Siemens Joins SCADA Hack Demo At Black Hat

NSS Labs researcher Dillon Beresford shows holes in Siemens programmable logic controllers that could lead to attacks.

Dillon Beresford, a researcher with NSS Labs, showed a backdoor in Siemens S7-300, S7-400, and S7-1200 devices that allowed him to get inside and capture passwords and reprogram programmable logic controller (PLC) logic in such a way that he could shut down the systems altogether or cause them to eventually crash. He staged a live demonstration at
Black Hat
, a UBM TechWeb event in Las Vegas, of how he could control the Siemens devices, which are used in power and manufacturing plants worldwide.
Beresford had
canceled his planned talk at TakedownCon 2011
in Dallas at the eleventh hour amid safety concerns, and provided ICS-CERT and Siemens with details of the vulnerabilities and proof of concept (PoC) exploits.
Thomas Brandstetter, acting head of Siemens product CERT, took the stage at Black Hat briefly with Beresford to confirm that Siemens was working on fixing the flaws in its devices. Brandstetter, who noted that he is not an official corporate Siemens spokesperson, in a press briefing after the talk said the company needs time to go after those
vulnerabilities
and to ensure that any fixes to the products dont negatively impact plant operations.
Siemens created a product CERT eight months ago to handle vulnerabilities in its products and to work with the security community, Brandstetter said.
Meanwhile, it took Beresford, who says hes no
SCADA
(supervisory control and data acquisition) expert, only about two-and-half hours to write code to exploit the backdoor in the Siemens PLCs. He found a hard-coded password--Basisk, German for basic--and was then able to open a command shell: That allowed me to do other things, such as perform a memory dump, capture passwords, and reprogram the programmable logic, he says.
The backdoor, which likely was put in place for diagnostics purposes, could allow attackers to get inside and perform arbitrary commands on the systems and intercept any communications coming to the PLC, he says. Beresford wrote a Metasploit module for the hack.
In a lighter moment in his research, Beresford says he also found an Easter egg of animated dancing monkeys in the Siemens firmware. So he had shirts with the dancing monkeys made for himself and Siemens for Black Hat, and Siemens Brandstetter gamely wore his to the session, with the word PWND emblazoned on the back.
Read the rest of this article on
Dark Reading
.
The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Heres how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own companys security ignores the bigger picture.
Download it now
. (Free registration required.)

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Siemens Joins SCADA Hack Demo At Black Hat