Download Attacking Programmable Logic Controllers

• Execute ladder logic
This Stuxnet inspired goals provides an adversary with the ability to execute ladder
logic and thereby perform arbitrary operations. This is also the reason why this goal
was included. If successful, the attack will allow the adversary to alter set points,
remove safety interlocks or do something else entirely. This can be leveraged to
perform[46];
Exclusion attacks - E.g. Running the motor while the oil pump is turned off.
Wear attacks - E.g. Keeping the clutch at 90% will reduce the lifespan of the equipment.
Inertial attacks - E.g. Large machinery is not designed for rapid acceleration or
deceleration. Doing so will reduce lifespan.
Surge attacks - E.g. Systems are designed to handle a certain amount of product.
Exceeding this limit may cause equipment damage.
4.4.2
Attack trees
Use of attack trees
Attack trees are closely related to fault trees[47] used in software safety. Fault trees
are used to describe how errors propagate, resulting in a set of failure scenarios. Bruce
Schneier introduced the concept of attack trees[64]. Attack trees are used to model threats,
vulnerabilities and possible exploitation of these. Attack trees allows for security analysis
to be conducted at multiple layers of abstraction. The purpose of the analysis is to understand the different ways the system can be compromised and present the results in a clear
and concise manner. The level of detail depends on the context of the analysis.
The root of the attack tree represent the overall goal of the attack. The children represent
the different ways to achieve said goal. There are also conjunction (AND) nodes and
disjunction (OR) nodes. Conjunction nodes represent different steps that are needed to
achieve a goal, e.g. Install keyboard sniffer AND obtain sniffer output file. Both steps are
necessary in order to steal a password. Disjunction nodes represent alternatives, e.g convince victim to give you the password OR steal password. Disjunctive nodes are assumed
unless otherwise specified. A trivial example follows:
35