## 3 JTAG Exploitations
### Attacks on Programmable Logic Controllers (PLC)  
In a broader perspective, IoT infrastructure will be wide enough covering not only commercial, medical, military and automobile industry but down the line that will also be used in industrial field to make an improvement into industrial process management. [PERSON] [19] explained a JTAG exploitation in the Supervisory control and data acquisition (SCADA) systems which is dominantly used to monitor and control huge system infrastructure such as electric power transmission lines, water distribution systems, gas and oil pipelines, etc. The programmable logic controller (PLCs) gathers data and interacts with sensors and valves for streamlining huge industrial process. For example, nowadays, the vehicle manufacturing factory assembles 20 cars a minute on an average, so if any single PLC hardware is being attacked and shut off for even for an hour, it could cause a hugeloss for company. According to the author, attacks on SCADA systems have predominantly focused on network protocols (e.g., MODBUS, Ethernet, and CAN protocol) and high-level systems where human-machine interface occurs, however it is equally important to consider security of PLCs and monitoring field devices in SCADA systems. The author experimented on Allen-Bradley's Controllogix 1756-L61 PLC controller for firmware exploitation. This experiment used commercial tools such as ControlFLASH for uploading firmware to PLC, \"IDA-Pro Hex Rays\" for disassembling the firmware, RealView ICE as JTAG hardware debugger and ARM Development Studio v5 in this experiment. The author followed three steps for exploitation: firmware acquisition, analysis of hardware and its components, and analysis of disassembled firmware. Here, the RealView ICE debugger is used in auto configuration mode to get all ARM related information. According to author, the hardware analysis is mandatory to identify the instruction set used in firmware. The author followed static and dynamic analysis for firmware by using IDA Pro disassembler. Previously developed IDA Pro scripts by [PERSON] [20] and [PERSON] [21] are used to identify ARM functions. During the static analysis, the location of firmware images in volatile memory is identified where initial jump to the entry point of the firmware is occurred. During the dynamic analysis, firmware execution paths are identified by using JTAG interface through which memory breakpoints can be set and test read/write access. This JTAG interface can also dump memory and register values before PLC goes into fault state which helped understanding conditional flags of hardware status. While working on the device, author identified vulnerable firmware sections through various diagnostic tests such as processor mode diagnostics, processor register r0 diagnostics, CIP (Common Industrial Protocol) communication protocol diagnosis, etc. In processor mode diagnosis method, the author was able to get current working mode of system. Usually, PLC has four mode settings: RUN, PROGRAM, REMOTE RUN, and REMOTE PROGRAM. Registers r0, r1, r2, r3 and r4 are kept observing to see the values while uploading and running program using RLSlogix. The author observed that \"cpmode\" is being called continuously. Cpmode from JTAG architecture acts as an event handler which is responsible for above four mode settings in PLC. Thus, the author suggested that continuous execution of cpmode function could at least hang the system. Next, the author worked on Allen-Bradley PLC's CIP communication protocol. This protocol is object-oriented protocol which is distributed over serial or ethernet link across all parts of system. The author found that the breakpoint can be triggered if identity object request is sent through CIP messages. All these diagnosis methods are combinatorially used to influence PLC system. In addition, the author initiated DoS attack, which is triggered by CIP commands, cpmode check and writing a sentinel value to an unused area of flash memory.