Hacking for Future Security

Researchers from the Technion and Tel Aviv University succeeded in gaining control of one of the world’s most secure industrial programmable logic controller (PLC)

As part of the attack, the researchers managed to turn the controller on and off, download rogue command logic, and change the operating and source codes. Moreover, they succeeded in creating a situation in which the engineer operating the controller did not recognize their “hostile intervention.”

The attack on the Siemens Simatic S7 controller will be presented TODAY at the prestigious Black Hat Hacking Conference.

The Siemens Simatic S7 controller

Researchers from the Technion–Israel Institute of Technology and Tel Aviv University, in collaboration with Israel National Cyber Directorate have managed to take control of a Siemens PLC, which is considered to be one of the safest controllers in the world. They will present the attack at the prestigious Black Hat Conference in Las Vegas on August 8. 

A version of the paper was sent in advance to Siemens so that it could fix the vulnerabilities found.

The attack was led by Professor Eli Biham, the head of the Hiroshi Fujiwara Cyber Security Research Center at the Technion and Dr. Sara Bitan, from the Technion’s Faculty of Computer Science, and Professor Avishai Wool of the School of Electrical Engineering at Tel Aviv University, together with the students Aviad Carmel, Alon Dankner and Uriel Malin.

As part of the attack, the researchers analyzed and identified the code elements of the Siemens proprietary cryptographic protocol, and on the basis of their analysis, created a fake engineering station, an alternative to Siemens’ official station. The fake engineering station was able to command the controller according to the will of the attackers. They were able to turn the controller on and off, download rogue command logic according to their wishes, and change the operation and source codes. They also succeeded in creating a situation in which the engineer operating the controller did not recognize their “hostile intervention.”

Professor Eli Biham from the Technion’s Faculty of Computer Science

The research leading to the attack focused on Siemens S7 Simatic systems, a series of programmable logic controllers. PLCs are currently used in a wide spectrum of operations that include critical infrastructures such as power stations, water pumps, building controls, production lines, lighting systems, vehicles, aircraft, automatic irrigation, and smart homes. Their main goal is automatic process control that optimally responds to environmental conditions and changes. The controllers receive instructions from a computer and operate the relevant terminal equipment for the operator: sensors, motors, traffic lights, and more. 

The new generations of the Simatic S7 family are considered safer and more protected than their predecessors, mainly due to improvements in the quality of encryption. Therefore, attacks on them constitute a complex challenge that requires extensive knowledge in various fields.

Since Siemens does not publish the protocol of operation of the controllers, the researchers recreated the protocol through reverse-engineering. According to Prof. Wool, this part of “detective work” took many months.

After the protocol was reconstructed, the researchers went on to map the security and encryption systems of the controller and detect weaknesses in these systems. Indeed, they were able to determine common keys with the controller and through them impersonate a legitimate engineering station from the point of view of the controller.

Professor Avishai Wool of the School of Electrical Engineering at Tel Aviv University

All this allowed them to load the controller malware despite the cryptographic security inherent in the systems. According to Prof. Biham, “this was a complex challenge because of the improvements that Siemens introduced in newer versions of Simatic controllers. Our success is linked to our vast experience in the study of controllers and their security and in combination with our in-depth knowledge in several areas – systems understanding, reverse engineering capabilities, communications protocol analysis, and cryptographic analysis.”

Dr. Bitan noted that the attack underscores the need for investment by both manufacturers and customers in securing industrial control systems. According to her, the attack shows that securing industrial control systems is a more difficult and challenging task than securing information systems.

Mr. Malin and Dr. Bitan will present the research at the prestigious Black Hat Hacking Conference in Las Vegas from 11:00–11:50 a.m. on Thursday, August 8.