PCaaD: Towards automated determination and exploitation of industrial systems

Abstract

Over the last decade, Programmable Logic Controllers (PLCs) have been increasingly targeted by attackers to obtain control over industrial processes that support critical services. Such targeted attacks typically require detailed knowledge of system-specific attributes, including hardware configurations, adopted protocols, and PLC control-logic, i.e., process comprehension. The consensus from both academics and practitioners suggests stealthy process comprehension obtained from a PLC alone, to execute targeted attacks, is impractical. In contrast, we assert that current PLC programming practices open the door to a new vulnerability class, affording attackers an increased level of process comprehension. To support this, we propose the concept of Process Comprehension at a Distance (PCaaD), as a novel methodological and automatable approach towards the system-agnostic identification of PLC library functions. This leads to the targeted exfiltration of operational data, manipulation of control-logic behavior, and establishment of covert command and control channels through unused memory. We validate PCaaD on widely used PLCs through its practical application.

To me, to you: Towards Secure PLC Programming through a Community-Driven Open-Source Initiative

“…Focusing on the intersection of PLC programming practices and memory management, Green et al [12] introduce the technique 'Process Comprehension at a Distance' (PCaaD). PCaaD takes advantage of the fact that many PLC programmers use vendor-provided library functions [15] to distinguish what functions are running on the PLC, thus providing an adversary a greater level of process comprehension [13].…”

“…Building on some of the concepts of PCaaD [12], Maesschalck et al [16] show that many of the vendorprovided library functions contain a vulnerability that allows adversaries to change the operation of the PLC. The authors present a scanning tool to identify bytes, and therefore variables, in the target PLC's memory that are susceptible to being manipulated over the network.…”

“…By adhering to established programming standards, implementing secure programming practices, and following thorough testing and validation processes, organisations can minimise the likelihood of vulnerabilities being introduced into their ICS and physical process. However, many organisations rely on PLC code in the form of vendor-provided library functions [15], which are proprietary, unable to be edited, and demonstrably vulnerable [12], [16], meaning that many elements of secure PLC programming practices cannot be exercised when they are sorely needed.…”

Learning to Walk: Towards Assessing the Maturity of OT Security Control Standards and Guidelines

“…While, historically, IT and OT were segregated as described by the Purdue Model [2], an increasing volume of standardised technology (including IT software and hardware) is being integrated into OT systems that operate within the Manufacturing and Cell/Area Zones. Despite the benefits that this technological integration provides, it has also led to an increased attack surface for threat actors to target [3], [4], resulting in several notable cyber attacks specifically aimed at industrial environments, including CNI facilities [5], [6].…”