Ladder logic bombs¶
Most attacks on industrial control systems in the public record went after the network, the engineering workstation or the firmware. A ladder logic bomb goes after the control logic itself: the rungs an engineer would open in the IDE and read.
The code is valid. It compiles, it downloads to the PLC, it passes a syntax check, and for years it drives the plant correctly. Then a specific combination of inputs appears, and it does something else.
Where the term comes from¶
Naman Govil, Anand Agrawal and Nils Ole Tippenhauer, On Ladder Logic Bombs in Industrial Control Systems, CyberICPS/SECPRE at ESORICS 2017, pages 110–126. DOI 10.1007/978-3-319-72817-9_8, preprint arXiv:1702.05241.
Their abstract defines it directly: "we discuss ladder logic bombs, i.e. malware written in ladder logic (or one of the other IEC 61131-3-compatible languages). Such malware would be inserted by an attacker into existing control logic on a PLC, and either persistently change the behavior, or wait for specific trigger signals to activate malicious behaviour."
They abbreviate it LLB, place Stuxnet in the same lineage as a special case, and build working examples on real PLCs in their lab.
Note the parenthesis in their own definition. The name says ladder because ladder is what most plant logic is written in, but the idea is not confined to it, and a bomb in Structured Text is the same object. This suite says logic-level bomb for that reason, keeping the abbreviation and widening the expansion, because the catalog carries the same attack in FBD, SFC and ST bodies as well as ladder.
The three parts¶
A pump runs when the operator commands it and stops when the stop button is pressed. The stop contact is normally closed, so pressing the button breaks the path. This is the shape every safety interlock in the standard takes.
One branch has been added around the stop contact, carrying stop and a service switch in
series. Written out:
Three things are worth naming separately, because defenses tend to address one and miss the others.
| part | in this rung |
|---|---|
| trigger | stop AND svc, a combination no operator asserts on purpose |
| payload | the stop button stops working, and the pump keeps running |
| dormancy | with svc low the two programs are the same function, input for input |
Dormancy is the part that does the damage. The added branch conducts only when the stop button is pressed and the service switch is on. Every other point in the input space, which is to say every point reached in normal operation, produces exactly the output the correct program produces.
Why reading the code does not find it¶
Govil and colleagues make this point themselves: they "focus on stealthy LLBs, i.e. LLBs that are hard to detect by human operators manually validating the program running in PLCs."
The reason is structural rather than a matter of diligence. A reviewer reads a rung and asks whether it looks like reasonable control logic, and the bombed rung does. Parallel branches around a contact are ordinary. A service or maintenance input is ordinary. Nobody holds the full input space in mind while reading, so the question "is there a combination that defeats this interlock" is not the question a reader is actually answering.
Testing has the matching gap. A test suite covers the cases somebody thought of, and the attacker picked a combination nobody would think of, which is the whole design criterion for the trigger.
A bomb is not a bug¶
The distinction matters for what you conclude when you find one.
A bug is a mistake, so ask what mistake produces this rung. Nobody types a series pair of
stop and svc by accident, and nobody wires that pair in parallel with precisely the
normally closed contact it cancels while leaving every other element of the interlock
untouched. The branch is deliberate, aimed at the one contact that carries the safety
function, and quiet until a chosen pattern appears.
That is why the catalog keeps a clean and a bombed variant of the same plant. The pair is the evidence: same machine, same property, one added branch, and a verdict that flips.
What the catalog carries¶
Thirty-six of the 117 benchmark tasks are tagged
llb, spanning 75 program variants across
ten industrial domains. All thirty carry the security tag as well.
The paper sorts payloads into three classes, and the suite carries all three:
| payload class | what the attacker gets |
|---|---|
| actuator manipulation | a valve, contactor or breaker moves when it must not |
| sensor or HMI forgery | the operator is shown a plant state that is not the real one |
| denial of control | the controller stops producing output at all |
Denial of control is the one that looks least like a conventional bug, and fourteen
benchmarks carry the non-termination tag for it. A payload that never terminates never finishes a
scan, so the PLC stops updating outputs entirely, and no assertion about a variable's value
catches it. Lesson 3.4 works through that case.
Triggers in the catalog take three shapes: an input pattern, as in the rung above; a counter that has to reach a threshold, so the bomb arms only after N scans; and a comparison against a specific sensor value.
Why a model checker is the right instrument¶
A bomb's defining property is that it hides everywhere except on a set the designer chose to be small and strange. Searching that set by sampling is hopeless, and reading for it is what the attacker already assumed you would do.
A bounded model checker does not sample. It asks whether any assignment of inputs, over any reachable sequence of scans, reaches a state where the property is false, and it answers by construction rather than by search over examples. When the answer is yes it prints the assignment:
That is the counterexample, and for a logic bomb it is also the trigger. The tool does not report that something looks suspicious. It hands back the exact combination that opens the hole, which is what lesson 3.5 means by recovering the knock.
The limit is honest and worth stating: this finds a bomb only when you have written the property it violates. A checker given no property to defend proves nothing, and lesson 3.6 is about that gap.
Where to go next¶
Part 3 of the lessons organizes these attacks by shape: triggers, fuses that outrun the checker, denial of control, and trigger synthesis. Part 2 fits the same attack to twelve plants in turn, starting with a conveyor whose emergency stop is bypassed exactly as the rung above bypasses the stop button.