@phdthesis{Alsabbagh2023, author = {Alsabbagh, Wael}, title = {Investigating security issues in programmable logic controllers and related protocols}, doi = {10.26127/BTUOpen-6611}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus4-66114}, school = {BTU Cottbus - Senftenberg}, year = {2023}, abstract = {Programmable Logic Controllers (PLCs) are pivotal in Critical Infrastructures (CIs) and Industrial Control Systems (ICSs), governing processes in nuclear power plants, petrochemical factories, and water treatment systems. Despite their importance, PLCs are vulnerable to security threats, notably control logic injection attacks, aiming to sabotage physical processes. This thesis delves into PLC security, analyzing vulnerabilities in non-cryptographically and cryptographically protected PLCs, particularly Siemens S7-300 and S7-1500 models. Siemens, an automation market leader, utilizes S7-300 PLCs in millions of applications, reflecting the broader ICS security landscape. The S7-1500 line claims resistance to cyberattacks, including control logic injections. The thesis evaluates authentication in non-cryptographically protected PLCs, introducing a stealthy control logic injection attack scenario using an S7-300 PLC and S7Comm protocol. The second part explores integrity checks in cryptographically protected S7-1500 PLCs. Findings, encompassing disclosed vulnerabilities, lead to a severe control logic injection attack with a malicious interrupt block, conducted in an industrial setting using the S7-1500 and S7CommPlus protocol. The final segment focuses on Profinet protocol security and an injection attack scenario. The study demonstrates adversaries manipulating critical data without prior knowledge, causing harm to physical processes. A real-world attack on a Profinet-based system with two S7-300 PLCs is executed. The thesis concludes by proposing mitigation solutions, enhancing PLC and communication protocol security. This contribution elevates the security posture of millions of operating devices globally, advancing PLC security research.}, subject = {Programmable logic controllers; Control logic injection; Cyberattacks; Cybersecurity; False data injection; Speicherprogrammierbare Steuerungen; Control Logic Injection-Angriffe; Cyberangriffe; Cybersischerheit; False Data Injection-Angriffe; Kritische Infrastruktur; Kontrollsystem; Speicherprogrammierte Steuerung; SIMATIC S7-300; SIMATIC S7-1500; Computersicherheit; Cyberattacke}, language = {en} }