Evil PLC Attack: Hacking PLCs to Attack Engineering Workstations

Team82's 'Evil PLC Attack' research demonstrates a novel and practical technique in which attackers store specially crafted data on PLCs so that when an engineer performs a normal upload from the PLC to an engineering workstation, the workstation parses the malicious data and executes code; the paper includes proof-of-concept exploits against seven major automation vendors, discusses attack scenarios (internet-exposed PLCs, traveling integrators, and defensive honeypots), explains methodology and findings, and provides mitigations such as network segmentation, client authentication/PKI, monitoring, and patching.