PLC Logic-Tamper Detection Lab
A tampered PLC does not throw an error — it runs the attacker's logic perfectly and the HMI shows exactly what it is told to. Inspect a live process mimic and its register and ladder-logic panel, and find the single value that was changed each round: a moved setpoint, a widened alarm threshold, a forced output, a bypassed interlock, or — the Stuxnet move — a spoofed sensor whose reading matches its setpoint while the real plant drifts toward failure. Name the tag and the technique before the process trips.
The real job. More noise, a tighter clock.
Round 1 / 4
Pump-start dry-run
A transfer pump that must never run dry.
Design intent: Pump starts at SP-LO = 30 %. Below ~15 % the pump cavitates and runs dry.
Register / ladder-logic panel
Click the tag you believe was tampered. Compare displayed to expected — and remember a value can match its setpoint and still be a lie. The independent tap reads the plant out-of-band.
Attack technique
Select the tampered tag and the technique to continue.
Integrity check
Across 4 rounds, one value per round was tampered — a setpoint, an alarm limit, a forced output, a bypassed interlock, or a spoofed sensor. Find which one and name the technique before the process reaches its damage point.
So far: 0 / 4 rounds locked in.
What breaks the illusion
If displayed ≠ expected, the tamper is on that value directly.
If everything matches spec but the independent tap disagrees, the sensor itself is spoofed — the Stuxnet replay.
FORCED on an output or rung means the program no longer controls it.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based OT lab: inspect a live HMI mimic and a register / ladder-logic panel, and find which single PLC value an attacker tampered with before the process reaches its damage point.
- Each round hides one change — a moved setpoint, a widened alarm/trip threshold, a forced output, a bypassed interlock rung, or a Stuxnet-style spoofed sensor — and you must name both the tag and the technique.
- At Elite the HMI value matches its setpoint perfectly, so the only tell is an independent out-of-band instrument tap — the exact move Stuxnet used to show operators green while damaging the plant.
- Scored on correctness plus speed, graded S–D, with difficulty tiers (Rookie / Pro / Elite) and best-score persistence like every PlayCISO lab.
- The debrief ties each round to the real lesson: a PLC and HMI will faithfully run and show whatever they are fed, so integrity has to be verified from outside the controller.
Frequently asked questions
What is the PLC Logic-Tamper Detection Lab?
A free, in-browser exercise where you play an OT engineer reviewing an industrial process. An HMI mimic shows tank level, pressure, temperature, pump/valve states and setpoints, alongside a register and ladder-logic panel. In each round an attacker has subtly tampered with exactly one value — a setpoint, an alarm or trip threshold, a forced coil/output, a bypassed interlock, or a spoofed sensor reading. You identify which value was changed and the technique used, scored on correctness and speed.
How does it relate to Stuxnet?
Stuxnet altered PLC logic and setpoints on centrifuge drives while replaying previously-recorded normal sensor values back to the operators, so the HMI looked completely healthy the whole time. The Elite tier reproduces that: the displayed value matches its design setpoint exactly and nothing alarms, and the only way to catch it is to cross-check the reading against an independent instrument. The centrifuge round even uses the real 1064 Hz normal / ~1410 Hz resonance figures.
What is the actual lesson?
A PLC will faithfully execute whatever logic and setpoints it holds, and an HMI will faithfully display whatever values it is fed — neither can tell you it was tampered with. So PLC integrity has to be established from outside the controller: baseline the program, setpoints and alarm limits and diff against a known-good copy, alarm on forced I/O and online logic edits, and verify safety-critical readings out-of-band with independent instrumentation.
Is this a real PLC or control system?
No. It is a teaching simulation that runs entirely in your browser — no real PLC, no network, no control protocol. The processes, tags, registers and tamper scenarios are invented to make the detection habits concrete. It deliberately simplifies the physics so the one lesson — controller integrity and out-of-band verification — stays clear.