With the advent of the fourth industrial revolution, networked industrial Programmable Logic Controllers (PLCs) have been introduced for critical infrastructure control. A number of recent discoveries of exploitable vulnerabilities in third-party libraries in such devices has raised concerns about their supply chain security. Supply chain security verification of software used in this context is challenging due to the proprietary nature of the platforms, and the difficulty of their runtime introspection. In particular, network-based fuzzing is often the only way to test the devices, but without guidance through execution tracing this fuzzing is inefficient. In this work, present a novel approach for dynamic analysis of such platforms, leveraging two main contributions: i) a `Ghost' application injected into the fuzzing target to allow on-system tracing and coverage computation, and ii) stateful fuzzing based on automated command discovery and status code extraction. We present FieldFuzz, a framework that realizes this approach for the widespread Codesys runtime for PLCs used by 80 industrial device vendors ranging from over 400 devices. Our fuzzing campaigns uncovered multiple vulnerabilities, leading to three reported CVE IDs. To study the cross-platform applicability of FieldFuzz, we reproduce the findings on a diverse set of Industrial Control System (ICS) devices, showing a significant improvement over the state-of-the-art.

翻译：随着第四次工业革命的到来，网络化工业可编程逻辑控制器（PLC）已被引入关键基础设施控制领域。近期在该类设备第三方库中发现的多个可利用漏洞，引发了对供应链安全的担忧。由于平台专有性及运行时内省困难，此类软件供应链安全验证极具挑战性。特别是基于网络的模糊测试通常是测试此类设备的唯一手段，但缺乏执行跟踪引导使测试效率低下。本文提出一种针对此类平台动态分析的新方法，其主要贡献包括：i）在模糊测试目标中注入"幽灵"应用程序实现片上跟踪与覆盖率计算；ii）基于自动化命令发现与状态码提取的有状态模糊测试。我们开发了FieldFuzz框架，将其应用于覆盖80个工业设备厂商400余款设备的通用Codesys运行时PLC环境。通过模糊测试活动，我们发现了多个漏洞并提交了三个CVE编号。为验证FieldFuzz的跨平台适用性，我们在多款工业控制系统（ICS）设备上复现了测试结果，证实其较现有技术有显著提升。