An Event Buffer Flooding Attack in DNP3 Controlled SCADA Systems

The DNP3 protocol is widely used in SCADA systems (particularly electrical power) as a means of communicating observed sensor state information back to a control center. Typical architectures using DNP3 have a two level hierarchy, where a specialized data aggregator receives observed state from devices within a local region, and the control center collects the aggregated state from the data aggregator. The DNP3 communications are asynchronous across the two levels; this leads to the possibility of completely filling a data aggregator's buffer of pending events, when a compromised relay sends overly many (false) events to the data aggregator.

Provided by: Institute of Electrical & Electronic Engineers Topic: Security Date Added: Nov 2011 Format: PDF

Find By Topic