SCADA Password-Cracking Tool For Siemens S7 PLCs Released

A Russian security researcher has unleashed a brute-force password-cracking tool that can capture passwords for Siemens S7 programmable logic controllers (PLC), which run machinery in power plants and manufacturing sites.

Sergey Gordeychik, a researcher with Positive Technologies, last week at the S4 2013 conference in Miami released the proof-of-concept tool that brute-force hacks the challenge-response information from a TCP/IP traffic exchange. The tool demonstrates how an attacker on an adjacent network could grab credentials for the PLCs simply by brute-force hacking for passwords.

S7 is the protocol used for communicating among engineering systems, SCADA, HMI, and PLC equipment, and can be password-protected. "We wrote two brute-force authentications for S7," Gordeychik says.

Siemens was the target of much of the vulnerability research at last week's conference, where another researcher also demonstrated how to intercept S7-400 PLC passwords. Erik Johansson, an independent consultant and researcher at the Royal Institute of Technology in Sweden, demonstrated how unpatched S7 systems are susceptible to attack and control by an unauthorized user who grabs their passwords. Siemens described the flaw as a security "weakness in the programming and configuration client software authentication method" that the S7 employs.

As one of the most prevalent vendors in the SCADA/ICS world, Siemens has been under the microscope of security researchers ever since it was revealed in 2010 that the Stuxnet attack zeroed in on its process control system products. The vendor, for the most part, has issued patches in response to bugs that are publicly reported, and also has begun updating its product families with more built-in security features as well as better-written code.

ICS-CERT issued a security alert about the password-cracker after Gordeychik's presentation last week. "ICS-CERT has notified the affected vendor of the report and has asked the vendor to confirm the attack vector and identify mitigations. ICS-CERT is issuing this alert to provide early notice of the report and identify baseline mitigations for reducing risks to these and other cybersecurity attacks," the alert says.

[Researcher Dillon Beresford shows holes in Siemens programmable logic controllers (PLCs) that could lead to attacks. See Siemens Shows Up For Black Hat Demo Of SCADA Hack.]

Dr. Tobias Limmer of Siemens Product CERT team says the free tool doesn't go after any particular vulnerability in the S7 PLC. "This is not a vulnerability," Limmer says. "It's ... a tool that tries to get the password on" the PLCs, he says. "We don't need to release a patch" for this, he says.

Protection against password-cracking, he says, requires using strong passwords. "Eight characters is not enough," Limmer says. "The password should be as long as possible. If it's a good password, you should be protected."

ICS-CERT in its advisory recommends that control system devices don't directly face the Internet, sit behind firewalls, and are isolated from the corporate network. Remote access should be allowed only via virtual private networks, the advisory says.

Positive Security's Gordeychik also pointed out vulnerabilities his team had discovered in other Siemens products, many of which have since been fixed by the vendor. He says the team found bugs in Simatic WinCC 7.X, Simatic WinCC Flexible HMI software for hardware panels, TIA Portal, KTP Family of HMI panels, and S7 PLCs.

The vulnerabilities can be used for stealing information, running code on an operator workstation in client- or server-side attacks, reading files, grabbing and resetting passwords, uploading custom code to PLCs, and decrypting secured communications, he says.

Meanwhile, Gordeychik says the quality of security patches coming from Siemens has improved. "Previously, they were not quite that good. Now they are implementing an internal patch review process ... to see if that patch really patches something," for example, he says.

But most organizations don't bother patching. SCADA security experts estimate that about 10 to 20 percent of organizations today actually install patches that their vendors release.

"That's actually a huge problem," Siemens' Limmer says. He says that Siemens is working on ways to make patching easier on its customers, but would not elaborate on just what that would entail.

"Our goal is to help the customer out and find the best solution and help them in this patching problem," he says.

But patching and best practices are obviously just one part of the equation in SCADA security. "The first step is for vendors to offer products that are secure, especially on the controller side," says Dale Peterson, CEO of Digital Bond, which sponsored the S4 conference. "Then owners/operators [of industrial communications systems] will have a choice. But I have some customers who are upgrading their PLCs and had to buy insecure PLCs because there was no secure one they could buy."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.