ICSREF: A Framework for Automated Reverse Engineering of Industrial Control Systems Binaries

Abstract

The security of Industrial Control Systems (ICS) has been attracting increased attention over the past years, following the discovery of real threats targeting industrial environments. Despite this attention, automation of the reverse engineering process of ICS binaries for programmable logic controllers remains an open problem, mainly due to the use of proprietary compilers by ICS vendors. Such automation could be a double-edged sword; on the one hand it could accelerate digital forensic investigations and incident response actions, while on the other hand it could enable dynamic generation of malicious ICS payloads. In this work, we propose a structured methodology that automates the reverse engineering process for ICS binaries taking into account their unique domain-specific characteristics. We apply this methodology to develop the modular Industrial Control Systems Reverse Engineering Framework (ICSREF), and instantiate ICSREF modules for reversing binaries compiled with CODESYS, a widely used software stack and compiler for PLCs. To evaluate our framework we create a database of samples by collecting real PLC binaries from public code repositories, as well as developing binaries in-house. Our results demonstrate that IC-SREF can successfully handle diverse PLC binaries from varied industry sectors, irrespective of the programming language used. Furthermore, we deploy ICSREF on a commercial smartphone which orchestrates and launches a completely automated processaware attack against a chemical process testbed. This example of dynamic payload generation showcases how ICSREF can enable sophisticated attacks without any prior knowledge.

I came, I saw, I hacked: Automated Generation of Process-independent Attacks for Industrial Control Systems

“…For payload generation, SABOT [33] gathers intelligence from source code analysis to automatically understand what kind of code manipulations would lead to attack goals being fulfilled. IC-SREF [21] is an open-source framework that allows general purpose PLC binary analysis. In all of these approaches, PLC code analysis has not been used to fingerprint a particular process.…”

“…FBs resemble functions in imperative programming languages. They are used as black boxes for frequently reoccurring processes, such as control algorithms (PID, Integral, Derivative), timing functions (triggers, timers), and networking functions (MODBUS, TCP) [21]. Extracting FBs from binaries can provide rich semantic information about the process.…”

“…The strings in a binary are dynamic and include descriptive error messages, input/output prompts, or other information that might be used to identify the process of the PLC. Constructed dataset: In order to extract FBs from the binaries, we use ICSREF [21]. ICSREF, at its current version (1.0), works only with Codesys v2.3 binaries.…”

“…After automatically extracting the FB names, individually, we had to cleanse the dataset. ICSREF is equipped with a function called hashmatch that extracts the FBs in PLC binaries, hashes them to create a signature and then matches them to a built-in library [21]. This function also provides the relative address at which the FB is located.…”

“…PLC control binaries are unique and different for each vendor. Using ICSREF [21], we explored the possibility to use the Global INIT subroutine to extract hard-coded values such as set points and PID values. This analysis is enabled by the reconnaissance steps before.…”