Detecting PLC Switch Position Changes Through the Network
Summary: Dragos describes detecting PLC key switch position changes over the network by monitoring CIP traffic, specifically the CIP Extended Device Status in the Identities Path, using Wireshark filters cip.id.ext==0x00000006 and 0x00000007 for Run and Program states. The blog notes that remote Start and Stop commands (CIP.SC==0x6 and 0x7) work only when the physical key switch is in Remote mode, a common finding for Dragos Professional Services teams, and that the Dragos Platform flags these as Configuration Change severity 1 notifications.
Bottom line: A PLC left in Remote mode lets an adversary insert or delete logic - such as a PID function block or SFC transition - through a trusted path from a compromised HMI, and the TRISIS attack showed firmware can alter key switch memory values outright. Firewalls alone do not close this: CIP bundles read and write requests into a data blob that makes granular filtering difficult, and inspection latency can make millisecond-critical processes noncontrollable.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026