Unveiling the Secrets of Codesys V3: ZeroDays, Forensic Artifacts and More
summary
Research discloses 31 zero days in CODESYS V3 impacting millions of devices and demonstrates concrete tooling and exploits: Binwalk and IDA + IDAPython reveal protocol tag tables and symbol entries; Capstone-based ARM simulator reconstructs task configs and call graphs; a downloaded .app via the CODESYS V3 protocol is parsed into metadata, tasks, network capabilities and CSVs by the open-source ICSpector plugin; multiple memcpy stack overflow bugs yield RCE on a WAGO PFC using ROP and return-to-libc, plus guidance for patching and network hygiene.
AI-written summary · about
chapters (11)
- 0:00CODESYS V3 research intro
- 2:17Why CODESYS V3 is prime target
- 3:23OT forensic analysis motivation
- 4:49IEC 61131-3 and ladder logic
- 8:24Reverse engineering binaries
- 18:26Firmware vulnerabilities found
- 25:56Memory layout reconstruction
- 29:03CODESYS V3 forensic tool
- 31:54ICSpector and open-source tools
- 32:36Securing OT environments
- 34:43Q&A
related talks
34mCoDe16; 16 Zero-Day Vulnerabilities Affecting CODESYS Framework Leading to Remote Code Execution
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
38mFail Harder: Finding Critical 0-Days in Spite of Ourselves
39mNight of the living vulnerabilities
46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS Hacking
37mCDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days
45mFinding Vulnerabilities through Static Analysis and Scripting