Efficient Passive ICS Device Discovery and Identification by MAC Address Correlation

Owing to a growing number of attacks, the assessment of Industrial Control Systems (ICSs) has gained in importance. An integral part of an assessment is the creation of a detailed inventory of all connected devices, enabling vulnerability evaluations. For this purpose, scans of networks are crucial. Active scanning, which generates irregular traffic, is a method to get an overview of connected and active devices. Since such additional traffic may lead to an unexpected behavior of devices, active scanning methods should be avoided in critical infrastructure networks. In such cases, passive network monitoring offers an alternative, which is often used in conjunction with complex deep-packet inspection techniques. There are very few publications on lightweight passive scanning methodologies for industrial networks. In this paper, we propose a lightweight passive network monitoring technique using an efficient Media Access Control (MAC) address-based identification of industrial devices. Based on an incomplete set of known MAC address to device associations, the presented method can guess correct device and vendor information. Proving the feasibility of the method, an implementation is also introduced and evaluated regarding its efficiency. The feasibility of predicting a specific device/vendor combination is demonstrated by having similar devices in the database. In our ICS testbed, we reached a host discovery rate of 100% at an identification rate of more than 66%, outperforming the results of existing tools.Comment: http://dx.doi.org/10.14236/ewic/ICS2018.

LICSTER -- A Low-cost ICS Security Testbed for Education and Research

Unnoticed by most people, Industrial Control Systems (ICSs) control entire productions and critical infrastructures such as water distribution, smart grid and automotive manufacturing. Due to the ongoing digitalization, these systems are becoming more and more connected in order to enable remote control and monitoring. However, this shift bears significant risks, namely a larger attack surface, which can be exploited by attackers. In order to make these systems more secure, it takes research, which is, however, difficult to conduct on productive systems, since these often have to operate twenty-four-seven. Testbeds are mostly very expensive or based on simulation with no real-world physical process. In this paper, we introduce LICSTER, an open-source low-cost ICS testbed, which enables researchers and students to get hands-on experience with industrial security for about 500 Euro. We provide all necessary material to quickly start ICS hacking, with the focus on low-cost and open-source for education and research

Combination therapy with oral treprostinil for pulmonary arterial hypertension. A double-blind placebo-controlled clinical trial

Rationale: Oral treprostinil improves exercise capacity in patients with pulmonary arterial hypertension (PAH), but the effect on clinical outcomes was unknown. Objectives: To evaluate the effect of oral treprostinil compared with placebo on time to first adjudicated clinical worsening event in participants with PAH who recently began approved oral monotherapy. Methods: In this event-driven, double-blind study, we randomly allocated 690 participants (1:1 ratio) with PAH to receive placebo or oral treprostinil extended-release tablets three times daily. Eligible participants were using approved oral monotherapy for over 30 days before randomization and had a 6-minute-walk distance 150 m or greater. The primary endpoint was the time to first adjudicated clinical worsening event: death; hospitalization due to worsening PAH; initiation of inhaled or parenteral prostacyclin therapy; disease progression; or unsatisfactory long-term clinical response. Measurements and Main Results: Clinical worsening occurred in 26% of the oral treprostinil group compared with 36% of placebo participants (hazard ratio, 0.74; 95% confidence interval, 0.56–0.97; P = 0.028). Key measures of disease status, including functional class, Borg dyspnea score, and N-terminal pro–brain natriuretic peptide, all favored oral treprostinil treatment at Week 24 and beyond. A noninvasive risk stratification analysis demonstrated that oral treprostinil–assigned participants had a substantially higher mortality risk at baseline but achieved a lower risk profile from Study Weeks 12–60. The most common adverse events in the oral treprostinil group were headache, diarrhea, flushing, nausea, and vomiting. Conclusions: In participants with PAH, addition of oral treprostinil to approved oral monotherapy reduced the risk of clinical worsening. Clinical trial registered with www.clinicaltrials.gov (NCT01560624)