Internet-facing PLCs as a network backdoor

2015 IEEE Conference on Communications and NetworkSecurity, CNS 2015

Volumn , Issue , 2015, Pages 524-532

  Klick, Johannes ^a   Lau, Stephan ^a   Marzin, Daniel ^a   Malchow, Jan Ole ^a   Roth, Volker ^a  

^a FREIE UNIVERSITÄT BERLIN   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

FACINGS; INTELLIGENT CONTROL; INTERNET; SCANNING;

CONTROL PROCESS; INDUSTRIAL CONTROL SYSTEMS; INTEGRAL COMPONENTS; IT NETWORKS; MODERN INFRASTRUCTURE; PRODUCTION NETWORK; SECURITY FEATURES;

NETWORK SECURITY;

EID: 84966318447     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CNS.2015.7346865     Document Type: Conference Paper

References (24)

1. S. Heng, "Industry 4. 0 upgrading of germany's industrial capabilities on the horizon:' Deutsche Bank Research, 2014.
2. NIST, "CVE-2014-2908, " Apr. 2014. [Online]. Available: hups: Ilweb. nvd. nist. gov/view/vuln/detail?vulnld=CVE-2014-2908
3. -, "CVE-2014-2246, " Mar. 2014. [Online]. Available: https: Ilweb. nvd. nist. gov/view/vuln/detail?vulnld=CVE-2014-2246
4. -, "CVE-2012-3037, " May 2012. [Online]. Available: hups: Ilweb. nvd. nist. gov/view/vuln/detail?vulnld=CVE-2012-3037
5. D. Beresford, "Exploiting Siemens Simatic S7 PLCs, " Black Hat USA, 2011.
6. N. Cybersecurity and C. I. C. (NCCIC), "Ics-cert monitor, " Sep. 2014.
7. Bundesamt fUr Sicherheit in der Informationstechnik, "Die Lage der IT-Sicherheit in Deutschland 2014, " 2015.
8. Industrial Control Systems Cyber Emergency Response Team, "Alert (ICS-ALERT-l2-046-0 LA) Increasing Threat to Industrial Control Systems (Update A), " Available from ICS-CERT, ICSALERT-12-046-0lA., Oct. 2012. [Online]. Available: hups: I lics-cert. us-cert. gov lalerts/ICS-ALERT-12-046-0 I A
9. J.-O. Malchow and J. Klick, Sicherheit in vernetzten Systemen: 21. DFN-Workshop. Paulsen, c., 2014, ch. Erreichbarkeit von digitalen Steuergeraten-ein Lagebild, pp. C2-CI9.
10. B. Radvanovsky, "Project shine: 1, 000, 000 internet-connected scada and ics systems and counting, " Tofino Security, 2013.
11. R. Langner. (2011) A time bomb with fourteen bytes. [Online]. Available: hUp:llwww. langner. comlen!20lll071 211a-ti me-bomb-with-fourteen-bytesl
12. B. Meixell and E. Forner, "Out of Control: Demonstrating SCADA Exploitation:' Black Hat USA, 2013.
13. S. E. McLaughlin, "On dynamic malware payloads aimed at programmable logic controllers. " in HotSec, 20 II. 532
14. S. McLaughlin and P. McDaniel, "Sabot: specification-based payload generation for programmable logic controllers, " in Proceedings of the 2012 ACM coriference on Computer and communications security. ACM, 2012, pp. 439-449.
15. Wikipedia, "Automation Pyramid (content taken). " [Online]. Available: https:llde. wikipedia. org/wiki/Automatisierungspyramide
16. Siemens, "S7 314C-2PN/DP Technical Details. " [Online]. Available: https://support. industry. siemens. com/cs/pd/495261 ?pdti=td& pnid=13754&lc=de-WW
17. -, "S7-300 CPU 31xC and CPU 31x: Technical specifications. " [Online]. Available: https:llcache. industry. siemens. com/dllfiles/906/12996906lau-70325/v II s7300-cpu-31xc-and-cpu-31 x-manuaCen-US-en-US. pdf
18. -. (2011) S7-300 Instruction list S7-300 CPUs and ET 200 CPUs . [Online]. Available: https://cache. industry. siemens. com/dIlfiles/679/ 3 I 977679/atC8I 622/v lIs7300-parameter-manual-en-US-en-US. pdf
19. SNAP7, "S7 Protocol. " [Online]. Available: http://snap7. sourceforge. netlsiemens-comm. html#s7 protocol
20. J. Kiihner, "DotNetSiemensPLCToolBoxLibrary. " [Online]. Available: https:llgithub. comljogibear9988/DotNetSiemensPLCToolBoxLibrary
21. Siemens. (2006) System Software for S7-300/400 System and Standard Functions Volume 112. [Online]. Available: https:llcache. industry. siemens. com/dIlfiles/57 4/121457 4/atc 44504/v lISFC-e. pdf
22. D. Marzin, S. Lau, and J. Klick, "PLCinject Tool. " [Online]. Available: https:llgithub. comlSCADACS/PLCinject
23. J. Case, M. Fedor, M. Schoffstall, and J. Davin, "Simple Network Management Protocol (SNMP), " RFC 1157 (Historic), Internet Engineering Task Force, May 1990. [Online]. Available: http://www. ietf. orglrfc/rfcI157. Txt
24. M. Leech, M. Ganis, Y. Lee, R. Kuris, D. Koblas, and L. Jones, "SOCKS Protocol Version 5, " RFC 1928 (Proposed Standard), Internet Engineering Task Force, Mar. 1996. [Online]. Available: http://www. ietf. orglrfc/rfc 1928. Txt