Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/5/2011
01:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Siemens Shows Up For Black Hat Demo Of SCADA Hack

NSS Labs researcher Dillon Beresford shows holes in Siemens programmable logic controllers (PLCs) that could lead to attacks

BLACK HAT USA 2011 -- Las Vegas -- A researcher who discovered major holes in Siemens' programmable logic controllers (PLCs) finally got his day on stage to reveal them after having to pull a planned presentation on the vulnerabilities earlier this year due to concerns of possible risk to human life -- and a Siemens computer emergency response team (CERT) member was on hand for the demo here.

Click here for more of Dark Reading's Black Hat articles.

Dillon Beresford, a researcher with NSS Labs, showed a backdoor in Siemens S7-300, S7-400, and S7-1200 devices that allowed him to get inside and capture passwords and reprogram PLC logic in such a way that he could shut down the systems altogether or cause them to eventually crash. He staged a live demonstration of how he could control the Siemens devices, which are used in power and manufacturing plants worldwide.

Beresford had canceled his planned talk at TakedownCon 2011 in Dallas at the eleventh hour amid safety concerns, and provided ICS-CERT and Siemens with details of the vulnerabilities and PoC exploits.

Thomas Brandstetter, acting head of Siemens Product CERT, took the stage at Black Hat briefly with Beresford to confirm that Siemens was working on fixing the flaws in its devices. Brandstetter, who noted that he is not an official corporate Siemens spokesperson, in a press briefing after the talk said the company needs "time to go after those vulnerabilities" and to ensure that any fixes to the products don't negatively impact plant operations.

"Siemens created a product CERT eight months ago to handle vulnerabilities in its products and to work with the security community," Brandstetter said.

Meanwhile, it took Beresford, who says he's no SCADA expert, only about two-and-half hours to write code to exploit the backdoor in the Siemens PLCs. He found a hard-coded password -- "Basisk," German for "basic" -- and was then able to open a command shell: "That allowed me to do other things," such as perform a memory dump, capture passwords, and reprogram the programmable logic, he says.

The backdoor, which likely was put in place for diagnostics purposes, could allow attackers to get inside and perform arbitrary commands on the systems and intercept any communications coming to the PLC, he says. Beresford wrote a Metasploit module for the hack.

In a lighter moment in his research, Beresford says he also found an "Easter egg" of animated dancing monkeys in the Siemens firmware. So he had shirts with the dancing monkeys made for himself and Siemens for Black Hat, and Siemens' Brandstetter gamely wore his to the session, with the word "PWND" emblazoned on the back.

"In the beginning [of the vulnerability disclosure], the Siemens PR team didn't talk to the engineering team," Beresford says, but that has since changed. "I give [Siemens] a lot of credit for not trying to pull my talk."

Beresford says there are plenty of PLCs connected to the Internet, whether operators are aware of them or not. "I'm not here to freak you out. But an attack on PLCs for 24 hours could cause it to blow up a plant," he says.

The bottom line is that it's not that difficult to wrest control of these devices. Beresford says his research debunks theories by experts, such as Ralph Langner, that it would take a major nation-state to pull off a devastating power grid hack. Although Beresford didn't write any exploit code, his proof-of-concept could be easily parlayed into a worm-borne attack similar to the way Stuxnet spread.

"This creates an awareness that not only nation-states [can hack SCADA systems], but it's now in the hands of researchers, and it's only a matter of time," Beresford says. "Someone could use it to cause damage to control systems."

But Beresford's hack is actually more streamlined than Stuxnet was: His went directly at the PLC. "I directly attacked the PLC, unlike Stuxnet," Beresford says. "Stuxnet pivoted off of an engineering workstation. I'm not sure why they did that -- they didn't need to go to that trouble. They probably wanted something on that workstation."

At the heart of the holes in the Siemens devices are the lack of access control to them, which, like other PLC systems, use the 802.3 Ethernet Profibus and Profinet LAN protocols, which communicate via TSAP over TCP Port 102. TSAP transmits packets in plain text, too. TSAP, like TCP, is an older protocol that was not created with security in mind. So it's a matter of PLC manufacturers better locking them down. "The protocols are not broken -- it's the lack of access control," Beresford says.

It's not just Siemens SCADA systems that are at risk of such attacks. Jonathan Pollet, a SCADA security expert and founder and principal consultant at Red Tiger Security, says the threat is "systemic across all PLCs."

The researchers say it's likely these attacks could also work against GE, Rockwell, and other SCADA products that run the same communications protocols. The evolution of open systems and open protocols among these devices has left the door open for malicious activity, Pollet says. "And we don't have the capability to log forensic information in these products," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8216
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8217
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-8218
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8219
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-8220
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions, 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .