Low-Cost Platform for Fault Injection Attacks on Industrial Programmable Logic Controllers

Attacks such as Stuxnet have shown that programmable logic controllers (PLCs) used in supervisory control and data acquisition (SCADA) systems are vulnerable to attack. Over the last decade, research in cybersecurity related to these systems has been increasing significantly. Most of this research focuses on the context of embedded security and the exploitation of software-based vulnerabilities through fuzzing methods. However, in the context of implementation security of embedded devices, implementation attacks such as Fault Injection Attacks (FIA) are important as they allow attackers to bypass functionally correctly implemented security mechanisms. Although hardware attacks such as Fault Injection Attacks (FIA) have been an active research topic for several decades, this type of attack has been studied little or not at all in the context of SCADA systems or PLCs. This paper investigates the practical implementation of a voltage-based fault injection attack on a PLC with a low-cost crowbar tool to evaluate the potential risk and impact on compromising security applications in an Operational Technology (OT) domain running on a PLC.