Assessing and Exploiting Control Systems

Version 38
Copyright 2020 Justin Searle
801-784-2052 // justin@controlthings.io
1
2
•
•
•
•
•
•
•

3
•
–
–
–
–
–
–
•
–
–
•
–
–
–

4
•
•
•
•
•
•
•
•

5
•
–
•
–
–
•
–
–
•
–
•
–

6
•
–

•
–

•
–

7
•

•
https://greatscottgadgets.com/wheretobuy/
•

8
Control System Basics
Controller Systems
PLCs
Real Time Operating Systems (RTOS)
RTUs
IEDs

9
 Sensors
Supervisory (Monitor Points)
&
Management
Basic and/or Fieldbus I/O
Infrastructure Actuators
(Control Points)

•
–
–
•
–
–
•

10
•
•

Source: http://en.wikipedia.org/wiki/Programmable_logic_controller#/media/File:BMA_Automation_Allen_Bradley_PLC_3.JPG
11
Source: http://en.wikipedia.org/wiki/Microkernel
12
•
–
–
–
–

•
–
–
–
–

13
•

–
–
–
•
–
–
–
•
•

14
•
•
•
•

Source:
http://www.hyosungpni.com/upload/product/image/1278753931796.jpg
15
Controller Logic

Our Target PLC

Exercise: Programming our PLC
Exercise: Making an HMI

16
 Welcome to the
brave new world of
Pico PLCs! ☺

17
18
 vBuilder supports both:
- Sequential Function Chart (SFC)
- Ladder Logic (LL)

We will use SFC in class

vBuilder manual has LL tutorials

19
•
TOR
– RUC B!!!
N ST LA
I ED
• L
–
–
–
–
•

20
•
•
•

TOR
R UC B!!!
ST LA
IN ED
L
•
21
•
–
TOR
U C !!!
– TR LAB
S
– IN ED
L
–
•
•
–
–
–
–
•

22
•
–
–
–
•
–
–
– TOR
U C !!!
– STR LAB
IN ED
– L
–
•
–
–
–
23
•

TOR
R UC B!!!
ST LA
IN ED
L

24
Supervisory and Control
Control Systems Concepts
DCS vs SCADA
ICS Components
ICS Architectures

25
•
•
–
–
–

26
•

–
–

Source:
27 https://www.osisoft.com/software-support/what-is-pi/What_Is_PI.aspx
•
–

•
–

•
–

•
–

28
•
–

•
–

•
–
29
 •
–
–
–
–
–

30
 Source: Shodan ICS Radar:
https://ics-radar.shodan.io/

•
–
–

31
 DCS room for the scrubber section of a power plant. -
http://i.imgur.com/d6cSaQY.jpg

32
33
34
 Source:
http://www.comtrol.com/solutions/energy/energy-solutions
/oil-pipeline-monitoring
35
 Sensors
Local
Historian
HMI HMI
Actuators
MTU MTU Historian

HMI Historian

CONTROL CENTER
Sensors

Wide Area Network

(MPLS, Satellite, Actuators
Cellular, Microwave,
DUN)
Sensors

Historian Actuators
HMI

MTU MTU Historian

HMI Historian Sensors

CONTROL CENTER Actuators

36
•
•

Source: http://www.motherwell.net.au/Uploads/Images/rtu32-ovan-framsida3.jpg
37
38
•
•

TOR
R UC B!!!
N ST LA
I ED
L

39
•
•
–
–
–
E D
– U
DI
G !!
• E L AB!
F
S L
–
–
–

•
40
•
–
•
–
•
–
–
•
–
•
–

41
Control Things Platform

Knowledge without tools is limiting

Tools without knowledge is useless

42
•
–
–
–
–
•
–
–
–
•
–
–
–

43
•

•
–
–
–
•
–
–
–
•
•
•

44
• •
– –
– –
– •
– –
• –
– –
– –
– •
– –
–
–
–

45
• •
• •
• •
• •
• •
• •
•

46
47