Oops, It Halted Again: Exploiting PLC Memory for Fun and Profit in Industrial Control...
summary
Automated framework uses machine-learning SVM classifier on windowed, entropy and structural features (depth and indegree, byte-correlation) and acquires memory via Modbus/JTAG to find pointers and metadata; trained on an M221 and tested on three PLCs from two vendors including two Schneider models with different ISAs. Targets are tiny (<1% of space, often one-in-a-million sized), ordering priorities by likelihood, and active probes corrupt or crash devices (over 280 kill-switch blocks found on one PLC); vulnerability disclosed as CVE-2024-11737.
AI-written summary · about
chapters (10)
- 0:00ICS and PLC systems
- 1:59PLC memory security blind spot
- 3:03Analyzing PLC memory challenges
- 5:56Accessing PLC memory protocols
- 6:38Machine learning for memory layout
- 9:25Critical data in PLC memory
- 13:04Framework acquisition to analysis
- 16:00Testing attacks on PLC models
- 17:33Exploiting memory blocks
- 19:01Summary and ethical disclosure
related talks
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
58mIndustrial Control Systems : Pentesting PLCs 101 (Part 1/2)
55mPLC-Blaster: A worm Living Solely In The PLC
38mPLC-Blaster: A Worm Living Solely in the PLC
40mHacking Mitsubishi PLC Without Access To Firmware
50mDead Man’s PLC: Ransoming the Physical World via Operational Technology
46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OT
39mA Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven