On Ladder Logic Bombs in Industrial Control Systems

In industrial control systems, devices such as Programmable Logic Controllers (PLCs) are commonly used to directly interact with sensors and actuators, and perform local automatic control. PLCs run software on two different layers: a) firmware (i.e. the OS) and b) control logic (processing sensor readings to determine control actions). In this work, we discuss ladder logic bombs, i.e. malware written in ladder logic (or one of the other IEC 61131-3-compatible languages). Such malware would be inserted by an attacker into existing control logic on a PLC, and either persistently change the behavior, or wait for specific trigger signals to activate malicious behaviour. For example, the LLB could replace legitimate sensor readings with manipulated values. We see the concept of LLBs as a generalization of attacks such as the Stuxnet attack. We introduce LLBs on an abstract level, and then demonstrate several designs based on real PLC devices in our lab. In particular, we also focus on stealthy LLBs, i.e. LLBs that are hard to detect by human operators manually validating the program running in PLCs. In addition to introducing vulnerabilities on the logic layer, we also discuss countermeasures and we propose two detection techniques.Comment: 11 pages, 14 figures, 2 tables, 1 algorith

Alignment and orientation of an adsorbed dipole molecule

Half-cycle laser pulse is applied on an absorbed molecule to investigate its alignment and orientation behavior. Crossover from field-free to hindered rotation motion is observed by varying the angel of hindrance of potential well. At small hindered angle, both alignment and orientation show sinusoidal-like behavior because of the suppression of higher excited states. However, mean alignment decreases monotonically as the hindered angle is increased, while mean orientation displays a minimum point at certain hindered angle. The reason is attributed to the symmetry of wavefunction and can be explained well by analyzing the coefficients of eigenstates.Comment: 4 pages, 4 figures, to appear in Phys. Rev. B (2004

Spin-charge separation: From one hole to finite doping

In the presence of nonlocal phase shift effects, a quasiparticle can remain topologically stable even in a spin-charge separation state due to the confinement effect introduced by the phase shifts at finite doping. True deconfinement only happens in the zero-doping limit where a bare hole can lose its integrity and decay into holon and spinon elementary excitations. The Fermi surface structure is completely different in these two cases, from a large band-structure-like one to four Fermi points in one-hole case, and we argue that the so-called underdoped regime actually corresponds to a situation in between.Comment: 4 pages, 2 figures, presented in M2S-HTSC-VI conference (2000

An Infrared study of the Josephson vortex state in high-Tc cuprates

We report the results of the c-axis infrared spectroscopy of La_{2-x} Sr_x CuO_4 in high magnetic field oriented parallel to the CuO_2 planes. A significant suppression of the superfluid density with magnetic field rho_s(H) is observed for both underdoped (x=0.125) and overdoped (x=0.17) samples. We show that the existing theoretical models of the Josephson vortex state fail to consistently describe the observed effects and discuss possible reasons for the discrepancies