SCADA Radio Blackbox Reverse Engineering

Abstract

Supervisory control and data acquisition (SCADA) systems were designed to be open, robust, and easy to operate and repair, but not necessarily secure. In recent years, there have been multiple successful attacks targeting SCADA systems. Most of them have been caused by deploying malware on a supervisory computer in order to control and manage programmable logic controllers (PLCs) and remote terminal units (RTUs). This work investigates a different potential way to control PLCs or RTUs in a plant which consists in inflitrating over-the-air (OTA) links based on SCADA wireless modems. Indeed, PLCs and RTUs are often linked to a supervisory computer wirelessly using outdated radios, with low security at the physical-layer level. An example of such a radio is the CalAmp Guardian-400 wireless modem. A blackbox reverse engineering of the physical layer of the latter is performed, which leads to complete signal demodulation and decoding. Our results demonstrate that any electronic equipment connected serially to the radio is vulnerable to wireless packet injection.