Abstract
Cyber-Physical Systems (CPS), that integrate computations and communications with physical processes, are gaining popularity and being widely adopted in various mis-sion critical infrastructures, e.g., smart grids, nuclear plants, water systems, and robotics, among others. However, the increasing prevalence of cyber attacks targeting them poses a growing security concern. In particular, attacks exploiting memory-safety vul-nerabilities, which we refer to as memory-safety attacks, constitute a major attack vector against CPS. This is because, embedded systems often rely on unsafe but fast program-ming languages, such as C/C++, for the sake of efficiency. These attacks in CPS are typically launched on Programmable Logic Controllers (PLCs). They exploit vulnera-bilities in the PLCs’ firmware, control software or the underlying OS hosting the PLCs. A wide range of countermeasures have been developed to provide protection against these attacks. However, the existing ones have several limitations to be applied in the CPS context. In particular, the most reliable countermeasures incur in high run-time overheads; which might not be tolerable for the real-time constraints imposed by cyber-physical systems. Moreover, the existing mitigation strategies (of these counter-measures) have several limitations. In particular, most of the mitigation approaches are based on aborting or restarting the victim program when a memory-safety attack is detected, thus making the system unavailable. This might not be acceptable in sys-tems with stringent availability constraints, such as CPS, since the system unavailabil-ity leaves the control system in an unsafe state. In this work, we explore the applicability of strong countermeasures against memory-safety attacks in the context of a realistic CPS. Thus, we enforce a full-stack, i.e. a user-space and kernel-space, memory-safety countermeasure based on secure compiling of the PLCs in CPS. Furthermore, to address the mitigation problem, we propose CIMA – a resilient and light-weight mitigation technique that prevents invalid memory accesses at runtime. CIMA is a compile-time code-instrumentation based memory-safety tool. It manipulates the compiler-generated control-flow graph to dynamically detect and bypass unsafe memory accesses at runtime, thereby mitigating memory-safety attacks along the process. An appealing feature of CIMA is that it also ensures system avail-ability and resilience of the CPS even under the presence of memory-safety attacks. To evaluate the effectiveness and efficiency of our approach, we design our ex-perimental setup based on realistic Secure Water Treatment (SWaT) and Secure Urban Transportation System (SecUTS) testbeds. Then, we empirically measure the memory-safety overhead (MSO) caused by memory-safe compilation of the PLCs. Subsequently, we quantify the tolerability of this overhead in terms of the expected real-time con-straints of SWaT and SecUTS. The experimental results reveal high effectiveness of our security measure in de-tecting and mitigating memory-safety attacks in CPS. Moreover, it meets the real-time constraints and physical-state resiliency of the CPS under test. We also discuss how dif-ferent parameters impact the execution time of PLCs and the resulting absolute MSO.