FieldFuzz: In Situ Blackbox Fuzzing of Proprietary Industrial Automation Runtimes via the Network
Andrei Bytes, Prashant Hari Narayan Rajput, Constantine Doumanidis,, Nils Ole Tippenhauer, Michail Maniatakos, Jianying Zhou

TL;DR
FieldFuzz is a novel network-based fuzzing framework that analyzes proprietary industrial PLC runtimes, uncovering vulnerabilities and improving security assessment of critical infrastructure devices.
Contribution
The paper introduces FieldFuzz, a new framework for in situ blackbox fuzzing of industrial PLC runtimes, including reverse-engineering, automated command discovery, and coverage-guided testing.
Findings
Uncovered multiple security vulnerabilities in Codesys runtime
Reported three new CVEs affecting industrial PLCs
Demonstrated cross-platform effectiveness on diverse ICS devices
Abstract
Networked Programmable Logic Controllers (PLCs) are proprietary industrial devices utilized in critical infrastructure that execute control logic applications in complex proprietary runtime environments that provide standardized access to the hardware resources in the PLC. These control applications are programmed in domain-specific IEC 61131-3 languages, compiled into a proprietary binary format, and process data provided via industrial protocols. Control applications present an attack surface threatened by manipulated traffic. For example, remote code injection in a control application would directly allow to take over the PLC, threatening physical process damage and the safety of human operators. However, assessing the security of control applications is challenging due to domain-specific challenges and the limited availability of suitable methods. Network-based fuzzing is often the…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSmart Grid Security and Resilience · Advanced Malware Detection Techniques · Physical Unclonable Functions (PUFs) and Hardware Security
