In my experience you don't even need to go after the PLCs. The operating systems are typically so out of date and missing patches so exploitation is usually pretty trivial. Also, if you can pop the box that manages the PLCs you own everything.

Also, about 5 years ago when PLC manufacturers started adding web servers and snmp to their devices, they almost never password protected them or used hardcoded pws/snmp strings.

Finally, simple arp spoofing will usually yield tons of clear text passwords since most comm protocols are still modbus over tcp or telnet. As far as crafting CIP messages, I've never needed to do that. Total domination on ICS is usually less than a days work.

I have this book, and it is OK, not great: http://www.amazon.com/Industrial-Network-Security-Securing-Infrastructure/dp/1597496456/ref=sr_1_1?ie=UTF8&qid=1340658150&sr=8-1&keywords=industrial+network+security

Aside from an allen bradley manual, not really sure on what to read from the hardware side. However, you might want to search on Embedded Device Hacking or Firmware Hacking.

Just reading some of the spec on CIP, (couldnt find an RFC looks to be a manufacturer created protocol?) two things jump out:

-Transfer of basic I/O data via User Datagram Protocol (UDP)-based implicit messaging
-Uploading and downloading of parameters, setpoints, programs and recipes via TCP (i.e., explicit messaging.)

Obvious UDP security issues with the first bullet, spoofing etc.

The second bullet is very interesting. I suspect if you fiddled with the values in those packets you might be able to get the PLCs to crash, which might mean exploitation is possible. I doubt they have much bounds checking implemented, especially if they are old. It would seem, the most malicious of intent would want to exploit this because success equals changing values or device compromise. I'm totally speculating on this attack vector, but it might be worth a look.

The hardest part would be debugging the crash. It's not like you could just open Immunity and debug the crashes. This part is out of my league.

Looks like there has already been some work done here: http://www.digitalbond.com/tools/basecamp/metasploit-modules/
http://www.digitalbond.com/tools/basecamp/rockwell-automation-controllogix/