Firmware modification attacks on programmable logic controllers

International Journal of Critical Infrastructure Protection

Volumn 6, Issue 2, 2013, Pages 76-84

  Basnight, Zachry ^a   Butts, Jonathan ^a   Lopez, Juan ^a   Dube, Thomas ^a  

^a AIR FORCE INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

Firmware; Industrial control systems; Modification attacks; Programmable logic controllers; Reverse engineering

Indexed keywords

ALLEN-BRADLEY; INDUSTRIAL CONTROL SYSTEMS; MALWARES; MODIFICATION ATTACK; PHYSICAL OUTPUT; PROGRAMMABLE LOGIC CONTROLLERS (PLC); PROOF OF CONCEPT; USER LEVELS;

CONTROLLERS; PROGRAMMABLE LOGIC CONTROLLERS; PROGRAMMED CONTROL SYSTEMS; REVERSE ENGINEERING;

FIRMWARE;

EID: 84879786846     PISSN: 18745482     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.ijcip.2013.04.004     Document Type: Article

References (20)

1. ARM Limited, Software Development Toolkit Reference Guide, ARM DUI 0041C, Cambridge, United Kingdom, 1998.
2. ARM, ARM Architecture Reference Manual, ARM DDI 0100I, Cambridge, United Kingdom, 2005.
3. ARM, ARM RealView ICE and ARM Development Studio 5, Cambridge, United Kingdom.
4. Breeuwsma I. Forensic imaging of embedded systems using JTAG (boundary-scan). Digital Investigation 2006, 3(1):32-42.
5. G. Cook, CRC RevEng: An arbitrary-precision CRC calculator and algorithm finder 〈〉, 2013. http://www.reveng.sourceforge.net.
6. DI Management, BigDigits multiple-precision arithmetic source code, Perth, Australia 〈〉. http://www.di-mgt.com.au/bigdigits.html.
7. N. Falliere, L. O'Murchu, E. Chien, W32.Stuxnet Dossier, Symantec Corporation, Cupertino, California, 2011.
8. Hex-Rays, IDA Disassembler and Debugger, Liege, Belgium 〈〉. http://www.hex-rays.com/products/ida.
9. Institute of Electrical and Electronics Engineers, IEEE Standard Test Access Port and Boundary-Scan Architecture, IEEE Standard 1149.1-2001, New York, 2001.
10. Institute of Electrical and Electronics Engineers, IEEE Standard for Information Technology - Telecommunications and Information Exchange Between Systems - Local and Metropolitan Area Networks - Specific Requirements Part 3: Carrier Sense Multiple Access with Collision Detection (CSMA/CD) Access Method and Physical Layer Specifications, IEEE Standard 802.3-2008, New York, 2008.
11. International Electrotechnical Commission, Programmable Controllers - Part 3: Programming Languages, IEC 61131-3, Geneva, Switzerland, 2013.
12. C. Madsen, VBinDiff - Visual Binary Diff 〈〉. http://www.cjmweb.net/vbindiff.
13. Maxino T., Koopman P. The effectiveness of checksums for embedded control networks. IEEE Transactions on Dependable and Secure Computing 2009, 6(1):59-72.
14. McMinn L., Butts J. A firmware verification tool for programmable logic controllers. Critical Infrastructure Protection VI, 2012, 59-69. Springer, Heidelberg, Germany.
15. D. Peck, D. Peterson, Leveraging Ethernet card vulnerabilities in field devices, presented at the SCADA Security Scientific Symposium, 2009.
16. Rockwell Automation, Logix5000 Controllers Nonvolatile Memory Card Programming Manual, Publication 1756-PM017E-EN-P, Milwaukee, Wisconsin, 2012.
17. R. Santamarta, Reverse engineering industrial firmware for fun and backdoors I, Reversemode 〈〉, 2011. http://www.reversemode.com/index.php?option=com_content&task=view&id=80&Itemid=1.
18. I. Slochinsky, Intro to embedded reverse engineering for PC reversers, presented at the REcon 2010 Conference, 2010.
19. K. Stouffer, J. Falco, K. Scarfone, Guide to Industrial Control Systems (ICS) Security, NIST Special Publication 800-82, National Institute of Standards and Technology, Gaithersburg, Maryland, 2011.
20. U.S. Department of Homeland Security, ICS-CERT Monitor, Washington, DC 〈〉, October-November-December, 2012. http://ics-cert.us-cert.gov/pdf/ICS-CERT_Monthly_Monitor_Oct-Dec2012.pdf.