{"id":729,"date":"2013-09-12T13:09:02","date_gmt":"2013-09-12T19:09:02","guid":{"rendered":"http:\/\/www.malos-ojos.com\/?p=729"},"modified":"2013-09-12T13:09:02","modified_gmt":"2013-09-12T19:09:02","slug":"research-paper-on-snort-rule-development-for-the-major-fault-attack-on-allen-bradley-micrologix-1400-controllers-2","status":"publish","type":"post","link":"http:\/\/www.malos-ojos.com\/?p=729","title":{"rendered":"Research paper on Snort rule development for the major fault attack on Allen Bradley MicroLogix 1400 controllers"},"content":{"rendered":"<p>As part of a course I took last quarter at DePaul\u00a0University on critical infrastructure security I drew the straw on one of our group labs which required that we write a Snort signature for an attack on the Allen Bradley MicroLogix\u00a01400 series controllers. The attack was written by Matt Luallen\u00a0of Cybati in September of last year for Metasploit\u00a0which sets a bit on a data file on the controller which indicates to the controller that there is a major logical fault. This attack stops the running program on the controller and must be manually cleared (either through physical interaction with the controller or by clearing the fault using the RSMicroLogix application).<\/p>\n<p>The results of this research project will likely be published in the future in a more formal fashion, but until then I wanted to post a sneak peek at the report for those who may be interested. Note that I wrote this a few months ago and held off on publishing it as it was being copy edited for publication.\u00a0 As I assume that process had died I am left with no choice but to publish this work&#8230;no sense in holding on to something to could be of value to someone else.<\/p>\n<p>A link to the PDF is <a onclick=\"javascript:pageTracker._trackPageview('\/downloads\/wp-content\/uploads\/2013\/05\/Snort-Signtuare-for-Allen-Bradley-MicroLogix-1400-Contoller-Fault-Attack-Research-Paper.pdf');\" title=\"here\"  href=\"http:\/\/www.malos-ojos.com\/wp-content\/uploads\/2013\/05\/Snort-Signtuare-for-Allen-Bradley-MicroLogix-1400-Contoller-Fault-Attack-Research-Paper.pdf\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>As part of a course I took last quarter at DePaul\u00a0University on critical infrastructure security I drew the straw on one of our group labs which required that we write a Snort signature for an attack on the Allen Bradley MicroLogix\u00a01400 series controllers. The attack was written by Matt Luallen\u00a0of Cybati in September of last [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-729","post","type-post","status-publish","format-standard","hentry","category-general"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pme9o-bL","jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/www.malos-ojos.com\/index.php?rest_route=\/wp\/v2\/posts\/729","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.malos-ojos.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.malos-ojos.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.malos-ojos.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.malos-ojos.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=729"}],"version-history":[{"count":3,"href":"http:\/\/www.malos-ojos.com\/index.php?rest_route=\/wp\/v2\/posts\/729\/revisions"}],"predecessor-version":[{"id":732,"href":"http:\/\/www.malos-ojos.com\/index.php?rest_route=\/wp\/v2\/posts\/729\/revisions\/732"}],"wp:attachment":[{"href":"http:\/\/www.malos-ojos.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=729"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.malos-ojos.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=729"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.malos-ojos.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=729"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}