False Command Injector on Metro Emulator doesn't work

[Phenixis]

Hi !

I'm working on a version of the Metro Emulator that can be attacked using the False Command Injector program you built.

I forked your repo to try to attack the Metro Emulator, and for now here is what works:

• The auto-collision avoidance system is deactivated and can't be reactivated using the HMI
• Trains can be stopped once

My problem is that the trains I successfully stopped once can be started again using the HMI and the trains I tried to keep running can be stopped using the HMI.

Do you have an idea on why and how to make it impossible using modbus command ?

You can check my version of the Metro Emulator here and of the Command Injector here

[LiuYuancheng]

Hi Phenixis

The version you are using is quite an older version. The current version has be updated to v_0.2.1. For the situation you mentioned, both your program and the HMI are sending the control command to the PLC, the PLC will execute the latest one which it accepted 'before' the time point at one round ladder logic execution. So if the HMI over write your attack script's command then you can see the train follow the HMI's control, for your attack script, you can modify your injector's infinite loop sleep interval and send the command every 0.1 second. So your injected false command will have higher possibility to over write the HMI's control request. Hope that can help solve your problem.

[Phenixis]

Hi LiuYuancheng !

I saw on your repo that you are still on version v_0.1.2 too, where can I find the latest version ?

Concerning the rate of sending, I understand that I can try to send the commands at a higher rate but even if I keep the same rate, from what I understand, here is what should happen:

• Round 1 : No HMI's command sent, Malicious program's command is the last command received by the PLC, so it gets executed. Train is stopped.
• Round 2 : Malicious program's command has been received before HMI's command, so the PLC execute the HMI's command. Train is running again.
• Round 3 : No HMI's command sent, Malicious program's command is the last command received by the PLC, so it gets executed. Train is stopped.

Is that right? Because if this is what should happen, the round 3 is not executed, as if the HMI's command overwrite every command the PLC receives after.