Results of the summarizing process for the arXiv paper: 1812.03478v1

The security of Industrial Control Systems (ICS) has become a major concern due to the discovery of real threats targeting industrial environments. Automating the reverse engineering process for ICS binaries is challenging, primarily because ICS vendors use proprietary compilers. Automation could accelerate digital forensic investigations and incident response actions, but it could also enable the dynamic generation of malicious ICS payloads. To address this problem, the authors propose a structured methodology that automates the reverse engineering process for ICS binaries while considering their unique domain-specific characteristics. They develop the Industrial Control Systems Reverse Engineering Framework (ICSREF), which consists of modular components specifically designed for reversing binaries compiled with CODESYS, a widely used software stack and compiler for Programmable Logic Controllers (PLCs). To evaluate its effectiveness, a database of samples is created by collecting real PLC binaries from public code repositories and developing in-house binaries. The results demonstrate that ICSREF can successfully handle diverse PLC binaries from various industry sectors, regardless of the programming language used. Furthermore, an example is showcased where ICSREF is deployed on a commercial smartphone to orchestrate and launch an automated process-aware attack against a chemical process testbed. This highlights how ICSREF can enable sophisticated attacks without requiring any prior knowledge. Overall, this research presents an innovative framework that addresses the challenges associated with reverse engineering ICS binaries by automating this process and considering domain-specific characteristics; thus offering valuable insights for digital forensic investigations and incident response actions in industrial control systems.

• - Security of Industrial Control Systems (ICS) is a major concern due to real threats targeting industrial environments
• - Automating reverse engineering process for ICS binaries is challenging due to proprietary compilers used by ICS vendors
• - Automation can accelerate digital forensic investigations and incident response actions, but also enable dynamic generation of malicious ICS payloads
• - Authors propose a structured methodology that automates reverse engineering process for ICS binaries while considering unique domain-specific characteristics
• - They develop the Industrial Control Systems Reverse Engineering Framework (ICSREF) with modular components designed for reversing CODESYS compiled binaries
• - Evaluation shows ICSREF successfully handles diverse PLC binaries from various industry sectors regardless of programming language used
• - Example showcases deployment of ICSREF on a commercial smartphone to launch an automated process-aware attack against a chemical process testbed
• - ICSREF enables sophisticated attacks without requiring prior knowledge
• - Research presents innovative framework that addresses challenges associated with reverse engineering ICS binaries, offering valuable insights for digital forensic investigations and incident response actions in industrial control systems.

- Security of Industrial Control Systems (ICS) is a big concern because there are real threats that target industrial environments. - Industrial Control Systems (ICS): These are systems used to control and monitor industrial processes, such as manufacturing or power plants. - It is difficult to automate the process of reverse engineering ICS binaries because they use special compilers that are owned by the companies that make the ICS systems. - Reverse engineering: The process of analyzing and understanding how something works by taking it apart and studying its components. - Binaries: In this context, it refers to the compiled software code used in ICS systems. - Automation can help speed up investigations and actions taken in response to incidents, but it can also be used to create harmful software for ICS systems. - Automation: Using machines or computers to perform tasks automatically without human intervention. - Incidents: Unexpected events or problems that occur in a system or environment. - The authors propose a structured method for automating the reverse engineering process for ICS binaries, taking into account the unique characteristics of these systems. - They have developed a framework called ICSREF specifically designed for reversing CODESYS compiled binaries used in PLCs across different industries. - PLCs: Programmable Logic Controllers, which are devices used to control industrial processes. - The evaluation shows that ICSREF successfully handles different types of PLC binaries from various industries, regardless of the programming language used. - An example demonstrates how

The Security of Industrial Control Systems: Automating the Reverse Engineering Process

Industrial Control Systems (ICS) are used in a variety of industries, from manufacturing to energy production. However, as these systems become increasingly connected to the internet, they have become vulnerable to malicious attacks. To address this problem, researchers have proposed a structured methodology that automates the reverse engineering process for ICS binaries while considering their unique domain-specific characteristics. This research paper presents an innovative framework called Industrial Control Systems Reverse Engineering Framework (ICSREF), which is designed to handle diverse PLC binaries from various industry sectors regardless of programming language used.

Background and Motivation

The security of industrial control systems has become a major concern due to the discovery of real threats targeting industrial environments. Automating the reverse engineering process for ICS binaries could accelerate digital forensic investigations and incident response actions; however it could also enable dynamic generation of malicious ICS payloads. As such, there is an urgent need for automated solutions that can effectively analyze ICS binaries while considering their unique domain-specific characteristics.

The Proposed Solution: The Industrial Control Systems Reverse Engineering Framework (ICSREF)

To address this challenge, the authors propose a structured methodology that automates the reverse engineering process for ICS binaries while considering their unique domain-specific characteristics. They develop the Industrial Control Systems Reverse Engineering Framework (ICSREF), which consists of modular components specifically designed for reversing binaries compiled with CODESYS, a widely used software stack and compiler for Programmable Logic Controllers (PLCs).

Evaluation Results

To evaluate its effectiveness, a database of samples was created by collecting real PLC binaries from public code repositories and developing in-house binaries. The results demonstrate that ICSREF can successfully handle diverse PLC binaries from various industry sectors regardless of programming language used. Furthermore, an example was showcased where ICSREF was deployed on a commercial smartphone to orchestrate and launch an automated process-aware attack against a chemical process testbed; thus highlighting how ICSREF can enable sophisticated attacks without requiring any prior knowledge or expertise in industrial control systems security or forensics analysis techniques.

Conclusion

Overall, this research presents an innovative framework that addresses challenges associated with reverse engineering ICS binaries by automating this process and considering domain-specific characteristics; thus offering valuable insights for digital forensic investigations and incident response actions in industrial control systems