Safety Instruments Testing: Spotting and Stopping Process Attacks
Summary: Dragos research, drawing on the LOGIIC Project 12 Safety Instrumentation Report, describes 'device state' attacks in which HART-protocol sensors are placed into 'fixed current' or 'loop current' modes so their analog readings no longer reflect the process. These two modes produce six key attack effects and are the only known effects that can universally blind a Safety Instrument System to process state, and the HART status bit 4 flags the condition, which engineers can use in safety logic to trip the process.
What's compelling: During LOGIIC testing, no mechanism for circumventing that HART status bit was ever found, but the defense only works if the SIS uses HART-aware I/O cards that expose the data to control logic; a card that only passes commands through is described as just as dangerous, or more so, than one with no HART awareness at all.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026