Rogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
summary
Demonstrates practical attacks on Simatic S7‑1500 PLCs by abusing weaknesses in the S7 P3 handshake: a single shared PLC public key (the one ring to rule them all) lets a prepared attacker craft key material offline, run a Python rogue engineering station that completes the handshake, and perform a stealth program injection that runs a malicious binary while the PLC still returns the benign source on upload. The team builds a proxy and scripts, successfully infects real S7‑1500 hardware, and notes Siemens’ mitigation advice (use password-based access control) is rarely deployed at scale.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:40Overview
- 2:46The PLC
- 7:21Stuxnet
- 8:52Engineering Workstation
- 10:51S7 1500
- 11:10S7 1200
- 12:15S7 Protocol
- 16:51S7 Ring
- 17:15Program Cycle Object
- 18:21Two Simple Programs
- 18:58Malicious Program
- 19:51Legal Flow
- 21:33Description
- 22:11Setup Phase
- 26:02Raw Engineering Station
- 27:35Conclusion
- 28:55Cryptographic Primitive
- 30:42PLC Public Key
- 31:39PLC Ring
- 33:09Reverse Engineering Tips
- 36:08Runtime Type Information
- 38:11Demonstration
related talks
39mA Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven
29mFuzzing and Breaking Security Functions of SIMATIC PLCs
58mIndustrial Control Systems : Pentesting PLCs 101 (Part 1/2)
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
29mThe Spear to Break the Security Wall of S7Commplus
50mDead Man’s PLC: Ransoming the Physical World via Operational Technology
47mExfiltrating Reconnaissance Data from Air-Gapped ICS/SCADA Networks
40mHacking Mitsubishi PLC Without Access To Firmware