00:00:00.167-->00:00:05.172 >>Hello everyone thanks for coming. So this is a talk about the 7 S7Comm Plus protocol and 00:00:08.242-->00:00:13.947 the work is uh is mainly done by my colleague uh Cheng Lei but he's unfortunately to get with 00:00:13.947-->00:00:18.952 uh in time so I stand for him here. Uh first uh let's see some related work. Dillon had a talk 00:00:25.726-->00:00:30.731 about uh his exploit siemens S7 PLC at uh Blackhat uh 2011 and the the protocol he discussed is 00:00:36.203-->00:00:41.208 the S7Comm. Ralf has a talk about a a worm living solely in the PLC last year and then the 00:00:45.746-->00:00:50.751 protocol he discussed is the early which you know S7Comm Plus not this talk is mainly focused 00:00:56.189-->00:01:01.128 on the current protocol s7 Plus which is encrypted. So what is a PLC? PLC is responsible for 00:01:04.264-->00:01:06.266 process control in industrial control system. A PLC contains a CPU some IO modules, some 00:01:06.266-->00:01:08.268 communication modules, and uh some process modules etc. Now this is a picture of the Siemens 00:01:08.268-->00:01:10.270 PLC. Uh Siemens named his PLC s7 08 the 7 200 or 300 and 400 uh using the S7Comm protocol. Um 00:01:10.270-->00:01:12.272 s71000 200 version 3 using the early version of the s7Comm Plus protocol and the s7 100 uh 1000 00:01:12.272-->00:01:17.277 200 v4 and uh 1500 using the current version of s7comm plus protocol which is encrypted. 00:01:40.534-->00:01:45.539 That is the protocol we are discussing today. To communicate with the PLC siemens provided a 00:02:02.856-->00:02:07.861 TIA Portal software which can be used to configure and program the Siemens PLC. So there's a 00:02:26.013-->00:02:28.548 prog program to add uh either a communicator with the PLC with the uh sur- network. So there 00:02:28.548-->00:02:31.151 can be a replay attack. One can capture and uh replay the packets communicate through the 00:02:31.151-->00:02:36.156 PLC and the PC to control the PLC. So let's see the s7Comm Plus protocol for detail. First 00:03:04.251-->00:03:09.256 the um the TIA portal will send a connection request to a packet. This packet oops, this 00:03:18.198-->00:03:23.203 packet here had to be discussed uh before so I won't discuss the detail here. Then the PLC will 00:03:30.877-->00:03:35.882 return a connection response packet here. There are 2 part needed to be noticed. Uh I mark 00:03:41.822-->00:03:46.827 it with the red and the pink. Uh and I will explain later. Then the PCU will send the connection 00:03:53.867-->00:03:58.872 request to the second time to complete the connection. There is a 2 encrypting parts which 00:04:11.618-->00:04:16.623 are important for the protocol. I also mark them with a pink and uh blue rectangle uh and uh also 00:04:20.894-->00:04:25.899 I will explain later. After that the connection is uh built uh so the function packet can be sent 00:04:37.511-->00:04:42.516 from the PC to the PLC uh it's easy as somehow of uh uh packet to stop the PLC. Uh the 00:04:51.992-->00:04:56.997 important uh is also marked with uh uh green rectangle here. [coughing] So uh I will set 00:05:03.436-->00:05:08.441 aside uh [inaudible word] some part needed to be noticed because say uh this part will be 00:05:12.379-->00:05:17.384 used to validate the packet the master beat uh right value to to go through the validation and 00:05:23.390-->00:05:28.395 the excluded function. First let's there are 2 ID's, the session ID and the object ID. 00:05:30.697-->00:05:35.702 The session ID was returned from the PLC and it's assumed to be a random date and the object uh ID 00:05:38.538-->00:05:42.342 should be the send from the PC. It should be so so sorry sorry. The object ID is sent from the 00:05:42.342-->00:05:47.347 the PLC uh it's the random value and the session ID should be sent from the PC to the PLC to 00:05:53.920-->00:05:58.925 validate the session. IT should be the object ID plus plus 100 uh 28. Then comes the encryption 00:06:21.915-->00:06:26.920 part. [sighs] and here's the the first uh packet uh come from the PC to the PLC. There has 2 part 00:06:38.265-->00:06:43.270 that needed to be encryption and uh the part 1 was uh the encryption part of the function 00:06:52.479-->00:06:57.484 packet there's only part which is encrypted uh and I'll explain how they are created. First 00:07:03.990-->00:07:08.995 there is the the first uh encryption part of the connection packet. The input is 00:07:22.175-->00:07:27.180 the encrypt the is the or random random value of that come from the PLC through the connection 00:07:30.684-->00:07:35.689 respon responsible packet. [sighs] and and the the encryption is just uh uh simple 00:07:42.762-->00:07:47.767 XOR. NOw you can see this is the value come from the packet of the connection response packet. 00:07:56.609-->00:08:01.548 And this is the encryption function is just a simple XOR and the result is the first uh 00:08:04.851-->00:08:09.856 encryption which is used in the second encryption. NOw the this is the second encryption part. 00:08:17.964-->00:08:22.969 It use uh input parameter to algorithm to to do this uh encryption. So you can see this 00:08:31.378-->00:08:36.383 is the first uh encryption part which is calculated uh from the XOR and this is the second uh 00:08:43.990-->00:08:48.995 encryption function is uh an complicated uh private algorithm but it can be reverse engineered 00:08:52.499-->00:08:57.504 from from the TR TI [inaudible word] So this uh this function was used to encrypt and we 00:09:03.143-->00:09:08.148 gathered a second encryption part. Now is the function packet encryption part. You use a fixed 00:09:18.191-->00:09:23.196 field array with the session ID is the input and also a complex algorithm is used to calculate 00:09:28.368-->00:09:33.373 uh the corruption result. So you can see this here is the constant array with the session 00:09:37.210-->00:09:42.215 ID and uh this is the en encryption function which is um private algorithm and this is 00:09:47.520-->00:09:52.525 the result which it can be can be seen the in the function packet. So with all this we can 00:10:00.500-->00:10:05.505 gather uh home apple with the communication. Uh first uh the first [inaudible word] packet 00:10:09.275-->00:10:14.280 was the TCP connection and it send the PCU you sends the connection request packet and 00:10:18.485-->00:10:23.490 the PLC returns the connection responsible packet and then the second uh connection request uh 00:10:26.326-->00:10:31.331 packet after that the the connection of for S7Comm Plus Protocol is is established so 00:10:36.669-->00:10:41.674 the PCU can send the function packet and uh do the control work. Uh now we can see them 00:10:46.679-->00:10:51.684 both. Now you can see there is a siemens S7 PLC, a hub and PC. The PC and the PLC is connecting 00:11:52.145-->00:11:57.150 through the hub. Now here's a program we make to control the PLC. First we click the uh 00:12:14.968-->00:12:19.973 connection button and then to establish the connection so the wireshark you can see the 00:12:28.948-->00:12:33.953 connection is established and the information of the PLC is uh returned. Now the now the light 00:12:54.040-->00:12:59.045 is green means that uh the the PLC is running now. We click the stop button to stop the PLC. The 00:13:14.027-->00:13:19.032 light turns to yellow means that the PLC has stopped. [sigh] and then we click the run button to 00:13:32.111-->00:13:37.116 run the PLC again and see the light uh return to green now. Means that uh the PLC is running 00:13:47.593-->00:13:52.598 again. Okay [sigh] let's return to the slide. Uh finally we argue some protection suggest uh 00:14:15.021-->00:14:20.026 first from the coding lab or mmm uh we we think uh the Siemens S7 Comm Plus Protocol uses some 00:14:28.568-->00:14:33.573 private algorithms to make the encryption secret is not a good idea. It uses some uh it 00:14:39.412-->00:14:44.417 shouldn't use some iuh really encryption algorithm to do this work and uh next in the design 00:14:48.855-->00:14:53.860 level uh the [coughing] uh uh uh in the in the in the design level it says should chose some 00:15:08.007-->00:15:13.012 encryption algorithms like RSA or or something like to do the encryption. Finally in the 00:15:18.050-->00:15:24.457 protocol level the whole packet should be encrypted and not just some key part of of of the 00:15:24.457-->00:15:29.462 packet uh uh that's all, thank you. [applause]