Download - PLC Code Protection
![Page 1: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/1.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Air Force Institute of Technology
Center for Cyberspace Research
Stephen Dunlap
Jonathan Butts, PhD
PLC Code Protection
![Page 2: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/2.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
What’s the Story?
![Page 3: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/3.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Tactical Questions
![Page 4: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/4.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
• Requirements
• Helpful:
Resources
![Page 5: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/5.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Static Analysis
Device? We don’t need no stinkin device…
![Page 6: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/6.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Hardware Analysis
But I’ll take it if I can get it…
![Page 7: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/7.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Dynamic Analysis
I don’t always do dynamic analysis, but when I do, I use JTAG…
![Page 8: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/8.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Let’s Do This
Attacks Need:
Triggers
Payloads Deployment
![Page 9: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/9.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
![Page 10: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/10.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
• Hook regularly executed function • Count executions
Time Bomb
Jump Instruction before modification
After modification
![Page 11: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/11.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Time Bomb Cont.
Store a counter in memory
Load counter and subtract
Test for zero Continue operation if greater
![Page 12: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/12.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
• Hook jump table for CPU mode change • Keep track of changes for specific sequence
Logic Bomb
RUN
REM RUN
REM PROG
PROG
![Page 13: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/13.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
• Hook CIP command handler jump table
Remote Commands
![Page 14: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/14.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
• Check for custom service and instance
Remote Commands Cont.
![Page 15: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/15.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
![Page 16: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/16.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
• Endless loop causes recoverable fault • Fault shutdown routine
Soft DoS
![Page 17: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/17.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
• Write value to flash • Fault if value exists
Persistent DoS
• Exploit Flash Writing Function • R0 – Destination address • R1 – Source Address • R1 – Data Length
Flash end address
![Page 18: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/18.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Where to From Here?
• Traffic Modification • Modify CIP values • Propagation
• Persistence • Implant in bootloader • Ignore firmware updates • Modify version number
![Page 19: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/19.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
![Page 20: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/20.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Pivoting Through Firewall
![Page 21: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/21.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Pivoting Through Router
![Page 22: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/22.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Pivoting Through Router
![Page 23: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/23.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Implications
• Vendor agnostic • Expensive devices not needed • Supply chain • Cost of entry
• Team composition: Two guys • Time: Approx 3 months • Money: $3,500
NATION STATE NOT REQUIRED
![Page 24: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/24.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Protection Mechanisms
• Vendor • Digital Signatures • Trusted Platform Module
• Integrator • Source Verification • Access Control • Configuration Management
• Asset Owner • Deep Packet Inspection • Data Diodes • Configuration Management
![Page 25: PLC Code Protection](https://reader033.vdocuments.site/reader033/viewer/2022051013/547e3b0db37959442b8b54eb/html5/thumbnails/25.jpg)
The AFIT of Today is the Air Force of Tomorrow.
CCR - The Center for Cyberspace Research
Thank You