hunnypOT: a production honeypot for Operational Technology (OT) systems in the power sector.
hunnypOT is a network appliance that simulates an Industrial Control System network. It provides an early warning system so that attacks on Critical Infrastructure (such as power plants, water treatment facilities and telecommunications networks) can be detected before the attacker can cause damage.
Our solution is simple. Plug in our device, and wait. You will receive email and SMS alerts if an attacker tries interacting with it, so that you can immediately start working to kick them out.
Attacks on critical infrastructure are increasing, and the impact of those attacks could be catastrophic, affecting not “just” data, but threatening national security, causing environmental damage, hurting the national economy, and even causing human injury or death. The converged Operational Technology (OT)-Information Technology (IT) space is relatively new and growing. Defending an OT system properly and preparing for incident response requires knowledge about the kinds of possible attacks on OT and OT/IT converged systems. Deception technology such as a honeypot is one way to obtain that intelligence and provide a non-invasive foolproof alert of anomalous activity.
2019 Utility Industry survey:
- 56% of utilities surveyed report at least one shutdown or operational data loss per year.
- 54% expect an attack on critical infrastructure in the next 12 months
- 42% rated their cyber readiness as high
- 31% rated readiness to respond to or contain a breach as high.
[Caught in the Crosshairs: Are Utilities Keeping Up with the Industrial Cyber Threat?, Siemens and Ponemon Institute, 04 October 2019]
We leveraged the open source project “Conpot” to jumpstart the power grid emulation, and have extended its limited emulation to improve realism by supporting more PLC commands. We built logging and command-control servers to capture, alert and log any activity on the emulated PLC.
Overview of software design
Tremendous thanks to:
Tiffany Rad from UC Berkeley
Matthew Travis, former deputy director CISA
Dom Maddalone, Christopher Jimenez and Shane Clancy from Santee Cooper
Developers of Conpot and SNAP7
Customer support at Siemens
Spring 2021 MICS Capstone Instructors and Classmates
Special thanks to Susan Thompson for our awesome logo design!