# Security Challenges in Industry 4.0 PLC Systems
## 3 Risk Sources in OT Systems
### Network System Hardware
#### 3.2.3 PLC Controllers
It blocks users while placing a \"logic bomb\" (a piece of code inserted into software to activate a malicious function under certain conditions) in the controller code. The attack method used in LogicLocker consists of five steps, as described below. 1. The initial infection usually takes place by taking advantage of security vulnerabilities. Since devices in industrial networks are typically always-on state, cybercriminals have enough time to break into a PLC, and controllers generally do not have strong authentication mechanisms that can help protect against a potential attack. The initial infection can take place when the user clicks on a malicious e-mail attachment or when visiting a crafted website. 2. After the initial infection, you can move horizontally (within the same OT subnetwork as presented in Figure 3a) or vertical (when switching between OT networks or from IT to OT networks as presented on the Figure 3b) to the PLC, which depends largely on how the controller is connected. 3. In the next step, the attacker blocks legitimate users to make system recovery difficult or impossible (e.g., by changing the password, overusing PLC resources, or changing the IP address of the controller). Different locking methods allow different degrees of success. 4. In the next stage, preparation for negotiations takes place, which consists of hiding the place of broadcasting the information. For this purpose, encryption or built-in functions of some controllers are used, e.g., the ability to send e-mails via a PLC. 5. Finally, negotiations are conducted between the cybercriminal and the victim in order to restore the correct operation of the system [84]. Figure 3: Two types of attack: (**a**) horizontal—between devices of the same subnetwork; (**b**) vertical—through subnets. **Attacks that Exploit the Weaknesses of the ISO-TSAP Protocol**  
Siemens Simatic S7 controllers are a group of controllers particularly exposed to hacking attacks and the use of their weaknesses due to their widespread use in industry and the use of the PROFINET network standard based on the modification of Industrial Ethernet. Simatic TIA and Step 7 Engineering are used to program these controllers, and the communication between the software and PLC is based on the ISO-TSAP protocol standard. This protocol provides no encryption of the data exchanged between the PLC and the computer, which means that all data are transferred in clear text. The following are examples of attacks that exploit the weaknesses of the ISO-TSAP protocol:  
* Response attack. The main assumption of this attack method is that the cybercriminal has the ability to intercept certain information or data and then use that data to later compromise the system. When analyzing the data transferred between the Step 7 software and the Simatic S7 controller, it is possible to distinguish certain elements of the frame that allow the analysis of the program logic, and even the physical process controlled by the PLC. The use of listening by an attacker may lead to the complete acquisition of data and analyze it, and then use this data to create its own command line sent to the controller. * MIM attack (Man in the Middle). A weakness of communication using the ISO-TSAP protocol is the fact that the attacker has the ability to track the data stream between the PLC and the Step 7 software. Thus, the cybercriminal has the ability to collect a complete set of data exchanged between the software and the controller without being able to detect this fact. Information obtained in this way may significantly influence further attacks or lead to the exchange of erroneous data. * Attack with authorization bypass. In some special cases, access to PLC may be password protected, but this is not a particularly popular practice in the industry due to the general belief that the industrial network is isolated from the global network.