# Security Challenges in Industry 4.0 PLC Systems
## 3 Risk Sources in OT Systems
### Network System Hardware
#### 3.2.3 PLC Controllers
PLCs have been regularly used to build process control systems for over 40 years, but the concept of cyber-attacks and the steps to reduce them have been the subject of research for a relatively short time. Due to their susceptibility to hacking attacks, PLCs should be treated as ordinary personal or process computers. However, since the target of such attacks is the output of a physical process, the defined safety margins should be significantly increased. Below are some examples of ways to break security in installations based on PLCs:  
**Security of Communication Protocols**  
PLC controllers use different transmission protocols to communicate between field devices such as inverters, sensors or even devices for programming the controllers themselves in industrial networks. The most commonly used transmission protocols are MODBUS, Ethernet/IP, Profibus, DNP 317 and ISO-TSAP. These protocols offer efficient communication but were not designed to ensure transmission security in industrial systems because while developed, this problem was not considered to be an issue. For this reason, the above data transmission methods do not ensure confidentiality and authentication, and in turn make the entire network vulnerable to various types of attacks. **Logic-Bypass Attack**  
Usually a PLC is equipped with two random access memory known as main and register memory. The main memory is used to store data of the program being executed, while the register memory is used as a temporary memory by the currently executing logic [83]. Despite the fact that the register memory is a temporary memory, it must contain some important variables that influence this logic. In general, from the level of computers located in the industrial network of the plant, there are no restrictions on access to the memory of PLC registers and on the free execution of read and write operations in this memory area. Therefore, it is enough to assume that a potential attacker has the ability to gain access to one device on the network and introduce a worm into the system, the purpose of which will be to enter random values into the PLC's registers. Since, as a result of the operation of such a worm, the register memory values will change, the parameters related to the operation of the logical part of the program may also change. Eventually, the logic, when executing the algorithm, will set a new value for the outputs based on random changes written to the registers, which can cause unpredictable results. **The Attack Based on the Output Forcing**  
The basic principle of PLC operation is to execute a specific program algorithm using the state of the inputs, and then, after completing all steps in the cycle, to update the outputs. Typically, for industrial systems based on a supervisory system (SCADA, HMI), PLCs have the function of a forced output setting. This allows the operator of the production process to remotely change the outputs of the control system despite the results of the control algorithm, which can be achieved by direct connection to the PLC via an industrial network or by direct connection via the controller transmission port. The process of forcing the output does not have any authorization verification mechanism, so virtually every person with access to the network where the controller is located can use this function. PLC outputs can affect the physical behavior of the process automation components, such as valves, switches, motors, etc. A person who wants to use this method does not need to have a lot of knowledge about the logic of the program. Considering the possibilities and the ease of carrying out this type of attack, it is not difficult to imagine the threat this poses to the production, plant and its employees. **LogicLocker**  
LogicLocker is a ransomware worm (ransom + software) that can hijack many PLCs from various popular manufacturers. The program is designed to bypass weak authentication mechanisms in PLCs.