Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/8/2019
02:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Siemens S7 PLCs Share Same Crypto Key Pair, Researchers Find

Researchers at Black Hat USA reveal how security authentication weaknesses in popular Siemens ICS family let them control a PLC.

BLACK HAT USA — Las Vegas — Security researchers who built a phony engineering workstation that was able to dupe  and alter — operations of the Siemens S7 programmable logic controller (PLC) found that modern S7 PLC families running the same firmware also share the same public cryptographic key, leaving the devices vulnerable to attacks like the ones they simulated.

"All PLCs of the same model have the same key, which means if you crack one, you've cracked all of them," said Avishai Wool, a professor at Tel Aviv University's School of Electrical Engineering, of the S7-1500 PLCs he and his fellow researchers studied. "So if you are able to talk to one of them, you are able to talk to all of them." 

Wool, Eli Biham and Sara Bitan of Technion, and Uriel Malin of Tel Aviv University reverse-engineered the S7's cryptographic protocol and were able to attack the S7-1500 PLC with a fake engineering workstation posing as a Siemens TIA (Totally Automated Integration Portation) system that forced the S7 to power on and off and follow other commands, as well as download rogue code. An attacker sending a rogue command to the PLC could cause a disruption to a plant's physical process, the researchers said.

They gained control of the PLC by surreptitiously downloading rogue command logic to the S7 PLC and hid it so that it was unnoticeable to an engineer. If the engineer were to check the code, he or she would only see the legitimate PLC source code, unaware of the malicious code running in the background and controlling the PLC.

The security weakness here is that in the S7 cryptographic handshake, the TIA does not authenticate to the PLC, according to Wool and Biham. The PLC just authenticates to the TIA, which allowed them to operate the fake TIA engineering workstation.

Overall, the Siemens S7 cryptographic protocol basically falls short, according to Biham, due to its key pair issue. "It authenticates only the device family, not the devices themselves. So it becomes quite easy to impersonate whatever side you wish, especially when you look at the engineering station," Biham said.

The researchers here today will detail the Siemens security issues, which they reported to the PLC vendor.

Turn on S7 'Access Protection'
Siemens recommends that its S7 customers activate the Access Protection security feature, which it said helps protect against the unauthorized changes to the PLC. "No update is necessary," a Siemens spokesperson told Dark Reading.

The company did not specifically confirm that it would alter the S7 protocol to address the security issue Wool and Biham's teams uncovered, but said it's looking at updates: "Siemens constantly enhances the security of its products. Further steps to improve security of the communication are under consideration," the company said.

Attacks exploiting the S7's crypto weaknesses would require a well-resourced threat group to pull it off, Wool and Biham note. It took them several years of work, with teams of crypto and ICS SCADA security experts. And Siemens' protocols are proprietary and not documented publicly, so they had to reverse-engineer them. "Siemens also modified their protocols and software a number of times over the years" while the researchers were studying it, Wool said. So some of their early work actually became obsolete with new updates.

Jacob Baines, principal researcher at Tenable, whose team recently hacked a Siemens TIA workstation, calls the research "impressive."

"But I'm sure it took months of research and reverse-engineering and required them to build upon years of experience in SCADA and network security," Baines said. "To actually deploy such an attack at an ICS plant, assuming the plant follows the most basic physical and network security, would be incredibly difficult."

The researchers said the S7's authentication weaknesses could be improved by ensuring each TIA has its own private key, while the PLC retains and shares the public key. Or the Siemens PLC and TIA could be configured to use a pairing mode using a shared secret.

To prevent an attacker from attacking the PLC and installing malicious code, the PLC should activate a password-protected mode on each PLC, they said. In addition, the shared key pair for the Siemens PLCs leaves them vulnerable to attacks, so the S7 crypto protocol should be updated to address the weaknesses and prevent these attacks, they said.

But like any other industrial system update, it's not a given that plants will be able to install any upcoming Siemens S7 patches or updates given the risk of potentially disrupting operations. "Every deployment, especially in SCADA, is different. Patch cycles can be very long. Given the varied nature of patch cycles, I can't speculate as to how many customers are likely to apply updates," Tenable's Baines said.

Meanwhile, Siemens said it will publish "further information regarding product security" on its Siemens ProductCERT site.

Related Content:

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19645
PUBLISHED: 2019-12-09
alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
CVE-2019-19678
PUBLISHED: 2019-12-09
In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the generic field entry point via the Generic Test Definition field of a new Generic Test issue.
CVE-2019-19679
PUBLISHED: 2019-12-09
In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the Pre-Condition Summary entry point via the summary field of a Create Pre-Condition action for a new Test Issue.
CVE-2019-19647
PUBLISHED: 2019-12-09
radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted input.
CVE-2019-19648
PUBLISHED: 2019-12-09
In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size. A specially crafted MachO file can cause an out-of-bounds memory access, resulting in Denial of Service (application crash) or potential code execution.