Siemens S7 PLCs Share Same Crypto Key Pair, Researchers Find

BLACK HAT USA — Las Vegas — Security researchers who built a phony engineering workstation that was able to dupe — and alter — operations of the Siemens S7 programmable logic controller (PLC) found that modern S7 PLC families running the same firmware also share the same public cryptographic key, leaving the devices vulnerable to attacks like the ones they simulated.

"All PLCs of the same model have the same key, which means if you crack one, you've cracked all of them," said Avishai Wool, a professor at Tel Aviv University's School of Electrical Engineering, of the S7-1500 PLCs he and his fellow researchers studied. "So if you are able to talk to one of them, you are able to talk to all of them." 

Wool, Eli Biham and Sara Bitan of Technion, and Uriel Malin of Tel Aviv University reverse-engineered the S7's cryptographic protocol and were able to attack the S7-1500 PLC with a fake engineering workstation posing as a Siemens TIA (Totally Automated Integration Portation) system that forced the S7 to power on and off and follow other commands, as well as download rogue code. An attacker sending a rogue command to the PLC could cause a disruption to a plant's physical process, the researchers said.

They gained control of the PLC by surreptitiously downloading rogue command logic to the S7 PLC and hid it so that it was unnoticeable to an engineer. If the engineer were to check the code, he or she would only see the legitimate PLC source code, unaware of the malicious code running in the background and controlling the PLC.

The security weakness here is that in the S7 cryptographic handshake, the TIA does not authenticate to the PLC, according to Wool and Biham. The PLC just authenticates to the TIA, which allowed them to operate the fake TIA engineering workstation.

Overall, the Siemens S7 cryptographic protocol basically falls short, according to Biham, due to its key pair issue. "It authenticates only the device family, not the devices themselves. So it becomes quite easy to impersonate whatever side you wish, especially when you look at the engineering station," Biham said.

The researchers here today will detail the Siemens security issues, which they reported to the PLC vendor.

Turn on S7 'Access Protection'
Siemens recommends that its S7 customers activate the Access Protection security feature, which it said helps protect against the unauthorized changes to the PLC. "No update is necessary," a Siemens spokesperson told Dark Reading.

The company did not specifically confirm that it would alter the S7 protocol to address the security issue Wool and Biham's teams uncovered, but said it's looking at updates: "Siemens constantly enhances the security of its products. Further steps to improve security of the communication are under consideration," the company said.

Attacks exploiting the S7's crypto weaknesses would require a well-resourced threat group to pull it off, Wool and Biham note. It took them several years of work, with teams of crypto and ICS SCADA security experts. And Siemens' protocols are proprietary and not documented publicly, so they had to reverse-engineer them. "Siemens also modified their protocols and software a number of times over the years" while the researchers were studying it, Wool said. So some of their early work actually became obsolete with new updates.

Jacob Baines, principal researcher at Tenable, whose team recently hacked a Siemens TIA workstation, calls the research "impressive."

"But I'm sure it took months of research and reverse-engineering and required them to build upon years of experience in SCADA and network security," Baines said. "To actually deploy such an attack at an ICS plant, assuming the plant follows the most basic physical and network security, would be incredibly difficult."

The researchers said the S7's authentication weaknesses could be improved by ensuring each TIA has its own private key, while the PLC retains and shares the public key. Or the Siemens PLC and TIA could be configured to use a pairing mode using a shared secret.

To prevent an attacker from attacking the PLC and installing malicious code, the PLC should activate a password-protected mode on each PLC, they said. In addition, the shared key pair for the Siemens PLCs leaves them vulnerable to attacks, so the S7 crypto protocol should be updated to address the weaknesses and prevent these attacks, they said.

But like any other industrial system update, it's not a given that plants will be able to install any upcoming Siemens S7 patches or updates given the risk of potentially disrupting operations. "Every deployment, especially in SCADA, is different. Patch cycles can be very long. Given the varied nature of patch cycles, I can't speculate as to how many customers are likely to apply updates," Tenable's Baines said.

Meanwhile, Siemens said it will publish "further information regarding product security" on its Siemens ProductCERT site.

Related Content: