Post-exploitation and Persistence Techniques Against Programmable Logic Controller

An Overview of the Security of Programmable Logic Controllers in Industrial Control Systems

“…The rootkit HARVEY [34] is able to replace benign control commands with malicious commands to cause large-scale failures of the system. Bytes and Zhou [2] analyzed the software internals of WAGO PFC200 Series PLCs, and presented several potentially practical methods for the attack payload persistence executing on the firmware components. It has been notified in February 2022 that an unauthenticated and remote attacker has successfully launched denial-of-service (DoS) attacks to several Siemens PLCs [52].…”

“…In recent decades, Industrial Control Systems (ICSs) have been widely deployed to control and monitor operations of critical infrastructures, including transportation, power grids, and water treatment units [1,2]. In recent decades, due to the trend of connecting ICSs to the Internet, the security of ICSs has received significant attention.…”

A Taxonomy for Threat Actors’ Persistence Techniques

“…The authors defend that no universal method to gain persistence on IoT devices has been identified. In Bytes and Zhou (2020) Andrei Bytes et al analyze techniques used in Programmable Logic Controllers (PLC), extending Linux generic mechanisms to particular embedded Linux devices but without providing a suitable structure for them. Németh (2020) analyzes rootkit persistence techniques in IoT devices, identifying Linux Kernel Modules, ramdisk-based and user space programs as main categories.…”

Modeling of Advanced Threat Actors: Characterization, Categorization and Detection

“…The authors defend that no universal method to gain persistence on IoT devices has been identified. In [102] Andrei Bytes et al analyze techniques used in Programmable Logic Controllers (PLC), extending Linux generic mechanisms to particular embedded Linux devices but without providing a suitable structure for them. [440] analyzes rootkit persistence techniques in IoT devices, identifying Linux Kernel Modules, ramdiskbased and user space programs as main categories.…”