Dead Man’s PLC: Ransoming the Physical World via Operational Technology
summary
Dead Man’s PLC presents a concrete extortion method that targets the engineering workstation to inject malicious logic into PLC projects, using Siemens TIA Portal and Snap7 in a proof‑of‑concept called conveyor.exe. The build installs heartbeat and tamper‑detection across PLCs, enforces per‑PLC timers and lockouts, and demos (via factory.io demo) that pulling a PLC or letting a timer expire triggers coordinated physical disruptions. Demonstration works; mitigations are network segregation, USB dongle licensing, strict PLC passwords and practiced IR.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:30OT security threats
- 6:00Why OT isn't targeted
- 10:16IT vs OT extortion chain
- 15:15Dead Man's PLC concept
- 18:08Dead Man's PLC breakdown
- 27:39Live demo
- 38:05Defending against Dead Man's PLC
- 41:16Key takeaways
- 44:52Medium-term defenses
- 46:40Long-term OT security shifts
- 48:25Conclusions
related talks
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
58mIndustrial Control Systems : Pentesting PLCs 101 (Part 1/2)
21mOops, It Halted Again: Exploiting PLC Memory for Fun and Profit in Industrial Control...
55mPLC-Blaster: A worm Living Solely In The PLC
38mPLC-Blaster: A Worm Living Solely in the PLC
44mRogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
29mFuzzing and Breaking Security Functions of SIMATIC PLCs
19mIoT Security Exposed: From PLC Flaws to the Imperative of SBOM