-
Stealthy Deception Attacks Against SCADA Systems
Authors:
Amit Kleinmann,
Ori Amichay,
Avishai Wool,
David Tenenbaum,
Ofer Bar,
Leonid Lev
Abstract:
SCADA protocols for Industrial Control Systems (ICS) are vulnerable to network attacks such as session hijacking. Hence, research focuses on network anomaly detection based on meta--data (message sizes, timing, command sequence), or on the state values of the physical process. In this work we present a class of semantic network-based attacks against SCADA systems that are undetectable by the above…
▽ More
SCADA protocols for Industrial Control Systems (ICS) are vulnerable to network attacks such as session hijacking. Hence, research focuses on network anomaly detection based on meta--data (message sizes, timing, command sequence), or on the state values of the physical process. In this work we present a class of semantic network-based attacks against SCADA systems that are undetectable by the above mentioned anomaly detection. After hijacking the communication channels between the Human Machine Interface (HMI) and Programmable Logic Controllers (PLCs), our attacks cause the HMI to present a fake view of the industrial process, deceiving the human operator into taking manual actions. Our most advanced attack also manipulates the messages generated by the operator's actions, reversing their semantic meaning while causing the HMI to present a view that is consistent with the attempted human actions. The attacks are totaly stealthy because the message sizes and timing, the command sequences, and the data values of the ICS's state all remain legitimate.
We implemented and tested several attack scenarios in the test lab of our local electric company, against a real HMI and real PLCs, separated by a commercial-grade firewall. We developed a real-time security assessment tool, that can simultaneously manipulate the communication to multiple PLCs and cause the HMI to display a coherent system--wide fake view. Our tool is configured with message-manipulating rules written in an ICS Attack Markup Language (IAML) we designed, which may be of independent interest. Our semantic attacks all successfully fooled the operator and brought the system to states of blackout and possible equipment damage.
△ Less
Submitted 28 June, 2017;
originally announced June 2017.
-
Search for methylamine in high mass hot cores
Authors:
N. F. W. Ligterink,
E. D. Tenenbaum,
E. F. van Dishoeck
Abstract:
We aim to detect methylamine, CH$_{3}$NH$_{2}$, in a variety of hot cores and use it as a test for the importance of photon-induced chemistry in ice mantles and mobility of radicals. Specifically, CH$_3$NH$_2$ cannot be formed from atom addition to CO whereas other NH$_2$-containing molecules such as formamide, NH$_2$CHO, can. Submillimeter spectra of several massive hot core regions were taken wi…
▽ More
We aim to detect methylamine, CH$_{3}$NH$_{2}$, in a variety of hot cores and use it as a test for the importance of photon-induced chemistry in ice mantles and mobility of radicals. Specifically, CH$_3$NH$_2$ cannot be formed from atom addition to CO whereas other NH$_2$-containing molecules such as formamide, NH$_2$CHO, can. Submillimeter spectra of several massive hot core regions were taken with the James Clerk Maxwell Telescope. Abundances are determined with the rotational diagram method where possible. Methylamine is not detected, giving upper limit column densities between 1.9 $-$ 6.4 $\times$ 10$^{16}$ cm$^{-2}$ for source sizes corresponding to the 100 K envelope radius. Combined with previously obtained JCMT data analyzed in the same way, abundance ratios of CH$_{3}$NH$_{2}$, NH$_{2}$CHO and CH$_{3}$CN with respect to each other and to CH$_{3}$OH are determined. These ratios are compared with Sagittarius B2 observations, where all species are detected, and to hot core models. The observed ratios suggest that both methylamine and formamide are overproduced by up to an order of magnitude in hot core models. Acetonitrile is however underproduced. The proposed chemical schemes leading to these molecules are discussed and reactions that need further laboratory studies are identified. The upper limits obtained in this paper can be used to guide future observations, especially with ALMA.
△ Less
Submitted 8 January, 2015;
originally announced January 2015.
-
Comparative Spectra of Oxygen-Rich vs. Carbon-Rich Circumstellar Shells: VY Canis Majoris and IRC+10216 at 215-285 GHz
Authors:
E. D. Tenenbaum,
J. L. Dodd,
S. N. Milam,
N. J. Woolf,
L. M. Ziurys
Abstract:
A sensitive (1σ rms at 1 MHz resolution ~3 mK) 1 mm spectral line survey (214.5-285.5 GHz) of VY Canis Majoris (VY CMa) and IRC+10216 has been conducted to compare the chemistries of oxygen and carbon-rich circumstellar envelopes. This study was carried out using the Submillimeter Telescope (SMT) of the Arizona Radio Observatory (ARO) with a new ALMA-type receiver. This survey is the first to chem…
▽ More
A sensitive (1σ rms at 1 MHz resolution ~3 mK) 1 mm spectral line survey (214.5-285.5 GHz) of VY Canis Majoris (VY CMa) and IRC+10216 has been conducted to compare the chemistries of oxygen and carbon-rich circumstellar envelopes. This study was carried out using the Submillimeter Telescope (SMT) of the Arizona Radio Observatory (ARO) with a new ALMA-type receiver. This survey is the first to chemically characterize an O-rich circumstellar shell at millimeter wavelengths. In VY CMa, 128 emission features were detected arising from 18 different molecules, and in IRC+10216, 720 lines were observed, assigned to 32 different species. The 1 mm spectrum of VY CMa is dominated by SO2 and SiS; in IRC +10216, C4H and SiC2 are the most recurrent species. Ten molecules were common to both sources: CO, SiS, SiO, CS, CN, HCN, HNC, NaCl, PN, and HCO+. Sulfur plays an important role in VY CMa, but saturated/unsaturated carbon dominates the molecular content of IRC+10216, producing CH2NH, for example. Although the molecular complexity of IRC+10216 is greater, VY CMa supports a unique "inorganic" chemistry leading to the oxides PO, AlO, and AlOH. Only diatomic and triatomic compounds were observed in VY CMa, while species with 4 or more atoms are common in IRC+10216, reflecting carbon's ability to form strong multiple bonds, unlike oxygen. In VY CMa, a new water maser (v_2=2) has been found, as well as vibrationally-excited NaCl. Toward IRC+10216, vibrationally-excited CCH was detected for the first time.
△ Less
Submitted 29 July, 2010;
originally announced July 2010.
-
Understanding the Chemical Complexity in Circumstellar Envelopes of C-rich AGB Stars: the Case of IRC +10216
Authors:
M. Agundez,
J. Cernicharo,
J. R. Pardo,
J. P. Fonfria Exposito,
M. Guelin,
E. D. Tenenbaum,
L. M. Ziurys,
A. J. Apponi
Abstract:
The circumstellar envelopes of carbon-rich AGB stars show a chemical complexity that is exemplified by the prototypical object IRC +10216, in which about 60 different molecules have been detected to date. Most of these species are carbon chains of the type CnH, CnH2, CnN, HCnN. We present the detection of new species (CH2CHCN, CH2CN, H2CS, CH3CCH and C3O) achieved thanks to the systematic observ…
▽ More
The circumstellar envelopes of carbon-rich AGB stars show a chemical complexity that is exemplified by the prototypical object IRC +10216, in which about 60 different molecules have been detected to date. Most of these species are carbon chains of the type CnH, CnH2, CnN, HCnN. We present the detection of new species (CH2CHCN, CH2CN, H2CS, CH3CCH and C3O) achieved thanks to the systematic observation of the full 3 mm window with the IRAM 30m telescope plus some ARO 12m observations. All these species, known to exist in the interstellar medium, are detected for the first time in a circumstellar envelope around an AGB star. These five molecules are most likely formed in the outer expanding envelope rather than in the stellar photosphere. A pure gas phase chemical model of the circumstellar envelope is reasonably successful in explaining the derived abundances, and additionally allows to elucidate the chemical formation routes and to predict the spatial distribution of the detected species.
△ Less
Submitted 28 March, 2007; v1 submitted 19 February, 2007;
originally announced February 2007.
-
Detection of Near-IR CO Absorption Bands in R Coronae Borealis Stars
Authors:
Emily D. Tenenbaum,
Geoffrey C. Clayton,
Martin Asplund,
C. W. Engelbracht,
Karl D. Gordon,
M. M. Hanson,
Richard J. Rudy,
David K. Lynch,
S. Mazuk,
Catherine C. Venturini,
R. C. Puetter
Abstract:
R Coronae Borealis (RCB) stars are hydrogen-deficient, carbon-rich pulsating post-AGB stars that experience massive irregular declines in brightness caused by circumstellar dust formation. The mechanism of dust formation around RCB stars is not well understood. It has been proposed that CO molecules play an important role in cooling the circumstellar gas so that dust may form. We report on a sur…
▽ More
R Coronae Borealis (RCB) stars are hydrogen-deficient, carbon-rich pulsating post-AGB stars that experience massive irregular declines in brightness caused by circumstellar dust formation. The mechanism of dust formation around RCB stars is not well understood. It has been proposed that CO molecules play an important role in cooling the circumstellar gas so that dust may form. We report on a survey for CO in a sample of RCB stars. We obtained H- and K-band spectra including the first and second overtone CO bands for eight RCB stars, the RCB-like star, DY Per and the final-helium-flash star, FG Sge. The first and second overtone CO bands were detected in the cooler (T(eff)<6000 K) RCB stars, Z Umi, ES Aql, SV Sge and DY Per. The bands are not present in the warmer (T(eff)>6000 K) RCB stars, R CrB, RY Sgr, SU Tau, XX Cam. In addition, first overtone bands are seen in FG Sge, a final-helium-flash star that is in an RCB-like phase at present. Effective temperatures of the eight RCB stars range from 4000 to 7250 K. The observed photospheric CO absorption bands were compared to line-blanketed model spectra of RCB stars. As predicted by the models, the CO bands are strongest in the coolest RCB stars and not present in the warmest. No correlation was found between the presence or strength of the CO bands and dust formation activity in the stars.
△ Less
Submitted 23 March, 2005;
originally announced March 2005.
-
An Extremely Large Excess of 18O in the Hydrogen-Deficient Carbon Star, HD 137613
Authors:
Geoffrey C. Clayton,
Falk Herwig,
T. R. Geballe,
Martin Asplund,
Emily D. Tenenbaum,
C. W. Engelbracht,
Karl D. Gordon
Abstract:
We report the discovery of a uniquely large excess of 18O in the hydrogen-deficient carbon (HdC) star, HD 137613, based on a spectrum of the first overtone bands of CO at 2.3-2.4 micron in which three strong absorption bands of 12C18O are clearly present. Bands of 12C16O also are present but no bands of 13C16O or 12C17O are seen. We estimate an isotopic ratio 16O/18O ~1. The Solar value of this…
▽ More
We report the discovery of a uniquely large excess of 18O in the hydrogen-deficient carbon (HdC) star, HD 137613, based on a spectrum of the first overtone bands of CO at 2.3-2.4 micron in which three strong absorption bands of 12C18O are clearly present. Bands of 12C16O also are present but no bands of 13C16O or 12C17O are seen. We estimate an isotopic ratio 16O/18O ~1. The Solar value of this ratio is ~500. Neither He-core burning nor He-shell flash burning can produce the isotopic ratios of oxygen and carbon observed in HD 137613. However, a remarkable similarity exists between the observed abundances and those found in the outer layers of the broad He-shell of early-AGB stars, soon after the end of He-core burning. It is not known how the outer envelope down to the He-shell could be lost but some mechanism of enhanced mass loss must be involved. HD 137613 may be a post-early-AGB star with the outer layers of the former He-burning shell as its photosphere.
The unusual elemental abundances of the HdC stars resemble those of the R Coronae Borealis (RCB) stars, but HdC stars do not produce clouds of dust that produce declines in brightness. None of the other RCB or HdC stars observed shows significant 18O.
△ Less
Submitted 8 March, 2005;
originally announced March 2005.
