@misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {A Flashback on Control Logic Injection Attacks against Programmable Logic Controllers}, series = {Automation}, volume = {3}, journal = {Automation}, number = {4}, issn = {2673-4052}, doi = {10.3390/automation3040030}, pages = {596 -- 621}, abstract = {Programmable logic controllers (PLCs) make up a substantial part of critical infrastructures (CIs) and industrial control systems (ICSs). They are programmed with a control logic that defines how to drive and operate critical processes such as nuclear power plants, petrochemical factories, water treatment systems, and other facilities. Unfortunately, these devices are not fully secure and are prone to malicious threats, especially those exploiting vulnerabilities in the control logic of PLCs. Such threats are known as control logic injection attacks. They mainly aim at sabotaging physical processes controlled by exposed PLCs, causing catastrophic damage to target systems as shown by Stuxnet. Looking back over the last decade, many research endeavors exploring and discussing these threats have been published. In this article, we present a flashback on the recent works related to control logic injection attacks against PLCs. To this end, we provide the security research community with a new systematization based on the attacker techniques under three main attack scenarios. For each study presented in this work, we overview the attack strategies, tools, security goals, infected devices, and underlying vulnerabilities. Based on our analysis, we highlight the current security challenges in protecting PLCs from such severe attacks and suggest security recommendations for future research directions.}, language = {en} } @misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {A Control Injection Attack against S7 PLCs -Manipulating the Decompiled Code}, series = {IECON 2021 - 47th Annual Conference of the IEEE Industrial Electronics Society}, journal = {IECON 2021 - 47th Annual Conference of the IEEE Industrial Electronics Society}, isbn = {978-1-6654-0256-9}, issn = {2577-1647}, doi = {10.1109/IECON48115.2021.9589721}, language = {en} } @misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {You Are What You Attack: Breaking the Cryptographically-Protected S7 Protocol}, series = {19th International Conference on Factory Communication Systems (WFCS), (2023)}, journal = {19th International Conference on Factory Communication Systems (WFCS), (2023)}, publisher = {IEEE}, isbn = {978-1-6654-6432-1}, issn = {2835-8414}, doi = {10.1109/WFCS57264.2023.10144251}, pages = {8}, abstract = {S7 protocol defines an appropriate format for exchanging messages between SIMATIC S7 PLCs and their corresponding engineering software i.e., TIA Portal. Recently, Siemens has provided its newer PLC models and their proprietary S7 protocols with a very developed and sophisticated integrity check mechanism to protect them from various exploits e.g., replay attacks. This paper addresses exactly this point, and investigates the security of the most developed integrity check mechanism that the newest S7CommPlus protocol version implements. Our results showed that the latest S7 PLC models as well as their related protocols are still vulnerable. We found that adversaries can manipulate two hashes that play a significant role in generating keys and bytes for the encryption processes implemented in the S7CommPlus protocol. This allows to reproduce S7 packets and conduct several attacks that eventually impact the operation of the target PLC and the entire physical process it controls. To validate our findings, we test all the attack scenarios presented in this work on a cryptographically protected S7 PLC from the 1500 family which uses the S7CommPlusV3 protocol.}, language = {en} } @misc{AlsabbaghAmogbonjayeUrregoetal., author = {Alsabbagh, Wael and Amogbonjaye, Samuel and Urrego, Diego and Langend{\"o}rfer, Peter}, title = {A Stealthy False Command Injection Attack on Modbus based SCADA Systems}, series = {20th Consumer Communications \& Networking Conference (CCNC), (2023)}, journal = {20th Consumer Communications \& Networking Conference (CCNC), (2023)}, isbn = {978-1-6654-9734-3}, issn = {2331-9860}, doi = {10.1109/CCNC51644.2023.10059804}, pages = {9}, abstract = {Modbus is a widely-used industrial protocol in Supervisory Control and Data Acquisition (SCADA) systems for different purposes such as controlling remote devices, monitoring physical processes, data acquisition, etc. Unfortunately, such a protocol lacks security means i.e., authentication, integrity, and confidentiality. This has exposed industrial plants using the Modbus protocol and made them attractive to malicious adversaries who could perform various kinds of cyber-attacks causing significant consequences as Stuxnet showed. In this paper, we exploit the insecurity of the Modbus protocol and perform a stealthy false command injection scenario concealing our injection from the SCADA operator. Our attack approach is comprised of two main phases: 1) Pre-attack phase (offline) where an attacker sniffs, collects and stores sufficient valid request-response pairs in a database, 2) Attack phase (online) where the attacker performs false command injection and conceals his injection by replaying a valid response from his database upon each request sent from the HMI user. Such a scenario is quite severe and might cause disastrous damages in SCADA systems and critical infrastructures if it is successfully implemented by malicious adversaries. Finally, we suggest some appropriate mitigation solutions to prevent such a serious threat.}, language = {en} } @misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {Security of Programmable Logic Controllers and Related Systems: Today and Tomorrow}, series = {IEEE Open Journal of the Industrial Electronics Society}, journal = {IEEE Open Journal of the Industrial Electronics Society}, number = {4}, issn = {2644-1284}, doi = {10.1109/OJIES.2023.3335976}, pages = {659 -- 693}, abstract = {Programmable logic controllers (PLCs) are indispensable in critical infrastructures and industrial control systems. The increasing demand for enhanced cost-effectiveness and production efficiency has driven automation manufacturers to integrate PLC-based applications and systems with external networks, such as Internet. Unfortunately, this connectivity has exposed systems to potential malicious attacks from motivated adversaries. Addressing this pressing issue necessitates a comprehensive summary of ongoing research related to PLCs and their related systems. This summary should classify these systems based on disclosed vulnerabilities, potential threats, and proposed security solutions, catering to both scientists and industrial engineers. While several recent surveys have reviewed and discussed PLC security and related topics, they often fell short of covering all essential aspects comprehensively. Furthermore, prior surveys tended to focus on analyzing vulnerabilities at the system level, overlooking the vulnerabilities specific to PLCs themselves. Consequently, their findings failed to effectively secure current operational systems or propose improved solutions for future PLC designs. In this article, we bridge this research gap by providing a detailed review of all aspects concerning the security of PLCs and related systems. This includes vulnerabilities, potential attacks, and security solutions including digital forensics. We aim to offer a precise analysis, addressing the shortcomings of previous studies. Finally, we conclude this article by presenting our recommendations tailored for PLC manufacturers, researchers, and engineers. We hope that these recommendations will contribute to the development of more secure PLCs in the future.}, language = {en} } @misc{AlsabbaghKimLangendoerfer, author = {Alsabbagh, Wael and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {No Attacks Are Available: Securing the OpenPLC and Related Systems}, series = {8th GI/ACM Workshop on Industrial Automation and Control Systems (IACS WS 2023), 2085 (2023)}, journal = {8th GI/ACM Workshop on Industrial Automation and Control Systems (IACS WS 2023), 2085 (2023)}, doi = {10.13140/RG.2.2.24570.47043}, pages = {12}, abstract = {The use of Programmable Logic Controllers (PLCs) expands in industrial domains, which makes ensuring the security of Industrial Control Systems (ICSs) become paramount. The OpenPLC project, the first open-source initiative, provides flexible and cost-effective PLC solutions to build up affordable test-beds, as well as conduct experiments and academic researches. This project has wildly grown in the last few years, thus it is essential to address the most emerging security challenges it encounters. This paper introduces a new OpenPLC architecture, called OpenPLC Aqua, provided with a set of security solutions designed specifically to overcome the vulnerabilities that the current OpenPLC versions are prone to. The new OpenPLC architecture includes four security features: 1) user credentials encryption, securing the Webserver, Whitelisting and secure SSL/TLS communication channel. The OpenPLC Aqua software was tested against several attack scenarios, that were feasible against the old OpenPLC versions. Our experimental results showed our enhanced OpenPLC software is secure and resistant against several attack scenarios e.g., authentication, injection, Man-in-the-Middle and replay attacks. The OpenPLC Aqua is publicly available and a proof of concept demo is also published with this paper.}, language = {en} } @incollection{LangendoerferKornemannAlsabbaghetal., author = {Langend{\"o}rfer, Peter and Kornemann, Stephan and Alsabbagh, Wael and Hermann, Erik}, title = {Information Security: The Cornerstone for Surviving the Digital Wild}, series = {The Future of Smart Production for SMEs: A Methodological and Practical Approach Towards Digitalization in SMEs}, booktitle = {The Future of Smart Production for SMEs: A Methodological and Practical Approach Towards Digitalization in SMEs}, publisher = {Springer International Publishing}, address = {Cham}, isbn = {978-3-031-15428-7}, doi = {10.1007/978-3-031-15428-7_29}, pages = {335 -- 341}, abstract = {In this chapter we are discussing the very basics in the sense of how to prepare your company with respect to security. The essential issues are a proper information security governance framework that takes into account the managerial and organizational issues as well as proper technical means. For the latter we introduce network separation as this is one of the prime means to protect your production network from network based attacks.}, language = {en} } @misc{AlsabbaghKimLangendoerfer, author = {Alsabbagh, Wael and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {Good Night, and Good Luck: A Control Logic Injection Attack on OpenPLC}, series = {Proc. 49th Annual Conference of the IEEE Industrial Electronics Society (IECON 2023), (2023)}, journal = {Proc. 49th Annual Conference of the IEEE Industrial Electronics Society (IECON 2023), (2023)}, doi = {10.13140/RG.2.2.32913.20321}, pages = {8}, language = {en} } @misc{AlsabbaghKimPatiletal., author = {Alsabbagh, Wael and Kim, Chaerin and Patil, Nitin Sanjay and Langend{\"o}rfer, Peter}, title = {Beyond the lens: false data injection attacks on IIoT-cameras through MQTT manipulation}, series = {2024 7th Conference on Cloud and Internet of Things (CIoT)}, journal = {2024 7th Conference on Cloud and Internet of Things (CIoT)}, publisher = {IEEE}, doi = {10.1109/CIoT63799.2024.10757025}, pages = {1 -- 7}, language = {en} } @misc{AlsabbaghKimPatiletal., author = {Alsabbagh, Wael and Kim, Chaerin and Patil, Nitin Sanjay and Langend{\"o}rfer, Peter}, title = {Hacking the backbone : shell reverse attacks on IIoT systems}, series = {21st International Conference on Embedded Wireless Systems and Networks (EWSN)}, journal = {21st International Conference on Embedded Wireless Systems and Networks (EWSN)}, doi = {10.13140/RG.2.2.23097.79207}, pages = {1 -- 7}, abstract = {As Industrial Internet of Things (IIoT) systems expand , they face growing risks from complex cyber threats, including reverse shell attacks. These attacks exploit IIoT vulnerabilities, allowing unauthorized remote access and endangering industrial operations. This paper explores reverse shell attacks, where adversaries trick operators into unwittingly installing malware on IIoT devices. This malware then establishes hidden connections to the attacker's server, bypassing traditional firewalls. Exploiting command injection vulnerabilities on IIoT servers facilitates the deployment of reverse shell scripts, granting attackers persistent and covert system access. Our research focuses on IIoT device authentication, identifying weak credentials and using brute force attacks for initial access. We also demonstrate deploying Python-based reverse shell payloads via the SFTP protocol, creating lasting connections to the attacker's server. Through experiments with the Fischertechnik Learning Factory 4.0, we show how reverse shell payloads disrupt operations, enabling unauthorized commands and data theft. To counter these threats, we advocate for robust security measures like network segmentation, rigorous patch management, and advanced intrusion detection systems. All our attack codes and a proof-of-concept are publicly accessible.}, language = {de} } @misc{AlsabbaghKimLangendoerfer, author = {Alsabbagh, Wael and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {Silent sabotage : a stealthy control logic injection in IIoT systems}, series = {5th Silicon Valley Cybersecurity Conference (SVCC 2024)}, journal = {5th Silicon Valley Cybersecurity Conference (SVCC 2024)}, publisher = {IEEE}, address = {New York}, doi = {10.1109/SVCC61185.2024.10637363}, pages = {1 -- 8}, language = {de} } @misc{AlsabbaghKimLangendoerfer, author = {Alsabbagh, Wael and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {Investigating the security of OpenPLC : vulnerabilities, attacks, and mitigation solutions}, series = {IEEE Access}, volume = {12}, journal = {IEEE Access}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, issn = {2169-3536}, doi = {10.1109/ACCESS.2024.3356051}, pages = {11561 -- 11583}, language = {en} } @misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {A Fully-Blind False Data Injection on PROFINET I/O Systems}, series = {2021 IEEE 30th International Symposium on Industrial Electronics (ISIE)}, journal = {2021 IEEE 30th International Symposium on Industrial Electronics (ISIE)}, isbn = {978-1-7281-9024-2}, issn = {2163-5145}, doi = {10.1109/ISIE45552.2021.9576496}, language = {en} } @misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {Patch Now and Attack Later - Exploiting S7 PLCs by Time-Of-Day Block}, series = {2021 4th IEEE International Conference on Industrial Cyber-Physical Systems (ICPS)}, journal = {2021 4th IEEE International Conference on Industrial Cyber-Physical Systems (ICPS)}, isbn = {978-1-6654-3045-6}, doi = {10.1109/ICPS49255.2021.9468226}, language = {en} } @misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {A Stealth Program Injection Attack against S7-300 PLCs}, series = {2021 22nd IEEE International Conference on Industrial Technology (ICIT)}, journal = {2021 22nd IEEE International Conference on Industrial Technology (ICIT)}, isbn = {978-1-7281-5731-3}, doi = {10.1109/ICIT46573.2021.9453483}, language = {en} } @misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {A New Injection Threat on S7-1500 PLCs - Disrupting the Physical Process Offline}, series = {IEEE Open Journal of the Industrial Electronics Society}, journal = {IEEE Open Journal of the Industrial Electronics Society}, number = {3}, issn = {2644-1284}, doi = {10.1109/OJIES.2022.3151528}, pages = {146 -- 162}, language = {en} } @misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {No Need to be Online to Attack - Exploiting S7-1500 PLCs by Time-Of-Day Block}, series = {Proc. 28th International Conference on Information, Communication and Automation Technologies (ICAT 2022), arajevo, Bosnia and Herzegovina, 16-18 June 2022}, journal = {Proc. 28th International Conference on Information, Communication and Automation Technologies (ICAT 2022), arajevo, Bosnia and Herzegovina, 16-18 June 2022}, isbn = {978-1-6654-6692-9}, issn = {2643-1858}, doi = {10.1109/ICAT54566.2022.9811147}, pages = {8}, language = {en} } @misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {A Remote Attack Tool on Siemens S7-300 Controllers: Practical Report}, series = {Kommunikation und Bildverarbeitung in der Automation : Ausgew{\"a}hlte Beitr{\"a}ge der Jahreskolloquien KommA und BVAu 2020}, journal = {Kommunikation und Bildverarbeitung in der Automation : Ausgew{\"a}hlte Beitr{\"a}ge der Jahreskolloquien KommA und BVAu 2020}, editor = {Jasperneite, J{\"u}rgen and Lohweg, Volker}, publisher = {Springer Vieweg}, address = {Heidelberg}, isbn = {978-3-662-64282-5}, issn = {2522-8579}, doi = {10.1007/978-3-662-64283-2_1}, pages = {3 -- 21}, language = {en} } @misc{AlsabbaghAmogbonjayeKimetal., author = {Alsabbagh, Wael and Amogbonjaye, Samuel and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {Pirates of the MQTT : raiding IIoT systems with a rogue client}, series = {2024 8th Cyber Security in Networking Conference (CSNet)}, journal = {2024 8th Cyber Security in Networking Conference (CSNet)}, publisher = {IEEE}, address = {Piscataway, NJ}, doi = {10.1109/CSNet64211.2024.10851733}, pages = {248 -- 253}, abstract = {The integration of MQTT (Message Queuing Telemetry Transport) in Industrial Internet of Things (IIoT) systems enhances operational efficiency but introduces significant security vulnerabilities, particularly through rogue MQTT clients. These clients exploit MQTT weaknesses to disrupt industrial processes and compromise data integrity. This paper examines the impact of rogue MQTT client attacks, demonstrated through a detailed case study using the Fischertechnik Lernfabrik 4.0. We highlight how attackers can exploit MQTT's inherent vulnerabilities, including anonymous connections and message retention, to inject false data and interfere with operations. To address these risks, we propose several mitigation strategies: implementing fine-grained authorization for topic access control, enhancing replay attack protection with Message Authentication Code (MAC), employing mutual TLS (mTLS) for secure client authentication, and incorporating real-time client activity monitoring and anomaly detection. These measures aim to bolster IIoT system security, mitigate potential disruptions, and maintain operational integrity. Our findings and recommendations contribute to advancing security practices in MQTT-based IIoT environments. All attack codes and a proof-of-concept are ublicly available.}, language = {en} } @misc{AlsabbaghKimLangendoerfer, author = {Alsabbagh, Wael and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {A payload of lies : false data injection attacks on MQTT-based IIoT systems}, series = {IECON 2024 - 50th Annual Conference of the IEEE Industrial Electronics Society : proceedings}, journal = {IECON 2024 - 50th Annual Conference of the IEEE Industrial Electronics Society : proceedings}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-6654-6454-3}, doi = {10.1109/IECON55916.2024.10905487}, pages = {1 -- 8}, abstract = {In the ever-evolving landscape of Industrial Internet of Things (IIoT), security emerges as a critical concern. This paper delves into the realm of False Data Injection Attacks (FDIAs) within MQTT-based IIoT systems, specifically targeting the publisher-subscriber model. Our exploration unveils two distinct attack scenarios that exploit the vulnerabilities inherent in the communication fabric. In the first scenario, we demonstrate the potential chaos wrought by sending false data to subscribers, manipulating their perception and inducing actions that align with the attacker's whims. The second scenario ventures into the heart of the publisher, where the attacker injects false data - deceptive status updates from other publishers e.g., Programmable Logic Controllers (PLCs). The repercussions ripple through the entire industrial process, impacting operations based on fraudulent information. This showcases the cascading effects of FDIAs, illustrating the profound threat they pose to the reliability and integrity of IIoT systems. For real-world attack scenarios, Our attacks were conducted on a small MQTT-based IIoT system, using the Fischertechnik Lernfabrik 4.0 9V factory. Finally, we proposes mitigation solutions to safeguard IIoT systems from the far-reaching consequences of false data manipulation. Our attack codes as well as a proof-of-concept are publicly available for further research.}, language = {en} }