PLC Code Protection

The AFIT of Today is the Air Force of Tomorrow.

CCR - The Center for Cyberspace Research

Air Force Institute of Technology

Center for Cyberspace Research

Stephen Dunlap

Jonathan Butts, PhD

PLC Code Protection



What’s the Story?



Tactical Questions



•  Requirements

•  Helpful:

Resources



Static Analysis

Device? We don’t need no stinkin device…



Hardware Analysis

But I’ll take it if I can get it…



Dynamic Analysis

I don’t always do dynamic analysis, but when I do, I use JTAG…



Let’s Do This

Attacks Need:

Triggers

Payloads Deployment





•  Hook regularly executed function •  Count executions

Time Bomb

Jump Instruction before modification

After modification



Time Bomb Cont.

Store a counter in memory

Load counter and subtract

Test for zero Continue operation if greater



•  Hook jump table for CPU mode change •  Keep track of changes for specific sequence

Logic Bomb

RUN

REM RUN

REM PROG

PROG



•  Hook CIP command handler jump table

Remote Commands



•  Check for custom service and instance

Remote Commands Cont.





•  Endless loop causes recoverable fault •  Fault shutdown routine

Soft DoS



•  Write value to flash •  Fault if value exists

Persistent DoS

•  Exploit Flash Writing Function •  R0 – Destination address •  R1 – Source Address •  R1 – Data Length

Flash end address



Where to From Here?

•  Traffic Modification •  Modify CIP values •  Propagation

•  Persistence •  Implant in bootloader •  Ignore firmware updates •  Modify version number





Pivoting Through Firewall



Pivoting Through Router



Pivoting Through Router



Implications

•  Vendor agnostic •  Expensive devices not needed •  Supply chain •  Cost of entry

•  Team composition: Two guys •  Time: Approx 3 months •  Money: $3,500

NATION STATE NOT REQUIRED



Protection Mechanisms

•  Vendor •  Digital Signatures •  Trusted Platform Module

•  Integrator •  Source Verification •  Access Control •  Configuration Management

•  Asset Owner •  Deep Packet Inspection •  Data Diodes •  Configuration Management



Thank You

Documents

PLC Code Protection