Non-Intrusive Vulnerability Localization and Hotpatching for Industrial Control Systems
summary
Framework locates and hotpatches buffer and control-flow bugs in Codesys IEC applications without reboot by rehosting execution in angr rehosting, building a data-dependence graph to trace a corrupt store back to the library boundary, and installing a jump-table hook via an LKM or JTAG patcher. Tested on a Fargo PFC100 with an MSF desalination HIL, it catches top CWEs (memcpy/pcpy overruns, OS command injection), stops a 200-sized exploit at the 100th cycle and restores normal scan cycles.
AI-written summary · about
chapters (10)
- 0:00Introduction to ICS
- 1:06Smart systems and security
- 3:18Hot patching motivation
- 5:52Analyzing attack impacts
- 8:55Patching methodology
- 13:11Out-of-bounds demo
- 17:28Runtime protection demo
- 20:04Out-of-bounds speed demo
- 23:02Command injection demo
- 27:41Conclusion and Q&A
related talks
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
45mFinding Vulnerabilities through Static Analysis and Scripting
34mCoDe16; 16 Zero-Day Vulnerabilities Affecting CODESYS Framework Leading to Remote Code Execution
39mNight of the living vulnerabilities
46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OT
01mFrom Bugs to Breaches
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)