 0, among the highest for galaxies detected by IRAS. This energy is concentrated at wavelengths less than 30 micrometers, and is approx. 50 times greater than the estimated optical luminosity. The serendipitous way in which this source was found in the PSC catalog suggests that many more similar objects may be found at the lowest levels of the IRAS survey