关键词: 工业控制系统, 可编程逻辑控制器, 攻击表面, 脆弱性分析

Abstract: Industrial Control System（ICS） is the key national infrastructure, and its core device is Programmable Logic Controller（PLC）. Stuxnet attacks PLC and destroys physical devices, indicating the threat brought by PLCs’ vulnerability. Firstly, the status in ICS and structure of PLC are described. Then according to the definition of the attack surface, the attack surface of PLC is proposed to conduct the analysis of vulnerability of PLC protocol, program and data. Meanwhile, the analysis technique of proprietary PLC protocol and bytecode is presented and realized. Finally, the exploitation and attack process of PLC is provided. This paper provides a basis for the analysis and research of the security assessment and protection of PLC and ICS.

Key words: industrial control system, programmable logic controller, attack surface, analysis of vulnerability