PLC-Blaster: A worm Living Solely In The PLC
summary
A self-contained PLC-only worm that runs entirely in SCL targets Siemens S7-1200 v1–3, implements the S7‑COMPP+ program-transfer protocol in ICShell, and uses TCON/TDISCON/Tsend/Treceive blocks to scan and infect other PLCs. Infection takes ~10 seconds while the PLC stops, uses ~38.5 KB RAM and ~216.6 KB persistent memory, adds an extra OB to run alongside the original program, and phones home to a C&C for remote I/O, proxying and a Stop command that forces a cold restart. Demo spreads across four PLCs; live demo has occasional flakiness.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:16Open Source Security
- 3:34How PLCs Work
- 4:41Program Organization Blocks
- 6:09Programming Languages
- 8:22Target Discovery II
- 10:46Carrier
- 11:21Protocol Analysis II
- 14:08Numbers in Attribute-Blocks
- 14:58Anti-Replay Mechanism
- 15:51Transfer a Program
- 17:10Fun with Attribute Blocks
- 20:21Implement the Worm
- 22:08Payloads
- 22:42Demonstration
- 31:15Impact on the PLC
- 33:14Persistence & Identification
- 37:00Knowhow Protection
- 41:31Copy Protection
- 44:02Access Protection
- 45:36Improvements & Recommendations
- 48:30Other Vendors?
- 49:42Leading Vendors Supporting Ethernet
- 50:15Leading Vendors Supporting TCP/IP Functions
- 51:45Further Research
related talks
38mPLC-Blaster: A Worm Living Solely in the PLC
21mOops, It Halted Again: Exploiting PLC Memory for Fun and Profit in Industrial Control...
50mDead Man’s PLC: Ransoming the Physical World via Operational Technology
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
58mIndustrial Control Systems : Pentesting PLCs 101 (Part 1/2)
47mExfiltrating Reconnaissance Data from Air-Gapped ICS/SCADA Networks
44mRogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
39mA Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven