• search hit 171 of 187
Back to Result List

You Are What You Attack: Breaking the Cryptographically-Protected S7 Protocol

  • S7 protocol defines an appropriate format for exchanging messages between SIMATIC S7 PLCs and their corresponding engineering software i.e., TIA Portal. Recently, Siemens has provided its newer PLC models and their proprietary S7 protocols with a very developed and sophisticated integrity check mechanism to protect them from various exploits e.g., replay attacks. This paper addresses exactly this point, and investigates the security of the most developed integrity check mechanism that the newest S7CommPlus protocol version implements. Our results showed that the latest S7 PLC models as well as their related protocols are still vulnerable. We found that adversaries can manipulate two hashes that play a significant role in generating keys and bytes for the encryption processes implemented in the S7CommPlus protocol. This allows to reproduce S7 packets and conduct several attacks that eventually impact the operation of the target PLC and the entire physical process it controls. To validate our findings, we test all the attack scenariosS7 protocol defines an appropriate format for exchanging messages between SIMATIC S7 PLCs and their corresponding engineering software i.e., TIA Portal. Recently, Siemens has provided its newer PLC models and their proprietary S7 protocols with a very developed and sophisticated integrity check mechanism to protect them from various exploits e.g., replay attacks. This paper addresses exactly this point, and investigates the security of the most developed integrity check mechanism that the newest S7CommPlus protocol version implements. Our results showed that the latest S7 PLC models as well as their related protocols are still vulnerable. We found that adversaries can manipulate two hashes that play a significant role in generating keys and bytes for the encryption processes implemented in the S7CommPlus protocol. This allows to reproduce S7 packets and conduct several attacks that eventually impact the operation of the target PLC and the entire physical process it controls. To validate our findings, we test all the attack scenarios presented in this work on a cryptographically protected S7 PLC from the 1500 family which uses the S7CommPlusV3 protocol.show moreshow less

Export metadata

Additional Services

Search Google Scholar
Metadaten
Author: Wael Alsabbagh, Peter LangendörferGND
DOI:https://doi.org/10.1109/WFCS57264.2023.10144251
ISBN:978-1-6654-6432-1
ISBN:978-1-6654-6433-8
ISSN:2835-8414
Title of the source (English):19th International Conference on Factory Communication Systems (WFCS), (2023)
Publisher:IEEE
Document Type:Conference publication peer-reviewed
Language:English
Year of publication:2023
Tag:Industrial Control Systems; Process control; Protocols; S7 Protocol
Number of pages:8
Way of publication:Open Access
Faculty/Chair:Fakultät 1 MINT - Mathematik, Informatik, Physik, Elektro- und Informationstechnik / FG Systeme
Einverstanden ✔
Diese Webseite verwendet technisch erforderliche Session-Cookies. Durch die weitere Nutzung der Webseite stimmen Sie diesem zu. Unsere Datenschutzerklärung finden Sie hier.