PT0-001 · Question #93
A security consultant found a SCADA device in one of the VLANs in scope. Which of the following actions would BEST create a potentially destructive outcome against device?
The correct answer is A. Launch an SNMP password brute force attack against the device. Against SCADA devices, brute forcing the SNMP write community string is most destructive because it grants direct ability to modify device operational parameters and influence physical industrial processes.
Question
A security consultant found a SCADA device in one of the VLANs in scope. Which of the following actions would BEST create a potentially destructive outcome against device?
Options
- ALaunch an SNMP password brute force attack against the device.
- BLunch a Nessus vulnerability scan against the device.
- CLaunch a DNS cache poisoning attack against the device.
- DLaunch an SMB exploit against the device.
How the community answered
(34 responses)- A59% (20)
- B24% (8)
- C12% (4)
- D6% (2)
Why each option
Against SCADA devices, brute forcing the SNMP write community string is most destructive because it grants direct ability to modify device operational parameters and influence physical industrial processes.
SCADA and ICS devices frequently run SNMP v1 or v2c with default or weak community strings. Successfully brute forcing the write community string allows an attacker to alter device configuration, setpoints, or control values via SNMP SET operations, potentially causing dangerous process conditions, equipment damage, or physical harm in the industrial environment.
Running a Nessus vulnerability scan may crash or degrade a fragile SCADA device as an unintended side effect, but this is not a controlled destructive action that leverages direct operational control of the device.
DNS cache poisoning redirects name resolution traffic and could disrupt communications, but it does not provide direct access to the SCADA device's control parameters or operational settings.
An SMB exploit requires the target to be running a Windows SMB service, which is not a standard feature of most purpose-built SCADA or ICS hardware controllers.
Concept tested: SCADA device exploitation via SNMP write community string
Source: https://www.cisa.gov/resources-tools/resources/recommended-practice-securing-industrial-control-systems
Topics
Community Discussion
No community discussion yet for this question.