PLC-BLASTER

Recommendations

Info

Fun with Attribute Blocks I ● Data redundancy creates attack surface 00000901 03 00 04 00 02 f0 00 72 02 05 a9 31 00 00 04 ca .......r ...1.... 00000911 00 00 00 1d 00 00 03 a2 34 00 00 00 03 00 04 00 ........ 4....... 00000921 00 00 00 00 a1 8a 32 00 01 94 57 20 00 a3 81 69 ......2. ..W ...i . . . . 00000C71 53 77 65 65 70 20 28 43 79 63 6c 65 29 22 00 a3 Sweep (C ycle)".. 00000C81 93 59 00 03 00 01 a3 93 5a 00 01 00 a3 93 5b 00 .Y...... Z.....[. Which one is evaluated by Siemens? Both! Black Hat Asia 2016: <strong>PLC</strong>-Blaster 24
Fun with Attribute Blocks I ● ● ● ● Allows you to download hidden blocks Choose an existing blocknumber TIA Portal recognizes only the original block Not working with data blocks Black Hat Asia 2016: <strong>PLC</strong>-Blaster 25
Page 1 and 2: PLC-BLASTER A Worm Living Solely in
Page 3 and 4: S7-1211 ● ● ● ● ● Built f
Page 5 and 6: Program Organization Blocks ● OB
Page 7 and 8: Worm ● ● ● ● Target discove
Page 9 and 10: Target Discovery II IF "data".con_s
Page 11 and 12: Worm ● ● ● ● Target discove
Page 13 and 14: Protocol Analysis I ● S7CommPlus
Page 15 and 16: Protocol Analysis III Message 1: Co
Page 17 and 18: Attribute-Blocks II Datatype Attrib
Page 19 and 20: Anti-Replay Mechanism Message 2: Co
Page 21 and 22: Transfer a Program Message: Downloa
Page 23: Fun with Attribute Blocks I ● Dat
Page 27 and 28: Fun with Attribute Blocks II ●
Page 29 and 30: Implement the Worm ● ● ● ●
Page 31 and 32: Activation ● ● ● ● OB (Orga
Page 33 and 34: Payloads ● ● ● DoS Arbitrary
Page 35 and 36: Demonstration Attacker Injection C&
Page 37 and 38: Demonstration Attacker C&C Server C
Page 39 and 40: Impact on the PLC II ● Memory usa
Page 41 and 42: Persistence & Identification ●
Page 43 and 44: Black Hat Asia 2016: PLC-Blaster 43
Page 45 and 46: Knowhow Protection ● ● ● Prev
Page 47 and 48: Knowhow Protection III ● ● Key
Page 49 and 50: Copy Proection ● ● ● ● ●
Page 51 and 52: Improvements & Recommendations ●
Page 53 and 54: Test Test Siemens● S7-1200 Ja Ja
Page 55 and 56: Test Test Leading Vendors Supportin
Page 57: Q&A http://opensource-security.de i

PLC-BLASTER

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?