I'm a bit confused about the Stuxnet S7-417 attack. I believe Stuxnet performed a man-in-the-middle attack on the PLC, closing various valves in the background while it spoofed the values in the input image of the PLC, left the original logic running to write to the output image, and disassociated the input and output images from the sensors and actuators 2. However, I don't understand how this could work if the logic on the PLC wasn't changed (which I assume it wasn't, as the original program continued to run), but I doubt that it was a firmware change as I've read that changing the firmware on PLCs is very difficult due to digital signatures 3. So where actually was the modification made?
[I have never actually played around with PLCs - only read about them - which may be why I can't see how this works]
2 www.langner.com/2010/11/417-attack-code-doing-the-man-in-the-middle-on-the-plc/
3 Section 2.3, https://arxiv.org/pdf/1702.05241.pdf