Hacking Mitsubishi PLC Without Access To Firmware
summary
Reconstructs the undocumented Mitsubishi network protocol for the Mitsubishi FX5U PLC using the jig Works 3 simulator, Process Explorer, debugger-assisted reverse engineering, brute‑force command/device enumeration, and custom scripts and a dissector; produces a protocol spec, modules to read/write files, and 15 CVEs including CVE-2022-25161 and CVE-2022-25162; shows practical exploits that lock PLCs, corrupt project files, bypass file/remote passwords and security keys, and reproduces effects on oil and water station demos.
AI-written summary · about
chapters (14)
- 0:00Speaker and Talk Introduction
- 2:40Pre-Research
- 3:29Welcome To Hell The World Of Bytes And Bits
- 4:27Reverse Engineering Eye-Gineering
- 5:27M Protocol
- 5:58M Protocol vs PCAP
- 6:38PCAP vs Manual
- 7:25M Protocol vs Manual
- 8:01Preliminary results
- 9:14Research
- 22:50Results
- 26:06Vulnerabilities
- 34:06Do's & Demo
- 39:08Conclusion
related talks
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
21mOops, It Halted Again: Exploiting PLC Memory for Fun and Profit in Industrial Control...
46mDeconstructive Take-Over of Mitsubishi Electric Ecosystems
58mIndustrial Control Systems : Pentesting PLCs 101 (Part 1/2)
29mFuzzing and Breaking Security Functions of SIMATIC PLCs
39mA Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven
39mIn-Field Emulation & Fuzzing of PLCs to Uncover the Next Zero-Day in Industrial Control Systems
44mRogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs