@misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {You Are What You Attack: Breaking the Cryptographically-Protected S7 Protocol}, series = {19th International Conference on Factory Communication Systems (WFCS), (2023)}, journal = {19th International Conference on Factory Communication Systems (WFCS), (2023)}, publisher = {IEEE}, isbn = {978-1-6654-6432-1}, issn = {2835-8414}, doi = {10.1109/WFCS57264.2023.10144251}, pages = {8}, abstract = {S7 protocol defines an appropriate format for exchanging messages between SIMATIC S7 PLCs and their corresponding engineering software i.e., TIA Portal. Recently, Siemens has provided its newer PLC models and their proprietary S7 protocols with a very developed and sophisticated integrity check mechanism to protect them from various exploits e.g., replay attacks. This paper addresses exactly this point, and investigates the security of the most developed integrity check mechanism that the newest S7CommPlus protocol version implements. Our results showed that the latest S7 PLC models as well as their related protocols are still vulnerable. We found that adversaries can manipulate two hashes that play a significant role in generating keys and bytes for the encryption processes implemented in the S7CommPlus protocol. This allows to reproduce S7 packets and conduct several attacks that eventually impact the operation of the target PLC and the entire physical process it controls. To validate our findings, we test all the attack scenarios presented in this work on a cryptographically protected S7 PLC from the 1500 family which uses the S7CommPlusV3 protocol.}, language = {en} } @misc{AlsabbaghKimLangendoerfer, author = {Alsabbagh, Wael and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {No Attacks Are Available: Securing the OpenPLC and Related Systems}, series = {8th GI/ACM Workshop on Industrial Automation and Control Systems (IACS WS 2023), 2085 (2023)}, journal = {8th GI/ACM Workshop on Industrial Automation and Control Systems (IACS WS 2023), 2085 (2023)}, doi = {10.13140/RG.2.2.24570.47043}, pages = {12}, abstract = {The use of Programmable Logic Controllers (PLCs) expands in industrial domains, which makes ensuring the security of Industrial Control Systems (ICSs) become paramount. The OpenPLC project, the first open-source initiative, provides flexible and cost-effective PLC solutions to build up affordable test-beds, as well as conduct experiments and academic researches. This project has wildly grown in the last few years, thus it is essential to address the most emerging security challenges it encounters. This paper introduces a new OpenPLC architecture, called OpenPLC Aqua, provided with a set of security solutions designed specifically to overcome the vulnerabilities that the current OpenPLC versions are prone to. The new OpenPLC architecture includes four security features: 1) user credentials encryption, securing the Webserver, Whitelisting and secure SSL/TLS communication channel. The OpenPLC Aqua software was tested against several attack scenarios, that were feasible against the old OpenPLC versions. Our experimental results showed our enhanced OpenPLC software is secure and resistant against several attack scenarios e.g., authentication, injection, Man-in-the-Middle and replay attacks. The OpenPLC Aqua is publicly available and a proof of concept demo is also published with this paper.}, language = {en} }