In industrial control systems, devices such as Programmable Logic Controllers (PLCs) are commonly used to directly interact with sensors and actuators, and perform local automatic control. PLCs run software on two different layers: a) firmware (i.e. the OS) and b) control logic (processing sensor readings to determine control actions). In this work, we discuss ladder logic bombs, i.e. malware written in ladder logic (or one of the other IEC 61131-3-compatible languages). Such malware would be inserted by an attacker into existing control logic on a PLC, and either persistently change the behavior, or wait for specific trigger signals to activate malicious behaviour. For example, the LLB could replace legitimate sensor readings with manipulated values. We see the concept of LLBs as a generalization of attacks such as the Stuxnet attack. We introduce LLBs on an abstract level, and then demonstrate several designs based on real PLC devices in our lab. In particular, we also focus on stealthy LLBs, i.e. LLBs that are hard to detect by human operators manually validating the program running in PLCs. In addition to introducing vulnerabilities on the logic layer, we also discuss countermeasures and we propose two detection techniques.
@cite_10 , the authors investigate vulnerabilities of industrial PLCs on firmware and network level, leaving out any analysis on logic level exploits. In this work, we provide a consolidated study on logic layer manipulations and provide logic level safeguarding methods, unlike the network based security (e.g., firewall, VPN security and secured layered architecture) methods proposed in majority of the papers above.
@cite_10
56492688 2074450875 2542991636 2792724737
Industrial control systems are a vital part of the critical infrastructure. The potentially large impact of a failure makes them attractive targets for adversaries. Unfortunately, simplistic approaches to intrusion detection using protocol analysis or naive statistical estimation techniques are inadequate in the face of skilled adversaries who can hide their presence with the appearance of legitimate actions. In this paper we have shown that PLC devices are complex embedded systems often relying on some operating system. They are plagued by the same sorts of vulnerabilities and exploits as general purpose operating systems. In fact, the number of latent vulnerabilities in the typical microprocessor-based device can be surprisingly high. However we don't need bugs or vulnerabilities in order to attack the PLC. We can exploit its normal operation provided we have some access to the device. It is suggested that the one of effective ways to avoid expensive business losses or production disruption due to misuse of the PLC is to start protecting the system with defence-in-depth measures. In this paper, we propose a hierarchical monitoring intrusion detection system (HAMIDS) for industrial control systems (ICS). The HAMIDS framework detects the anomalies in both level 0 and level 1 of an industrial control plant. In addition, the framework aggregates the cyber-physical process data in one point for further analysis as part of the intrusion detection process. The novelty of this framework is its ability to detect anomalies that have a distributed impact on the cyber-physical process. The performance of the proposed framework evaluated as part of SWaT security showdown (S3) in which six international teams were invited to test the framework in a real industrial control system. The proposed framework outperformed other proposed academic IDS in term of detection of ICS threats during the S3 event, which was held from July 25-29, 2016 at Singapore University of Technology and Design. Abstract Cyber-physical systems and the Internet-of-Things are getting more and more traction in different application areas. Boosted by initiatives such as Industrie 4.0 in Germany or the Industrial Internet Consortium in the US, they are enablers for innovation in industrial automation. To provide the advanced flexibility in production envisioned for future automation systems, Programmable Logic Controllers (PLCs), as one of their main building blocks, also need to become more flexible. However, the conservative nature of this domain prohibits changes in the controller architecture impacting the installed base. Currently there exist various approaches that evolve control architectures to the next level, but none of them address flexible function deployment at the same time with legacy support. In this paper, we present an architecture for a multi-purpose controller that is inspired by the virtualization trend in cloud systems which moves from heavyweight virtual machines to lightweight containers solutions such as LXC or Docker. Our solution includes the support for multiple PLC execution engines and adds support for the emulation of legacy engines as well. We evaluate this architecture by executing performance measurements that analyze the impact of container technologies to the real-time aspects of PLC engines.