Behind Closed Doors: Process-Level Rootkit Attacks in Cyber-Physical Microgrid Systems

TL;DR

This paper explores how process-level rootkits in microgrid control systems can stealthily compromise operations by deploying system-specific models and orchestrating impactful attacks, highlighting new vulnerabilities in cyber-physical energy systems.

Contribution

It introduces a detailed analysis of process-aware rootkits in microgrids, including their deployment, modeling, and attack strategies, revealing novel stealth attack mechanisms.

Findings

Rootkits gather system info to build neural network models.

They use models to orchestrate impactful, undetectable attacks.

Attacks impair system operation and blind detection mechanisms.

Abstract

Embedded controllers, sensors, actuators, advanced metering infrastructure, etc. are cornerstone components of cyber-physical energy systems such as microgrids (MGs). Harnessing their monitoring and control functionalities, sophisticated schemes enhancing MG stability can be deployed. However, the deployment of `smart' assets increases the threat surface. Power systems possess mechanisms capable of detecting abnormal operations. Furthermore, the lack of sophistication in attack strategies can render them detectable since they blindly violate power system semantics. On the other hand, the recent increase of process-aware rootkits that can attain persistence and compromise operations in undetectable ways requires special attention. In this work, we investigate the steps followed by stealthy rootkits at the process level of control systems pre- and post-compromise. We investigate the rootkits' precompromise stage involving the deployment to multiple system locations and aggregation of system-specific information to build a neural network-based virtual data-driven model (VDDM) of the system. Then, during the weaponization phase, we demonstrate how the VDDM measurement predictions are paramount, first to orchestrate crippling attacks from multiple system standpoints, maximizing the impact, and second, impede detection blinding system operator situational awareness.