Wireshark Mac Crashes Stack Guard: Uncovering a Critical Bug in Industrial Control Systems

Industrial control systems, such as Programmable Logic Controllers (PLCs), play a crucial role in regulating and monitoring processes in various industries. These devices are used to control machinery, automate tasks, and monitor vital signs in real-time. However, when it comes to security, PLCs are often overlooked, leaving them vulnerable to attacks that can compromise their functionality.

Recently, I had the opportunity to explore the world of industrial control systems during a research project at Rapid7 Labs. During this endeavor, I stumbled upon a Denial of Service (DoS) bug in a Beckhoff PLC runtime while browsing eBay for used PLCs. This discovery led me down a rabbit hole of industrial automation and networking protocols.

The bug, which affected Beckhoff PLCs running the Profinet protocol stack, allowed an attacker to crash all connected devices by exploiting a vulnerability in the Stack Guard mechanism. The Stack Guard is a security feature designed to prevent buffer overflows by checking the stack frame for valid return addresses before executing a function call. In this case, the bug allowed an attacker to bypass this protection and execute arbitrary code, leading to system crashes.

To investigate further, I used Wireshark, a popular network protocol analyzer, to capture and analyze traffic between the PLC and its controller. Wireshark's capabilities in capturing and decoding industrial protocols such as Profinet proved invaluable in understanding the communication flow between devices.

Using Wireshark, I was able to identify the specific packets and protocols involved in the attack and create a proof-of-concept (PoC) exploit that demonstrated the vulnerability. The PoC exploited the bug by sending crafted packets to the PLC, which caused it to crash and become unresponsive.

The discovery of this critical bug highlights the importance of security testing and responsible disclosure in industrial control systems. PLCs are often used in critical infrastructure, such as power plants, water treatment facilities, and manufacturing lines, making them attractive targets for attackers.

As researchers, we must continue to identify vulnerabilities in these systems and work with manufacturers to develop patches and secure configurations. This ensures that industrial control systems can operate safely and securely, minimizing the risk of attacks that could compromise their functionality and potentially cause harm to people and the environment.

In conclusion, my experience using Wireshark to analyze industrial protocols and discover a critical bug in a Beckhoff PLC runtime underscores the importance of security testing and responsible disclosure in industrial control systems. By working together, researchers and manufacturers can ensure the safety and reliability of these critical systems.

Wireshark mac crashes stack guard