From HTTP to SSH: Finding a Host-Level Attack Path in OpenPLC v3
Introduction
A software PLC does not need a physical controller sitting inside a cabinet to execute industrial control logic. Its runtime can live entirely on a conventional computer, communicating with other systems through familiar industrial protocols while relying on an ordinary operating system underneath, and that changes the security picture.
When assessing a SoftPLC, it is easy to concentrate on the services it exposes: Modbus TCP, management interfaces, perhaps a programming environment. Yet the control logic has to get onto the machine somehow. It has to be stored, compiled, and loaded into a runtime. The host operating system participates in every one of those operations.
I wanted to investigate what happens when an attacker can reach that layer.
The question guiding this research was simple: could someone modify a SoftPLC's active control logic through its deployment environment, replace the existing program, and execute the altered logic without following the usual...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
