PLC-Blaster: A Worm Living Solely in the PLC
summary
Claim: a PLC-only worm that runs entirely on Siemens Simatic S7-1200 v1–v3 PLCs, written in SCL, implements the S7 download protocol over TCP port 102 via TCON/TRECV, and spreads by uploading itself as an extra organization block. It requires about 38.5 KB RAM and 216.6 KB persistent memory, infects targets in ~10 seconds (PLC briefly enters Stop mode), provides a Python C2 for I/O control and proxying, and survives cold restarts unless overwritten or factory-reset.
AI-written summary · about
chapters (11)
- 0:00Introduction and motivation
- 1:30Background on PLC operation
- 2:20Worm development roadmap
- 6:17Target discovery
- 8:34Protocol and carrier mechanism
- 15:15Security flaws and exploitation
- 19:20Activation and payloads
- 20:28Live demo of the worm
- 28:13Worm performance and analysis
- 31:41Security protection mechanisms
- 35:43Industry-wide implications
related talks
55mPLC-Blaster: A worm Living Solely In The PLC
21mOops, It Halted Again: Exploiting PLC Memory for Fun and Profit in Industrial Control...
50mDead Man’s PLC: Ransoming the Physical World via Operational Technology
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
58mIndustrial Control Systems : Pentesting PLCs 101 (Part 1/2)
39mA Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven
44mRogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
29mFuzzing and Breaking Security Functions of SIMATIC PLCs