A Study of SCADA System Vulnerabilities and Man-in-the-Middle Threats in Substation Operations

This article explores vulnerabilities in Supervisory Control and Data Acquisition (SCADA) systems used in both transmission and distribution substations across the electric grid. Focusing on a Man-in-the-Middle (MiTM) attack for eavesdropping, this work models a system designed to control an emulated circuit breaker via a Programmable Logic Controller (PLC) and open-source SCADA software. The system consists of three computers, a Raspberry Pi, a Wi-Fi Pineapple Mark VII, a PLC, and SCADA software to demonstrate potential cybersecurity risks and provide mitigation strategies. The research highlights that sensitive SCADA data, including log-in credentials and operational commands, can be extracted using simple Python scripts, demonstrating the significant threat posed by cyber attacks to the energy grid. The findings underline the need for robust security measures, such as encryption and audit logging, to safeguard against these vulnerabilities and mitigate the risks posed by evolving attacker capabilities.