Types and Processes of PLC Attacks in Industrial Control Systems

01 Types of PLC Attacks

1. Attacks via Embedded System Vulnerabilities

Figure 1 Brute Force Attack on Shell System

Many PLC devices from Siemens and Schneider run software on the VxWorks system. Wdbrpc is the remote debugging port for VxWorks, communicating via UDP with port number 17185. This protocol is based on sun-rpc, and the services it provides mainly support system remote interaction through the integrated development environment Tornado (as shown in Figure 2). According to the information released by Lighthouse Labs [2], hackers can use the wdbrpc protocol to dump all memory space data, find all ftp and telnet login passwords in memory, and further possible attacks include: tampering with bootline to bypass login verification, dumping memory data to capture login passwords, etc. By attacking the embedded real-time operating system, they can control the normal operation of the PLC.

Figure 2 Tornado Development Environment and VxWorks System Diagram

2. Attacks via PLC Communication Protocol Vulnerabilities

3. Attacks via PLC Software Vulnerabilities

Figure 3 Attacking PLC via Human-Machine Interface Process

Radvanovsky et al. [9] pointed out that the SHINE (SHodan Intelligence Extraction) project initiated by the United States aims to extract information about SCADA and ICS devices accessible from the internet (especially PLCs and RTUs). The SHODAN search engine works by searching common TCP/UDP ports, as shown in Table 3:

Table 3 Common Protocols and Port Reference Table

Newman [10] noted that control room duty in prisons introduces viruses and worms through online browsing of pictures and movies. Some prisons provide internet services to inmates, and although they are not directly connected to prison control and monitoring systems, they are also a vulnerable point. Additionally, patrol cars in the prison use wireless signals and need to connect to the prison network to upload data, which is also an attack entry point.

Klick [11] pointed out at the 2015 USABlackHat that PLCs lack security mechanisms, and code can often be uploaded to these internet-facing PLCs, using these PLCs as gateways to penetrate production networks and even corporate IT networks. Kclik used the PLC programming language STL to write a port scanner and SOCKS proxy, then used the infected PLC to scan the local network and connect to other PLCs or even penetrate the corporate business network, as shown in Figure 4:

Figure 4 Company System Hierarchy Diagram

McLaughlin [12] designed malware targeting PLCs that can generate dynamic data packet payloads. Attackers can use this tool to implement attacks without prior knowledge of the control system, significantly lowering the threshold for attacking PLCs. First, the generated payload infects one or more hosts, then conducts industrial process analysis, followed by decoding binary files, and finally trimming the generated payload, uploading it to the PLC and running it, as shown in Figure 5:

Figure 5 Dynamic Generation of Malicious Payload Process

McLaughlin, in another article [13], developed a tool for automatically generating PLC payloads—Sabot, which automatically identifies PLC logic control and generates malicious PLC code, as shown in Figure 6:

Figure 6 Sabot Attack Process Schematic

Spenneberg [14] et al. demonstrated a worm that survives on PLCs, using Siemens SIMATIC S7-1200 as an example, at the 2016 Asia BlackHat. This worm does not rely on PCs to spread; it remains active and runs on PLCs, discovering new targets (PLCs) through network scanning, then attacking these targets and copying itself to new PLCs without changing the main program of the infected PLC. This allows for target discovery and carrying malicious payloads, among other attack methods. Moreover, removing these worms is very difficult; currently, it can only be done by restoring factory settings or rewriting the functional blocks where the worm resides. The infection process is shown in Figure 7:

Figure 7 Worm Infection Process on PLC

The code execution process is shown in Figure 8:

Figure 8 Worm Malicious Code Execution Process

In summary, the security situation of PLCs is not optimistic, with multiple attack paths available and the depth of attacks gradually increasing. There is still a long way to go to ensure the security of PLCs.

References:

[1] Beresford D. Exploiting Siemens Simatic S7 PLCs[J]. Black Hat USA, 2011, 16(2): 723-733.

[2] Kimon. Revealing VxWorks – Directly Targeting IoT Security Vulnerabilities [EB/OL]. http://chuansong.me/n/1864339, 2015-11-01

[3] Langner R. A time bomb with fourteen bytes[J]. Available: hUp: llwww. langner. comlen, 2011.

Hardcore Collection

ERP/PLM/MES/SCADA/PLC/Industrial Software Research Report