PLC-BLASTER

Recommendations

Info

Target Discovery I ● ● TCP port 102 is open on all S7-PLCs Implement a portscanner – TCON: Open a new TCP connection – TDISCON: Close a TCP connection Black Hat Asia 2016: PLC-Blaster 8
Target Discovery II IF "data".con_state = 10 THEN "TCON_DB"(REQ:="data".action, ID:=1, DONE=>"data".con_done, BUSY=>"data".con_busy, ERROR=>"data".con_error, STATUS=>"data".con_status, CONNECT:="data".con_param); IF "data".con_done = True THEN "data".con_state := 20; "data".con_timeout_counter := 0; ELSE "data".con_timeout_counter := "data".con_timeout_counter + 1; IF "data".con_timeout_counter > 200 THEN "data".con_state := 0; END_IF; END_IF; GOTO CYCLE_END; END_IF; Black Hat Asia 2016: PLC-Blaster 9
Page 1 and 2: PLC-BLASTER A Worm Living Solely in
Page 3 and 4: S7-1211 ● ● ● ● ● Built f
Page 5 and 6: Program Organization Blocks ● OB
Page 7: Worm ● ● ● ● Target discove
Page 11 and 12: Worm ● ● ● ● Target discove
Page 13 and 14: Protocol Analysis I ● S7CommPlus
Page 15 and 16: Protocol Analysis III Message 1: Co
Page 17 and 18: Attribute-Blocks II Datatype Attrib
Page 19 and 20: Anti-Replay Mechanism Message 2: Co
Page 21 and 22: Transfer a Program Message: Downloa
Page 23 and 24: Fun with Attribute Blocks I ● Dat
Page 25 and 26: Fun with Attribute Blocks I ● ●
Page 27 and 28: Fun with Attribute Blocks II ●
Page 29 and 30: Implement the Worm ● ● ● ●
Page 31 and 32: Activation ● ● ● ● OB (Orga
Page 33 and 34: Payloads ● ● ● DoS Arbitrary
Page 35 and 36: Demonstration Attacker Injection C&
Page 37 and 38: Demonstration Attacker C&C Server C
Page 39 and 40: Impact on the PLC II ● Memory usa
Page 41 and 42: Persistence & Identification ●
Page 43 and 44: Black Hat Asia 2016: PLC-Blaster 43
Page 45 and 46: Knowhow Protection ● ● ● Prev
Page 47 and 48: Knowhow Protection III ● ● Key
Page 49 and 50: Copy Proection ● ● ● ● ●
Page 51 and 52: Improvements & Recommendations ●
Page 53 and 54: Test Test Siemens● S7-1200 Ja Ja
Page 55 and 56: Test Test Leading Vendors Supportin
Page 57: Q&A http://opensource-security.de i

PLC-BLASTER

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?