Non-Intrusive Vulnerability Localization and Hotpatching for Industrial Control Systems

Overview: Michail Maniatakos and Prashant Rajput from New York University Abu Dhabi present an automated framework for non-intrusive vulnerability localization and dynamic hotpatching in Industrial Control Systems (ICS). The research addresses the critical challenge of securing Programmable Logic Controllers (PLCs) running real-time operating systems where operational downtime and reboots are prohibited. By combining binary symbolic execution with dynamic memory manipulation, the authors demonstrate how to identify and remediate vulnerabilities in running control applications without interrupting industrial processes.

Key Topics: - Insecurity of modern digitized ICS/OT architectures running embedded Linux with real-time extensions (RT-PREEMPT) - Memory corruption vulnerabilities arising from structured text pointers within the IEC 61131-3 control application - Exploiting execution control flow in the CODESYS runtime to suppress the primary PLC logic loop (PLC_PRG) - Non-intrusive binary hotpatching utilizing the angr symbolic execution framework, live base address resolution, and an LCM patcher

Technical Details: The presenters highlight the architectural evolution of modern PLCs, which increasingly employ general-purpose operating systems like Linux equipped with real-time kernel patches (RT-PREEMPT) to run complex runtimes such as CODESYS. In these environments, the IEC 61131-3 control logic executes as a task that shares process memory space directly with the underlying CODESYS runtime. While this digitization enables advanced connectivity (SSH, FTP), it imports IT-style memory corruption risks. In an experimental testbed simulating a multi-stage flash (MSF) desalination plant in Simulink controlled by a WAGO PFC100 PLC, the researchers demonstrate how pointer manipulation in Structured Text (ST)—enabled by weak static compiler checks—allows an attacker to write arbitrary values to runtime stack memory.

Specifically, the exploit targets the prologue code executed prior to PLC_PRG (the control application's equivalent to main). The assembly routine retrieves a stack address via register r10, loads an offset into register r6, fetches a value into r4, and checks if it equals zero. If zero, execution proceeds normally to PLC_PRG; if non-zero, it branches away and returns early. By using structured text pointers to write a non-zero value to stack offset 4649 during the 100th operation cycle, the attack completely suppresses PLC_PRG execution, halting all sensor reading and actuator updating while leaving the underlying runtime process seemingly healthy.

To remediate such vulnerabilities without rebooting or halting the physical process, the authors introduce a non-intrusive hotpatching pipeline. The workflow deploys a twin test PLC running an identical CODESYS runtime and IEC project subjected to the exploit input. The system extracts application state—comprising memory hex dumps of the CODESYS binary, the IEC application, shared libraries (libc, libm), and register states (notably the program counter and stack pointer)—to a dedicated patch server. The patch server uses the angr binary analysis framework to symbolically locate the vulnerability and compute relative patching offsets. Finally, the framework queries the live target PLC for its base memory address, synthesizes an in-memory binary patch, and applies it via a Local Control Module (LCM) patcher to the active CODESYS runtime without process interruption.

Key Takeaways: OT asset owners cannot rely on proprietary PLC compiler checks to prevent memory corruption when structured text utilizes raw pointer mechanics. Runtimes like CODESYS require architectural memory isolation between the runtime core and IEC control applications to prevent user-space logic from altering host execution stacks. Automated binary analysis combined with dynamic in-memory hotpatching offers a viable defensive mechanism to remediate critical vulnerabilities on active PLCs without incurring costly plant shutdowns.

(AI summary — Gemini Flash)