Killing Watts: ICS Attack Chains Against Power Systems

At Stan, Parham Mohammadi presented the CPPS-SEC Lab, an ICS attack simulation environment he built. It had a simulated power system running power flow on a standard IEEE 14-bus grid, a control layer of PLCs, MQTT brokers and Modbus registers, and a detection layer with Suricata and Zeek. Stan sponsored the night.

He walked through three attacks. An unauthenticated MQTT broker let an attacker drop an 80-megawatt fleet of distributed energy resources to zero. Overwritten Modbus registers spiked load demand and Suricata never fired an alert. False data injection corrupted the sensors feeding the state estimator. Chained together, the three collapsed the grid in under two minutes while the operator dashboard stayed green. The lab was going open source after publication.