Downloads & Free Reading Options - Results

Although Programmable Logic Controllers (PLCs) have been successfully used at municipal and industrial wastewater treatment plants (WWTPs), the Army has not yet automated its WWTPs by using this relatively simple, low-cost, available technology. PLCs are widely used in environmental engineering facilities and in applications with control requirements similar to water/ wastewater operations to: (1) reduce manhours dedicated to repetitive operational monitoring tasks, (2) ensure operational and equipment safety, and (3) monitor and reduce facility chemical and energy costs. Benefits of PLCs include: (1) Off-the-shelf availability; (2) Low-cost procurement, installation, and repair; (3) Small physical size; (4) Simplified programming and troubleshooting; (5) Standalone or networked operation; and (6) Multiple sensor monitoring. This report summarizes the concepts underlying PLC use in WWTPs, outlines successful applications of PLC technology in commercial WWTPs, and details specific operations in military WWTPs that may benefit from PLC implementation.

Although Programmable Logic Controllers (PLCs) have been successfully used at municipal and industrial wastewater treatment plants (WWTPs), the Army has not yet automated its WWTPs by using this relatively simple, low-cost, available technology. PLCs are widely used in environmental engineering facilities and in applications with control requirements similar to water/ wastewater operations to: (1) reduce manhours dedicated to repetitive operational monitoring tasks, (2) ensure operational and equipment safety, and (3) monitor and reduce facility chemical and energy costs. Benefits of PLCs include: (1) Off-the-shelf availability; (2) Low-cost procurement, installation, and repair; (3) Small physical size; (4) Simplified programming and troubleshooting; (5) Standalone or networked operation; and (6) Multiple sensor monitoring. This report summarizes the concepts underlying PLC use in WWTPs, outlines successful applications of PLC technology in commercial WWTPs, and details specific operations in military WWTPs that may benefit from PLC implementation.

This document contains a 40-hour course in programmable logic controllers (PLC), developed for a business-industry technology resource center for firms in eastern Pennsylvania by Northampton Community College. The 10 units of the course cover the following: (1) introduction to programmable logic controllers; (2) DOS primer; (3) prerequisite mathematical understanding; (4) basic principles of operation; (5) discrete input/output systems; (6) basics of PLC programming; (7) implementing and programming the PLC; (8) guidelines for installation, start-up, and maintenance; (9) PLC system selection guidelines; and (10) course review. Units include information sheets, transparency masters, and (in some cases) pretests and exercises. (KC)

Daily operations of U.S. Navy afloat and ashore systems are heavily reliant on industrial control systems (ICSs) to manage critical infrastructure services. Programmable logic controllers (PLCs) are vital components in these cyber-physical systems. The industrial network protocols used to communicate between nodes in a control network are complex and vulnerable to a myriad of cyber attacks, as reported by Department of Homeland Security Industrial Control Systems Cyber Emergency Response Team. This thesis utilizes protocol fuzz testing techniques to investigate potential vulnerabilities in the Allen-Bradley/Rockwell Automation (AB/RA) MicroLogix 1100 PLC through its implementation of EtherNet/IP, Common Industrial Protocol (CIP), and Programmable Controller Communication Commands (PCCC) communication protocols. This research also examines whether cross-generational vulnerabilities exist in the more advanced AB/RA ControlLogix 1756-L71 PLC. Our results discover several deviations from the EtherNet/IP and PCCC specifications in the MicroLogix 1100 implementation of these protocols. Additionally, we find that a recently disclosed denial-of-service vulnerability that renders the MicroLogix 1100 inoperable does not trigger a similar fault condition in the ControlLogix PLC.

Incorporating a state-of-the-art process control and instrumentation system into a complex system for thermal vacuum testing is discussed. The challenge was to connect several independent control systems provided by various vendors to a supervisory computer. This combination will sequentially control and monitor the process, collect the data, and transmit it to color a graphic system for subsequent manipulation. The vacuum system upgrade included: replacement of seventeen diffusion pumps with eight cryogenic pumps and one turbomolecular pump, replacing a relay based control system, replacing vacuum instrumentation, and upgrading the data acquisition system.

Incorporating a state-of-the-art process control and instrumentation system into a complex system for thermal vacuum testing is discussed. The challenge was to connect several independent control systems provided by various vendors to a supervisory computer. This combination will sequentially control and monitor the process, collect the data, and transmit it to color a graphic system for subsequent manipulation. The vacuum system upgrade included: replacement of seventeen diffusion pumps with eight cryogenic pumps and one turbomolecular pump, replacing a relay based control system, replacing vacuum instrumentation, and upgrading the data acquisition system.

Incorporating a state-of-the-art process control and instrumentation system into a complex system for thermal vacuum testing is discussed. The challenge was to connect several independent control systems provided by various vendors to a supervisory computer. This combination will sequentially control and monitor the process, collect the data, and transmit it to color a graphic system for subsequent manipulation. The vacuum system upgrade included: replacement of seventeen diffusion pumps with eight cryogenic pumps and one turbomolecular pump, replacing a relay based control system, replacing vacuum instrumentation, and upgrading the data acquisition system.

Incorporating a state-of-the-art process control and instrumentation system into a complex system for thermal vacuum testing is discussed. The challenge was to connect several independent control systems provided by various vendors to a supervisory computer. This combination will sequentially control and monitor the process, collect the data, and transmit it to color a graphic system for subsequent manipulation. The vacuum system upgrade included: replacement of seventeen diffusion pumps with eight cryogenic pumps and one turbomolecular pump, replacing a relay based control system, replacing vacuum instrumentation, and upgrading the data acquisition system.

Incorporating a state-of-the-art process control and instrumentation system into a complex system for thermal vacuum testing is discussed. The challenge was to connect several independent control systems provided by various vendors to a supervisory computer. This combination will sequentially control and monitor the process, collect the data, and transmit it to color a graphic system for subsequent manipulation. The vacuum system upgrade included: replacement of seventeen diffusion pumps with eight cryogenic pumps and one turbomolecular pump, replacing a relay based control system, replacing vacuum instrumentation, and upgrading the data acquisition system.

Incorporating a state-of-the-art process control and instrumentation system into a complex system for thermal vacuum testing is discussed. The challenge was to connect several independent control systems provided by various vendors to a supervisory computer. This combination will sequentially control and monitor the process, collect the data, and transmit it to color a graphic system for subsequent manipulation. The vacuum system upgrade included: replacement of seventeen diffusion pumps with eight cryogenic pumps and one turbomolecular pump, replacing a relay based control system, replacing vacuum instrumentation, and upgrading the data acquisition system.

iv, 164 pages : 28 cm

iv, 164 pages : 28 cm

These materials were developed for a seven-unit secondary or postsecondary education course on programmable logic controllers (PLCs) that treats most of the skills needed to work effectively with PLCs as programming skills. The seven units of the course cover the following topics: fundamentals of programmable logic controllers; contracts, timers, and counters; sequencers and registers; editing and programming functions; installation and troubleshooting; types of PLCs and programming; and industrial program applications. The first section of the manual is designed to show teachers how to use the materials and includes an explanation of instructional elements; an instructional task analysis for each unit; a list of tools, equipment, and materials; and a list of 14 references. Each instructional unit includes some or all of these basic components: performance objectives; suggested activities; information sheets; transparency masters; assignment sheets; job sheets; tests; and test answers. Some elements, such as the information sheets, include photographs, diagrams, and line drawings. (CML)

Incorporating security in supervisory control and data acquisition (SCADA) systems and sensor networks has proven to be a pervasive problem due to the constraints and demands placed on these systems. Both attackers and security professionals seek to uncover the inherent roots of trust in a system to achieve opposing goals. With SCADA systems, a battle is being fought at the cyber -- physical level, specifically the programmable logic controller (PLC). The Stuxnet worm, which became increasingly apparent in the summer of 2010, has shown that modifications to a SCADA system can be discovered on infected engineering workstations on the network, to include the ladder logic found in the PLC. However, certain firmware modifications made to a PLC can go undetected due to the lack of effective techniques available for detecting them. Current software auditing tools give an analyst a singular view of assembly code, and binary difference programs can only show simple differences between assembly codes. Additionally, there appears to be no comprehensive software tool that aids an analyst with evaluating a PLC firmware file for modifications and displaying the resulting effects. Manual analysis is time consuming and error prone. Furthermore, there are not enough talented individuals available in the industrial control system (ICS) community with an in-depth knowledge of assembly language and the inner workings of PLC firmware. This research presents a novel analysis technique that compares a suspected-altered firmware to a known good firmware of a specific PLC and performs a static analysis of differences. This technique includes multiple tests to compare both firmware versions, detect differences in size, and code differences such as removing, adding, or modifying existing functions in the original firmware. A proof-of-concept experiment demonstrates the functionality of the analysis tool using different firmware versions from an Allen-Bradley ControlLogix L61 PLC.

Incorporating security in supervisory control and data acquisition (SCADA) systems and sensor networks has proven to be a pervasive problem due to the constraints and demands placed on these systems. Both attackers and security professionals seek to uncover the inherent roots of trust in a system to achieve opposing goals. With SCADA systems, a battle is being fought at the cyber -- physical level, specifically the programmable logic controller (PLC). The Stuxnet worm, which became increasingly apparent in the summer of 2010, has shown that modifications to a SCADA system can be discovered on infected engineering workstations on the network, to include the ladder logic found in the PLC. However, certain firmware modifications made to a PLC can go undetected due to the lack of effective techniques available for detecting them. Current software auditing tools give an analyst a singular view of assembly code, and binary difference programs can only show simple differences between assembly codes. Additionally, there appears to be no comprehensive software tool that aids an analyst with evaluating a PLC firmware file for modifications and displaying the resulting effects. Manual analysis is time consuming and error prone. Furthermore, there are not enough talented individuals available in the industrial control system (ICS) community with an in-depth knowledge of assembly language and the inner workings of PLC firmware. This research presents a novel analysis technique that compares a suspected-altered firmware to a known good firmware of a specific PLC and performs a static analysis of differences. This technique includes multiple tests to compare both firmware versions, detect differences in size, and code differences such as removing, adding, or modifying existing functions in the original firmware. A proof-of-concept experiment demonstrates the functionality of the analysis tool using different firmware versions from an Allen-Bradley ControlLogix L61 PLC.

Incorporating security in supervisory control and data acquisition (SCADA) systems and sensor networks has proven to be a pervasive problem due to the constraints and demands placed on these systems. Both attackers and security professionals seek to uncover the inherent roots of trust in a system to achieve opposing goals. With SCADA systems, a battle is being fought at the cyber -- physical level, specifically the programmable logic controller (PLC). The Stuxnet worm, which became increasingly apparent in the summer of 2010, has shown that modifications to a SCADA system can be discovered on infected engineering workstations on the network, to include the ladder logic found in the PLC. However, certain firmware modifications made to a PLC can go undetected due to the lack of effective techniques available for detecting them. Current software auditing tools give an analyst a singular view of assembly code, and binary difference programs can only show simple differences between assembly codes. Additionally, there appears to be no comprehensive software tool that aids an analyst with evaluating a PLC firmware file for modifications and displaying the resulting effects. Manual analysis is time consuming and error prone. Furthermore, there are not enough talented individuals available in the industrial control system (ICS) community with an in-depth knowledge of assembly language and the inner workings of PLC firmware. This research presents a novel analysis technique that compares a suspected-altered firmware to a known good firmware of a specific PLC and performs a static analysis of differences. This technique includes multiple tests to compare both firmware versions, detect differences in size, and code differences such as removing, adding, or modifying existing functions in the original firmware. A proof-of-concept experiment demonstrates the functionality of the analysis tool using different firmware versions from an Allen-Bradley ControlLogix L61 PLC.

Incorporating security in supervisory control and data acquisition (SCADA) systems and sensor networks has proven to be a pervasive problem due to the constraints and demands placed on these systems. Both attackers and security professionals seek to uncover the inherent roots of trust in a system to achieve opposing goals. With SCADA systems, a battle is being fought at the cyber -- physical level, specifically the programmable logic controller (PLC). The Stuxnet worm, which became increasingly apparent in the summer of 2010, has shown that modifications to a SCADA system can be discovered on infected engineering workstations on the network, to include the ladder logic found in the PLC. However, certain firmware modifications made to a PLC can go undetected due to the lack of effective techniques available for detecting them. Current software auditing tools give an analyst a singular view of assembly code, and binary difference programs can only show simple differences between assembly codes. Additionally, there appears to be no comprehensive software tool that aids an analyst with evaluating a PLC firmware file for modifications and displaying the resulting effects. Manual analysis is time consuming and error prone. Furthermore, there are not enough talented individuals available in the industrial control system (ICS) community with an in-depth knowledge of assembly language and the inner workings of PLC firmware. This research presents a novel analysis technique that compares a suspected-altered firmware to a known good firmware of a specific PLC and performs a static analysis of differences. This technique includes multiple tests to compare both firmware versions, detect differences in size, and code differences such as removing, adding, or modifying existing functions in the original firmware. A proof-of-concept experiment demonstrates the functionality of the analysis tool using different firmware versions from an Allen-Bradley ControlLogix L61 PLC.

Incorporating security in supervisory control and data acquisition (SCADA) systems and sensor networks has proven to be a pervasive problem due to the constraints and demands placed on these systems. Both attackers and security professionals seek to uncover the inherent roots of trust in a system to achieve opposing goals. With SCADA systems, a battle is being fought at the cyber -- physical level, specifically the programmable logic controller (PLC). The Stuxnet worm, which became increasingly apparent in the summer of 2010, has shown that modifications to a SCADA system can be discovered on infected engineering workstations on the network, to include the ladder logic found in the PLC. However, certain firmware modifications made to a PLC can go undetected due to the lack of effective techniques available for detecting them. Current software auditing tools give an analyst a singular view of assembly code, and binary difference programs can only show simple differences between assembly codes. Additionally, there appears to be no comprehensive software tool that aids an analyst with evaluating a PLC firmware file for modifications and displaying the resulting effects. Manual analysis is time consuming and error prone. Furthermore, there are not enough talented individuals available in the industrial control system (ICS) community with an in-depth knowledge of assembly language and the inner workings of PLC firmware. This research presents a novel analysis technique that compares a suspected-altered firmware to a known good firmware of a specific PLC and performs a static analysis of differences. This technique includes multiple tests to compare both firmware versions, detect differences in size, and code differences such as removing, adding, or modifying existing functions in the original firmware. A proof-of-concept experiment demonstrates the functionality of the analysis tool using different firmware versions from an Allen-Bradley ControlLogix L61 PLC.

Incorporating security in supervisory control and data acquisition (SCADA) systems and sensor networks has proven to be a pervasive problem due to the constraints and demands placed on these systems. Both attackers and security professionals seek to uncover the inherent roots of trust in a system to achieve opposing goals. With SCADA systems, a battle is being fought at the cyber -- physical level, specifically the programmable logic controller (PLC). The Stuxnet worm, which became increasingly apparent in the summer of 2010, has shown that modifications to a SCADA system can be discovered on infected engineering workstations on the network, to include the ladder logic found in the PLC. However, certain firmware modifications made to a PLC can go undetected due to the lack of effective techniques available for detecting them. Current software auditing tools give an analyst a singular view of assembly code, and binary difference programs can only show simple differences between assembly codes. Additionally, there appears to be no comprehensive software tool that aids an analyst with evaluating a PLC firmware file for modifications and displaying the resulting effects. Manual analysis is time consuming and error prone. Furthermore, there are not enough talented individuals available in the industrial control system (ICS) community with an in-depth knowledge of assembly language and the inner workings of PLC firmware. This research presents a novel analysis technique that compares a suspected-altered firmware to a known good firmware of a specific PLC and performs a static analysis of differences. This technique includes multiple tests to compare both firmware versions, detect differences in size, and code differences such as removing, adding, or modifying existing functions in the original firmware. A proof-of-concept experiment demonstrates the functionality of the analysis tool using different firmware versions from an Allen-Bradley ControlLogix L61 PLC.

/redirect?redir_token=V3nmTajsJ4o7zrboEGyw25qJq_98MTUwOTgyNTc0NEAxNTA5NzM5MzQ0&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&v=d3akQKVDLR8&event=video_description Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=d3akQKVDLR8 Uploader: media.ccc.de

/redirect?redir_token=V3nmTajsJ4o7zrboEGyw25qJq_98MTUwOTgyNTc0NEAxNTA5NzM5MzQ0&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&v=d3akQKVDLR8&event=video_description Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=d3akQKVDLR8 Uploader: media.ccc.de

xv, 735 p. : 24 cm

xv, 735 p. : 24 cm

xv, 735 p. : 24 cm

Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them.

Much has been made of the capabilities of FPGA's (Field Programmable Gate Arrays) in the hardware implementation of fast digital signal processing. Such capability also makes an FPGA a suitable platform for the digital implementation of closed loop controllers. Other researchers have implemented a variety of closed-loop digital controllers on FPGA's. Some of these controllers include the widely used proportional-integral-derivative (PID) controller, state space controllers, neural network and fuzzy logic based controllers. There are myriad advantages to utilizing an FPGA for discrete-time control functions which include the capability for reconfiguration when SRAM-based FPGA's are employed, fast parallel implementation of multiple control loops and implementations that can meet space level radiation tolerance requirements in a compact form-factor. Generally, a software implementation on a DSP (Digital Signal Processor) or microcontroller is used to implement digital controllers. At Marshall Space Flight Center, the Control Electronics Group has been studying adaptive discrete-time control of motor driven actuator systems using digital signal processor (DSP) devices. While small form factor, commercial DSP devices are now available with event capture, data conversion, pulse width modulated (PWM) outputs and communication peripherals, these devices are not currently available in designs and packages which meet space level radiation requirements. In general, very few DSP devices are produced that are designed to meet any level of radiation tolerance or hardness. The goal of this effort is to create a fully digital, flight ready controller design that utilizes an FPGA for implementation of signal conditioning for control feedback signals, generation of commands to the controlled system, and hardware insertion of adaptive control algorithm approaches. An alternative is required for compact implementation of such functionality to withstand the harsh environment encountered on spacecraft. Radiation tolerant FPGA's are a feasible option for reaching this goal.

Much has been made of the capabilities of FPGA's (Field Programmable Gate Arrays) in the hardware implementation of fast digital signal processing. Such capability also makes an FPGA a suitable platform for the digital implementation of closed loop controllers. Other researchers have implemented a variety of closed-loop digital controllers on FPGA's. Some of these controllers include the widely used proportional-integral-derivative (PID) controller, state space controllers, neural network and fuzzy logic based controllers. There are myriad advantages to utilizing an FPGA for discrete-time control functions which include the capability for reconfiguration when SRAM-based FPGA's are employed, fast parallel implementation of multiple control loops and implementations that can meet space level radiation tolerance requirements in a compact form-factor. Generally, a software implementation on a DSP (Digital Signal Processor) or microcontroller is used to implement digital controllers. At Marshall Space Flight Center, the Control Electronics Group has been studying adaptive discrete-time control of motor driven actuator systems using digital signal processor (DSP) devices. While small form factor, commercial DSP devices are now available with event capture, data conversion, pulse width modulated (PWM) outputs and communication peripherals, these devices are not currently available in designs and packages which meet space level radiation requirements. In general, very few DSP devices are produced that are designed to meet any level of radiation tolerance or hardness. The goal of this effort is to create a fully digital, flight ready controller design that utilizes an FPGA for implementation of signal conditioning for control feedback signals, generation of commands to the controlled system, and hardware insertion of adaptive control algorithm approaches. An alternative is required for compact implementation of such functionality to withstand the harsh environment encountered on spacecraft. Radiation tolerant FPGA's are a feasible option for reaching this goal.

Much has been made of the capabilities of FPGA's (Field Programmable Gate Arrays) in the hardware implementation of fast digital signal processing. Such capability also makes an FPGA a suitable platform for the digital implementation of closed loop controllers. Other researchers have implemented a variety of closed-loop digital controllers on FPGA's. Some of these controllers include the widely used proportional-integral-derivative (PID) controller, state space controllers, neural network and fuzzy logic based controllers. There are myriad advantages to utilizing an FPGA for discrete-time control functions which include the capability for reconfiguration when SRAM-based FPGA's are employed, fast parallel implementation of multiple control loops and implementations that can meet space level radiation tolerance requirements in a compact form-factor. Generally, a software implementation on a DSP (Digital Signal Processor) or microcontroller is used to implement digital controllers. At Marshall Space Flight Center, the Control Electronics Group has been studying adaptive discrete-time control of motor driven actuator systems using digital signal processor (DSP) devices. While small form factor, commercial DSP devices are now available with event capture, data conversion, pulse width modulated (PWM) outputs and communication peripherals, these devices are not currently available in designs and packages which meet space level radiation requirements. In general, very few DSP devices are produced that are designed to meet any level of radiation tolerance or hardness. The goal of this effort is to create a fully digital, flight ready controller design that utilizes an FPGA for implementation of signal conditioning for control feedback signals, generation of commands to the controlled system, and hardware insertion of adaptive control algorithm approaches. An alternative is required for compact implementation of such functionality to withstand the harsh environment encountered on spacecraft. Radiation tolerant FPGA's are a feasible option for reaching this goal.

Much has been made of the capabilities of FPGA's (Field Programmable Gate Arrays) in the hardware implementation of fast digital signal processing. Such capability also makes an FPGA a suitable platform for the digital implementation of closed loop controllers. Other researchers have implemented a variety of closed-loop digital controllers on FPGA's. Some of these controllers include the widely used proportional-integral-derivative (PID) controller, state space controllers, neural network and fuzzy logic based controllers. There are myriad advantages to utilizing an FPGA for discrete-time control functions which include the capability for reconfiguration when SRAM-based FPGA's are employed, fast parallel implementation of multiple control loops and implementations that can meet space level radiation tolerance requirements in a compact form-factor. Generally, a software implementation on a DSP (Digital Signal Processor) or microcontroller is used to implement digital controllers. At Marshall Space Flight Center, the Control Electronics Group has been studying adaptive discrete-time control of motor driven actuator systems using digital signal processor (DSP) devices. While small form factor, commercial DSP devices are now available with event capture, data conversion, pulse width modulated (PWM) outputs and communication peripherals, these devices are not currently available in designs and packages which meet space level radiation requirements. In general, very few DSP devices are produced that are designed to meet any level of radiation tolerance or hardness. The goal of this effort is to create a fully digital, flight ready controller design that utilizes an FPGA for implementation of signal conditioning for control feedback signals, generation of commands to the controlled system, and hardware insertion of adaptive control algorithm approaches. An alternative is required for compact implementation of such functionality to withstand the harsh environment encountered on spacecraft. Radiation tolerant FPGA's are a feasible option for reaching this goal.

xii, 164 pages : 28 cm

Recent attacks on industrial control systems (ICSs), like the highly publicized Stuxnet malware, have perpetuated a race to the bottom where lower level attacks have a tactical advantage. Programmable logic controller (PLC) firmware, which provides a software-driven interface between system inputs and physically manifested outputs, is readily open to modification at the user level. Current efforts to protect against firmware attacks are hindered by a lack of prerequisite research regarding details of attack development and implementation. In order to obtain a more complete understanding of the threats posed by PLC firmware counterfeiting and the feasibility of such attacks, this research explores the vulnerability of common controllers to intentional firmware modifications. After presenting a general analysis process that takes advantage of various techniques and methodologies applied to similar scenarios, this work derives the firmware update validation method used for the Allen-Bradley ControlLogix PLC. A proof of concept demonstrates how to alter a legitimate firmware update and successfully upload it to a ControlLogix L61. Possible mitigation strategies discussed include digitally signed and encrypted firmware as well as preemptive and post-mortem analysis methods to provide protection. Results of this effort facilitate future research in PLC firmware security through direct example of firmware counterfeiting.

The grant helped us build a control systems research laboratory at Western Washington University. We bought industrial computers from General Electric, Siemens, and Schweitzer Engineering. The lab resembles the control network of a power plant, and includes a small electrical substation control environment. The lab has already been used to support the research of the PI and his student group.

The grant helped us build a control systems research laboratory at Western Washington University. We bought industrial computers from General Electric, Siemens, and Schweitzer Engineering. The lab resembles the control network of a power plant, and includes a small electrical substation control environment. The lab has already been used to support the research of the PI and his student group.

More information about the video, more episodes to watch and to donate, visit https://www.timhunkin.com/a241_component-videos.htm CHAPTERS 0:00 - Start 02:15 - My PLC initiation 04:51 - Cam timers to PLCs 08:52 - Getting started 11:34 - Basic layouts 13:59 - Stepladder Programming 20:42 - Choosing a PLC 25:13 - Inputs and outputs 28:57 - Processing speed 32:23 - Extension blocks 35:37 - Programming 'states' 40:02 - Adding arduinos 42:16 - Adding video 46:43 - Simplicity

More information about the video, more episodes to watch and to donate, visit https://www.timhunkin.com/a241_component-videos.htm CHAPTERS 0:00 - Start 02:15 - My PLC initiation 04:51 - Cam timers to PLCs 08:52 - Getting started 11:34 - Basic layouts 13:59 - Stepladder Programming 20:42 - Choosing a PLC 25:13 - Inputs and outputs 28:57 - Processing speed 32:23 - Extension blocks 35:37 - Programming 'states' 40:02 - Adding arduinos 42:16 - Adding video 46:43 - Simplicity

More information about the video, more episodes to watch and to donate, visit https://www.timhunkin.com/a241_component-videos.htm CHAPTERS 0:00 - Start 02:15 - My PLC initiation 04:51 - Cam timers to PLCs 08:52 - Getting started 11:34 - Basic layouts 13:59 - Stepladder Programming 20:42 - Choosing a PLC 25:13 - Inputs and outputs 28:57 - Processing speed 32:23 - Extension blocks 35:37 - Programming 'states' 40:02 - Adding arduinos 42:16 - Adding video 46:43 - Simplicity

/redirect?v=QYNNzxdko6I&event=video_description&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&redir_token=aVTMDo6vPogX1Z8rAgzOJuh1xxl8MTUwOTgyMzgxOUAxNTA5NzM3NDE5 Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=QYNNzxdko6I Uploader: media.ccc.de

/redirect?v=QYNNzxdko6I&event=video_description&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&redir_token=aVTMDo6vPogX1Z8rAgzOJuh1xxl8MTUwOTgyMzgxOUAxNTA5NzM3NDE5 Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=QYNNzxdko6I Uploader: media.ccc.de

/redirect?v=QYNNzxdko6I&event=video_description&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&redir_token=aVTMDo6vPogX1Z8rAgzOJuh1xxl8MTUwOTgyMzgxOUAxNTA5NzM3NDE5 Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=QYNNzxdko6I Uploader: media.ccc.de

/redirect?v=QYNNzxdko6I&event=video_description&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&redir_token=aVTMDo6vPogX1Z8rAgzOJuh1xxl8MTUwOTgyMzgxOUAxNTA5NzM3NDE5 Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=QYNNzxdko6I Uploader: media.ccc.de

/redirect?v=QYNNzxdko6I&event=video_description&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&redir_token=aVTMDo6vPogX1Z8rAgzOJuh1xxl8MTUwOTgyMzgxOUAxNTA5NzM3NDE5 Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=QYNNzxdko6I Uploader: media.ccc.de

/redirect?v=QYNNzxdko6I&event=video_description&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&redir_token=aVTMDo6vPogX1Z8rAgzOJuh1xxl8MTUwOTgyMzgxOUAxNTA5NzM3NDE5 Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=QYNNzxdko6I Uploader: media.ccc.de

/redirect?v=QYNNzxdko6I&event=video_description&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&redir_token=aVTMDo6vPogX1Z8rAgzOJuh1xxl8MTUwOTgyMzgxOUAxNTA5NzM3NDE5 Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=QYNNzxdko6I Uploader: media.ccc.de

/redirect?v=QYNNzxdko6I&event=video_description&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&redir_token=aVTMDo6vPogX1Z8rAgzOJuh1xxl8MTUwOTgyMzgxOUAxNTA5NzM3NDE5 Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=QYNNzxdko6I Uploader: media.ccc.de

/redirect?v=QYNNzxdko6I&event=video_description&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&redir_token=aVTMDo6vPogX1Z8rAgzOJuh1xxl8MTUwOTgyMzgxOUAxNTA5NzM3NDE5 Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=QYNNzxdko6I Uploader: media.ccc.de

/redirect?v=QYNNzxdko6I&event=video_description&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&redir_token=aVTMDo6vPogX1Z8rAgzOJuh1xxl8MTUwOTgyMzgxOUAxNTA5NzM3NDE5 Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=QYNNzxdko6I Uploader: media.ccc.de

/redirect?v=QYNNzxdko6I&event=video_description&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&redir_token=aVTMDo6vPogX1Z8rAgzOJuh1xxl8MTUwOTgyMzgxOUAxNTA5NzM3NDE5 Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=QYNNzxdko6I Uploader: media.ccc.de

/redirect?v=QYNNzxdko6I&event=video_description&q=https%3A%2F%2Fmedia.ccc.de%2Fv%2F33c3-7853-do_as_i_say_not_as_i_do_stealth_modification_of_programmable_logic_controllers_i_o_by_pin_control_attack&redir_token=aVTMDo6vPogX1Z8rAgzOJuh1xxl8MTUwOTgyMzgxOUAxNTA5NzM3NDE5 Input/Output is the mechanisms through which embedded systems interact and control the outside world. Particularly when employed in mission critical systems, the I/O of embedded systems has to be both reliable and secure. Embedded system’s I/O is controlled by a pin based approach. In this work, we investigate the security implications of embedded system’s pin control. In particular, we show how an attacker can tamper with the integrity and availability of an embedded system’s I/O by exploiting cerain pin control operations and the lack of hardware interrupts associated to them. Ali Abbasi Majid Source: https://www.youtube.com/watch?v=QYNNzxdko6I Uploader: media.ccc.de

viii, 105 pages : 28 cm