Programmable logic controller memory management vulnerability analysis

Abstract

Programmable logic controller (PLC) is omnipresent in industrial control system (ICS), which plays an imperative part in critical infrastructures. However, once a PLC is compromised by an attacker, it will create destructive effects on critical infrastructures. The memory systems in PLCs are considered significant targets for attackers to disrupt real-world physical processes. In this paper, we proposed five types of attacks on the PLC memory management mechanism. Furthermore, we evaluated the feasibility of our memory attack generation approach on six PLCs from three leading controller vendors. A total of 22 memory attack payloads are implemented with several vulnerabilities on the target PLCs.