LetsDefend: ICS FuelStation — finding the attack in the packet capture

This week I tackled ICS FuelStation. One tool, three Wireshark filters, and an incident response report at the end. Here is exactly how I worked through it.

Weekly challenge solved!

Careful

Three filters. That is genuinely it. Let me explain why those three, and why in that order — because the order is the actual lesson here.

Industrial control networks are wonderfully boring.

A fuel station's control network does roughly the same thing all day, every day. Which means anything unusual has nowhere to hide — as long as you know how to ask the capture the right question.

My instinct with a big capture used to be to scroll it. Don't do that. Filter it.

The gap between those two filters is where the story lives. Hundreds of SYNs and only a handful of ACKs means most of that scan hit closed ports — and the small set that came back is where they actually got in.

Tip

Run both filters back to back and just compare the packet counts in the status bar before you read a single packet. That ratio alone tells you whether you are looking at a noisy scan, a targeted probe, or an established session.

Once a port stands out, pivot straight to it. Now the scan noise is gone and you are looking only at the conversation that mattered. Follow the stream and read what was exchanged.

It is very tempting to skip to step 3 as soon as you have a hunch.

I nearly did. Don't.

Solving it is only half the job. The last thing I did was put together an incident response report covering:

This is the part almost everyone skips while practising, and I think that is a mistake. Writing the report is what turns "I found the flag" into "I can explain what happened to someone who was not there". Only one of those is a job skill.

That three-step pattern will orient you in an unfamiliar capture in about a minute, and it works well beyond ICS.

Keep practising!

Contents

Skills covered