DoS Exploitation of Allen-Bradley's Legacy Protocol through Fuzz Testing

被引：8
作者：
Tacliad, Francisco
Nguyen, Thuy D. [1 ]
Gondree, Mark [2 ]
机构：
[1] Naval Postgrad Sch, Monterey, CA USA
[2] Sonoma State Univ, Rohnert Pk, CA 94928 USA
来源：
3RD ANNUAL INDUSTRIAL CONTROL SYSTEM SECURITY WORKSHOP (ICSS 2017) | 2017年
关键词：
Industrial control system; fuzz testing; EtherNet/IP; MicroLogix;
D O I：
10.1145/3174776.3174780
中图分类号：
TP [自动化技术、计算机技术];
学科分类号：
0812 ;
摘要：
EtherNet/IP is a TCP/IP-based industrial protocol commonly used in industrial control systems (ICS). TCP/IP connectivity to the outside world has enabled ICS operators to implement more agile practices, but it also has exposed these cyber-physical systems to cyber attacks. Using a custom Scapy-based fuzzer to test for implementation flaws in the EtherNet/IP software of commercial programmable logic controllers (PLC), we uncover a previously unreported denial-of-service (DoS) vulnerability in the Ethernet/IP implementation of the Rockwell Automation/Allen-Bradley MicroLogix 1100 PLC that, if exploited, can cause the PLC to fault. ICS-CERT recently announces this vulnerability in the security advisory ICSA-17-138-03. This paper describes this vulnerability, the development of an EtherNet/IP fuzzer, and an approach to remotely monitor for faults generated when fuzzing.
引用
收藏
页码：24 / 31
页数：8
相关论文
共 27 条
  • [1] [Anonymous], 2017, ADVISORY ICSA 17 138
  • [2] [Anonymous], 2012, CVE20124690
  • [3] [Anonymous], 2011, SCAPY
  • [4] Banks G, 2006, LECT NOTES COMPUT SC, V4176, P343
  • [5] Basnight Z.H., 2013, FIRMWARE COUNTERFEIT
  • [6] Bradley Allen, 2014, MICROLOGIX 1100 PROG
  • [7] Bradley Allen, 2016, LOGIX5000 DATA ACCES
  • [8] Bradley Allen, 1996, DF1 PROTOCOL COMMAND
  • [9] Bradley Allen, 2011, MICROLOGIX 1100 PROG
  • [10] Bratus Sergey, 2008, TR2008634 DARM COLL
123