A Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven
summary
Reverse engineering produces a decrypted S7‑1500 software‑controller ELF, a Ghidra plugin and QEMU patches on GitHub, and a full reproduction of the handshake so anyone can connect without credentials. Findings: the PLC ships with a single master private key, uses a custom ECC curve and a bespoke modified AES (static round keys, five rounds, reordered/mutated steps), and the researchers can read, write and stop controllers; the TLS fix from 2022 remains barely deployed.
AI-written summary · about
chapters (10)
- 0:00Speakers and PLCs
- 1:22Industrial security context
- 4:29Analyzing S7 communication
- 8:24Research history
- 9:31Firmware decryption
- 12:12Dynamic analysis
- 16:10Static analysis
- 18:51Protocol cryptography
- 28:50Security implications
- 35:17Q&A session
related talks
44mRogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
29mFuzzing and Breaking Security Functions of SIMATIC PLCs
29mThe Spear to Break the Security Wall of S7Commplus
58mIndustrial Control Systems : Pentesting PLCs 101 (Part 1/2)
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
21mOops, It Halted Again: Exploiting PLC Memory for Fun and Profit in Industrial Control...
40mHacking Mitsubishi PLC Without Access To Firmware
48mDoors of Durin: The Veiled Gate to Siemens S7 Silicon