Siemens Plc Password Crack

Sergey Gordeychik, a researcher with Positive Technologies, last week at the S4 2013 conference in Miami released the proof-of-concept tool that brute-force hacks the challenge-response information from a TCP/IP traffic exchange. The tool demonstrates how an attacker on an adjacent network could grab credentials for the PLCs simply by brute-force hacking for passwords.S7 is the protocol used for communicating among engineering systems, SCADA, HMI, and PLC equipment, and can be password-protected. "We wrote two brute-force authentications for S7," Gordeychik says.Siemens was the target of much of the vulnerability research at last week's conference, where another researcher also demonstrated how to intercept S7-400 PLC passwords. Erik Johansson, an independent consultant and researcher at the Royal Institute of Technology in Sweden, demonstrated how unpatched S7 systems are susceptible to attack and control by an unauthorized user who grabs their passwords. Siemens described the flaw as a security "weakness in the programming and configuration client software authentication method" that the S7 employs.As one of the most prevalent vendors in the SCADA/ICS world, Siemens has been under the microscope of security researchers ever since it was revealed in 2010 that the Stuxnet attack zeroed in on its process control system products. The vendor, for the most part, has issued patches in response to bugs that are publicly reported, and also has begun updating its product families with more built-in security features as well as better-written code.ICS-CERT issued a security alert about the password-cracker after Gordeychik's presentation last week. "ICS-CERT has notified the affected vendor of the report and has asked the vendor to confirm the attack vector and identify mitigations. ICS-CERT is issuing this alert to provide early notice of the report and identify baseline mitigations for reducing risks to these and other cybersecurity attacks," the alert says.[Researcher Dillon Beresford shows holes in Siemens programmable logic controllers (PLCs) that could lead to attacks. See Siemens Shows Up For Black Hat Demo Of SCADA Hack.]Dr. Tobias Limmer of Siemens Product CERT team says the free tool doesn't go after any particular vulnerability in the S7 PLC. "This is not a vulnerability," Limmer says. "It's ... a tool that tries to get the password on" the PLCs, he says. "We don't need to release a patch" for this, he says.Protection against password-cracking, he says, requires using strong passwords. "Eight characters is not enough," Limmer says. "The password should be as long as possible. If it's a good password, you should be protected."ICS-CERT in its advisory recommends that control system devices don't directly face the Internet, sit behind firewalls, and are isolated from the corporate network. Remote access should be allowed only via virtual private networks, the advisory says.Positive Security's Gordeychik also pointed out vulnerabilities his team had discovered in other Siemens products, many of which have since been fixed by the vendor. He says the team found bugs in Simatic WinCC 7.X, Simatic WinCC Flexible HMI software for hardware panels, TIA Portal, KTP Family of HMI panels, and S7 PLCs.The vulnerabilities can be used for stealing information, running code on an operator workstation in client- or server-side attacks, reading files, grabbing and resetting passwords, uploading custom code to PLCs, and decrypting secured communications, he says.Meanwhile, Gordeychik says the quality of security patches coming from Siemens has improved. "Previously, they were not quite that good. Now they are implementing an internal patch review process ... to see if that patch really patches something," for example, he says.But most organizations don't bother patching. SCADA security experts estimate that about 10 to 20 percent of organizations today actually install patches that their vendors release."That's actually a huge problem," Siemens' Limmer says. He says that Siemens is working on ways to make patching easier on its customers, but would not elaborate on just what that would entail."Our goal is to help the customer out and find the best solution and help them in this patching problem," he says.But patching and best practices are obviously just one part of the equation in SCADA security. "The first step is for vendors to offer products that are secure, especially on the controller side," says Dale Peterson, CEO of Digital Bond, which sponsored the S4 conference. "Then owners/operators [of industrial communications systems] will have a choice. But I have some customers who are upgrading their PLCs and had to buy insecure PLCs because there was no secure one they could buy."Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Siemens Plc Password Crack

A threat actor is targeting industrial engineers and operators with trojanized password-cracking software for programmable logic controllers (PLCs) and human-machine interfaces (HMIs), exploiting their pressing needs to turn industrial workstations into dangerous bots.

According to Dragos researchers, the adversary seems not to be interested in disrupting industrial processes but making money. The password-cracking software also carries a dropper that infects the machine with Sality malware, which:

Several websites and multiple social media accounts are touting password-cracking software for PLCs, HMIs and project files, Dragos researchers have found. These appear to be tailor-made to work on PLCs and HMIs by AutomationDirect, Omron, Siemens, ABB, Delta Automation, Fuji Electric, Mitsubishi Electric, Pro-Face, Vigor Electric, Weintek, Allen-Bradley, Panasonic, Fatek, IDEC Corp., and LG.

Tools advertised as being capable of cracking passwords for HMIs, PLCs and other industrial products have been found to exploit a zero-day vulnerability, and threat actors are using these tools to deliver malware.

Dragos has investigated a tool designed for DirectLogic PLCs from AutomationDirect, but the same threat actor also offers password cracking software for several other products from Omron, Siemens, ABB, Delta Automation, Fuji Electric, Mitsubishi Electric, Pro-face (Schneider Electric), Vigor, Allen-Bradley (Rockwell Automation), Panasonic, LG, Fatek, and IDEC.

Multiple accounts across a variety of social media websites are advertising Programmable Logic Controller (PLC), Human-Machine Interface (HMI), and project file password cracking software. Buyers can retrieve forgotten passwords by running an executable provided by the seller that targets a specific industrial system.

Previous research targeting DirectLogic PLCs has resulted in successful cracking techniques. However, Dragos found that this exploit does not crack a scrambled version of the password as historically seen in popular exploitation frameworks. Instead, a specific byte sequence is sent by the malware dropper to a COM port.

Sality is a peer-to-peer botnet for distributed computing tasks such as password cracking and cryptocurrency mining. A Sality infection could risk remote access to an EWS by an unknown adversary. Dragos assesses with moderate confidence the adversary, while having the capability to disrupt industrial processes, has financial motivation and may not directly impact Operational Technology (OT) processes.

Physical layer also includes wireless communication e.g. WiFi and radio frequency (RF). Drive by wireless scans involve picking up service set identifiers (SSID) and encryption standard (usually WPA or WPA2) and attempt to crack it.

According to two researchers who spent the past few months analyzing the Chrome-powered Cr-48 beta released in December, the browser-based OS is vulnerable to many of the same serious attacks that afflict people surfing websites. As a result, users remain susceptible to exploits that can intercept email, documents, and passwords stored on centralized servers, many of which are maintained by Google 041b061a72