Researchers have found and released two exploits that are similar to the Stuxnet worm that attacked nuclear centrifuges in Iran. These two exploits are capable of being used to damage critical infrastructure, such as refineries or factories. The exploits operate on the same piece of hardware, but have two different outcomes.

The first method is just sending a "stop" command which causes the piece of hardware to stop its functions thus shutting down whatever the piece of hardware is responsible for doing. The second method is much more dangerous. Instead of just stopping or shutting down the factory, this exploit can be used to cause damage.

This exploit involves downloading the ladder logic that is currently on the PLC. It is analyzed so that it can be understood what the device is doing. A modified ladder logic is then uploaded which automatically overwrites the current logic on the device. Both exploits use the fact that the actual PLC device doesn't have any authentication. If you can talk to it, you can write to it.