The spear to break the security wall of S7CommPlus
Breaking the encryption in Siemens S7CommPlus protocol to control PLC devices despite security reinforcements.
Summary
Industrial Control System Security
Attacks against industrial control systems have increased year over year. The Stuxnet attack in 2010 exploited the insecurity of the S7Comm protocol, prompting Siemens to implement security reinforcements in the S7CommPlus protocol, which includes encryption.
Analyzing the Protocol
The talk uses Wireshark to analyze communications between Siemens TIA Portal and PLC devices. Through reverse debugging with WinDbg and IDA, researchers demonstrate how to break the encryption in the S7CommPlus protocol. The analysis reveals vulnerabilities despite encryption implementation.
Demonstration and Control
The researchers created an MFC program capable of controlling the start and stop of PLCs and modifying digital and analog inputs and outputs. This demonstrates complete control over protected industrial systems.
Security Recommendations
Based on this research, the presentation proposes security improvements at both the code level and protocol level to enhance the protection of Siemens PLC devices against similar attacks.
Related talks
CSIT Village·25 min
Kendrick Yeo · Eugene Ong
Kendrick Yeo and Eugene Ong examines during this session, we will share simulated water testbed, and the attacks that can work on it.
Black Hat·39 min
Michail Maniatakos · Dimitrios Tychalas
Security researchers examine technical aspects of In-Field Emulation & Fuzzing of PLCs to Uncover the Next Zero-Day in Industrial Control Systems.
Black Hat·48 min
Industry experts analyze emerging threats surrounding How TRITON Disrupted Safety Systems & Changed the Threat Landscape of Industrial Control Systems.