Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/8/2019
02:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Siemens S7 PLCs Share Same Crypto Key Pair, Researchers Find

Researchers at Black Hat USA reveal how security authentication weaknesses in popular Siemens ICS family let them control a PLC.

BLACK HAT USA — Las Vegas — Security researchers who built a phony engineering workstation that was able to dupe  and alter — operations of the Siemens S7 programmable logic controller (PLC) found that modern S7 PLC families running the same firmware also share the same public cryptographic key, leaving the devices vulnerable to attacks like the ones they simulated.

"All PLCs of the same model have the same key, which means if you crack one, you've cracked all of them," said Avishai Wool, a professor at Tel Aviv University's School of Electrical Engineering, of the S7-1500 PLCs he and his fellow researchers studied. "So if you are able to talk to one of them, you are able to talk to all of them." 

Wool, Eli Biham and Sara Bitan of Technion, and Uriel Malin of Tel Aviv University reverse-engineered the S7's cryptographic protocol and were able to attack the S7-1500 PLC with a fake engineering workstation posing as a Siemens TIA (Totally Automated Integration Portation) system that forced the S7 to power on and off and follow other commands, as well as download rogue code. An attacker sending a rogue command to the PLC could cause a disruption to a plant's physical process, the researchers said.

They gained control of the PLC by surreptitiously downloading rogue command logic to the S7 PLC and hid it so that it was unnoticeable to an engineer. If the engineer were to check the code, he or she would only see the legitimate PLC source code, unaware of the malicious code running in the background and controlling the PLC.

The security weakness here is that in the S7 cryptographic handshake, the TIA does not authenticate to the PLC, according to Wool and Biham. The PLC just authenticates to the TIA, which allowed them to operate the fake TIA engineering workstation.

Overall, the Siemens S7 cryptographic protocol basically falls short, according to Biham, due to its key pair issue. "It authenticates only the device family, not the devices themselves. So it becomes quite easy to impersonate whatever side you wish, especially when you look at the engineering station," Biham said.

The researchers here today will detail the Siemens security issues, which they reported to the PLC vendor.

Turn on S7 'Access Protection'
Siemens recommends that its S7 customers activate the Access Protection security feature, which it said helps protect against the unauthorized changes to the PLC. "No update is necessary," a Siemens spokesperson told Dark Reading.

The company did not specifically confirm that it would alter the S7 protocol to address the security issue Wool and Biham's teams uncovered, but said it's looking at updates: "Siemens constantly enhances the security of its products. Further steps to improve security of the communication are under consideration," the company said.

Attacks exploiting the S7's crypto weaknesses would require a well-resourced threat group to pull it off, Wool and Biham note. It took them several years of work, with teams of crypto and ICS SCADA security experts. And Siemens' protocols are proprietary and not documented publicly, so they had to reverse-engineer them. "Siemens also modified their protocols and software a number of times over the years" while the researchers were studying it, Wool said. So some of their early work actually became obsolete with new updates.

Jacob Baines, principal researcher at Tenable, whose team recently hacked a Siemens TIA workstation, calls the research "impressive."

"But I'm sure it took months of research and reverse-engineering and required them to build upon years of experience in SCADA and network security," Baines said. "To actually deploy such an attack at an ICS plant, assuming the plant follows the most basic physical and network security, would be incredibly difficult."

The researchers said the S7's authentication weaknesses could be improved by ensuring each TIA has its own private key, while the PLC retains and shares the public key. Or the Siemens PLC and TIA could be configured to use a pairing mode using a shared secret.

To prevent an attacker from attacking the PLC and installing malicious code, the PLC should activate a password-protected mode on each PLC, they said. In addition, the shared key pair for the Siemens PLCs leaves them vulnerable to attacks, so the S7 crypto protocol should be updated to address the weaknesses and prevent these attacks, they said.

But like any other industrial system update, it's not a given that plants will be able to install any upcoming Siemens S7 patches or updates given the risk of potentially disrupting operations. "Every deployment, especially in SCADA, is different. Patch cycles can be very long. Given the varied nature of patch cycles, I can't speculate as to how many customers are likely to apply updates," Tenable's Baines said.

Meanwhile, Siemens said it will publish "further information regarding product security" on its Siemens ProductCERT site.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15138
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
CVE-2019-6145
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
CVE-2019-6649
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.
CVE-2019-6650
PUBLISHED: 2019-09-20
F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensitive information and allow the system configuration to be modified when using non-default settings.
CVE-2014-10396
PUBLISHED: 2019-09-20
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.