Silent Sabotage: A Stealthy Control Logic Injection in IIoT Systems

As Industrial Internet of Things (IIoT) continues to revolutionize industrial processes, the security of these systems becomes paramount. This work contributes to ongoing efforts to uncover security issues in IIoT-based systems, specifically those that allow attackers to conduct stealthy control logic injections. To achieve this, we designed an attack aimed at compromising IIoT-based systems by exploiting vulnerabilities within the MQTT and SFTP protocols. The attack specifically targets the interaction between IoT devices and Programmable Logic Controllers (PLCs) through MQTT communication, while utilizing the SFTP protocol for file transfer, with the goal of infecting and manipulating PLCs discreetly. We initially demonstrate that attackers can leverage weaknesses in the SFTP protocol to inject malicious control logic into IoT-PLCs. Subsequently, attackers exploit the lack of robust security mechanisms in the MQTT protocol to conceal their injection, orchestrating a deception by falsifying the user-dashboard view. This manipulation ensures that the injected control logic remains hidden, presenting a fabricated operational status to the end-user. Finally, we propose a set of security recommendations and mitigation solutions to safeguard IIoT systems against such a severe attack scenario. Our attack codes, along with a proof-of-concept, are publicly available.