  Programmable Logic Controllers (PLCs) are the core control devices in
Industrial Control Systems (ICSs), which control and monitor the underlying
physical plants such as power grids. PLCs were initially designed to work in a
trusted industrial network, which however can be brittle once deployed in an
Internet-facing (or penetrated) network. Yet, there is a lack of systematic
empirical analysis of the run-time security of modern real-world PLCs. To close
this gap, we present the first large-scale measurement on 23 off-the-shelf PLCs
across 13 leading vendors. We find many common security issues and unexplored
implications that should be more carefully addressed in the design and
implementation. To sum up, the unsupervised logic applications can cause system
resource/privilege abuse, which gives adversaries new means to hijack the
control flow of a runtime system remotely (without exploiting memory
vulnerabilities); 2) the improper access control mechanisms bring many
unauthorized access implications; 3) the proprietary or semi-proprietary
protocols are fragile regarding confidentiality and integrity protection of
run-time data. We empirically evaluated the corresponding attack vectors on
multiple PLCs, which demonstrates that the security implications are severe and
broad. Our findings were reported to the related parties responsibly, and 20
bugs have been confirmed with 7 assigned CVEs.
