Vulnerabilities / Threats
06:13 PM
Connect Directly
Repost This

SCADA Password-Cracking Tool For Siemens S7 PLCs Released

Siemens says no bug involved so no patch needed, and is working on simplifying patching overall for its customers

A Russian security researcher has unleashed a brute-force password-cracking tool that can capture passwords for Siemens S7 programmable logic controllers (PLC), which run machinery in power plants and manufacturing sites.

Sergey Gordeychik, a researcher with Positive Technologies, last week at the S4 2013 conference in Miami released the proof-of-concept tool that brute-force hacks the challenge-response information from a TCP/IP traffic exchange. The tool demonstrates how an attacker on an adjacent network could grab credentials for the PLCs simply by brute-force hacking for passwords.

S7 is the protocol used for communicating among engineering systems, SCADA, HMI, and PLC equipment, and can be password-protected. "We wrote two brute-force authentications for S7," Gordeychik says.

Siemens was the target of much of the vulnerability research at last week's conference, where another researcher also demonstrated how to intercept S7-400 PLC passwords. Erik Johansson, an independent consultant and researcher at the Royal Institute of Technology in Sweden, demonstrated how unpatched S7 systems are susceptible to attack and control by an unauthorized user who grabs their passwords. Siemens described the flaw as a security "weakness in the programming and configuration client software authentication method" that the S7 employs.

As one of the most prevalent vendors in the SCADA/ICS world, Siemens has been under the microscope of security researchers ever since it was revealed in 2010 that the Stuxnet attack zeroed in on its process control system products. The vendor, for the most part, has issued patches in response to bugs that are publicly reported, and also has begun updating its product families with more built-in security features as well as better-written code.

ICS-CERT issued a security alert about the password-cracker after Gordeychik's presentation last week. "ICS-CERT has notified the affected vendor of the report and has asked the vendor to confirm the attack vector and identify mitigations. ICS-CERT is issuing this alert to provide early notice of the report and identify baseline mitigations for reducing risks to these and other cybersecurity attacks," the alert says.

[Researcher Dillon Beresford shows holes in Siemens programmable logic controllers (PLCs) that could lead to attacks. See Siemens Shows Up For Black Hat Demo Of SCADA Hack.]

Dr. Tobias Limmer of Siemens Product CERT team says the free tool doesn't go after any particular vulnerability in the S7 PLC. "This is not a vulnerability," Limmer says. "It's ... a tool that tries to get the password on" the PLCs, he says. "We don't need to release a patch" for this, he says.

Protection against password-cracking, he says, requires using strong passwords. "Eight characters is not enough," Limmer says. "The password should be as long as possible. If it's a good password, you should be protected."

ICS-CERT in its advisory recommends that control system devices don't directly face the Internet, sit behind firewalls, and are isolated from the corporate network. Remote access should be allowed only via virtual private networks, the advisory says.

Positive Security's Gordeychik also pointed out vulnerabilities his team had discovered in other Siemens products, many of which have since been fixed by the vendor. He says the team found bugs in Simatic WinCC 7.X, Simatic WinCC Flexible HMI software for hardware panels, TIA Portal, KTP Family of HMI panels, and S7 PLCs.

The vulnerabilities can be used for stealing information, running code on an operator workstation in client- or server-side attacks, reading files, grabbing and resetting passwords, uploading custom code to PLCs, and decrypting secured communications, he says.

Meanwhile, Gordeychik says the quality of security patches coming from Siemens has improved. "Previously, they were not quite that good. Now they are implementing an internal patch review process ... to see if that patch really patches something," for example, he says.

But most organizations don't bother patching. SCADA security experts estimate that about 10 to 20 percent of organizations today actually install patches that their vendors release.

"That's actually a huge problem," Siemens' Limmer says. He says that Siemens is working on ways to make patching easier on its customers, but would not elaborate on just what that would entail.

"Our goal is to help the customer out and find the best solution and help them in this patching problem," he says.

But patching and best practices are obviously just one part of the equation in SCADA security. "The first step is for vendors to offer products that are secure, especially on the controller side," says Dale Peterson, CEO of Digital Bond, which sponsored the S4 conference. "Then owners/operators [of industrial communications systems] will have a choice. But I have some customers who are upgrading their PLCs and had to buy insecure PLCs because there was no secure one they could buy."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
1/14/2014 | 7:30:08 AM
re: SCADA Password-Cracking Tool For Siemens S7 PLCs Released
we have siemens plc s7 2000 cpu.i want up loud program for backup but he show posward err
Register for Dark Reading Newsletters
White Papers
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

Published: 2014-04-23
The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.

Published: 2014-04-23
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.

Published: 2014-04-23
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.

Published: 2014-04-23
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.

Best of the Web