Fuzzing and Breaking Security Functions of SIMATIC PLCs
summary
Claims cracking TLS on S7‑1500/S7‑1200 and extracting keys to build a rogue engineer station that performs S7‑1500 run stop upload project and modify control logic; describes a mutation‑based TLS fuzzer and a custom automated fuzzing platform with power cycling and LED/crash detection that discovers 3 disclosed vulnerabilities (Siemens patches Feb 2022) including a crash that allows remote denial and an access‑protection bypass method tied to captured TLS traffic and PBKDF2/password hash handling.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 2:55SIMATIC PLC architecture overview
- 9:03S7-Plus TLS security
- 12:39Reverse-engineered PLC control demo
- 14:12Bypassing S7-Plus access
- 15:56Fuzzing methodology for PLCs
- 16:41Mutation strategies and setup
- 20:40Automated fuzzing platform
- 22:32Automated fuzzing demo
- 23:18Vulnerabilities and impact
- 25:52Securing SIMATIC PLCs
- 26:59Summary and future research
- 28:03Q&A
related talks
44mRogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
39mA Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven
29mThe Spear to Break the Security Wall of S7Commplus
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
58mIndustrial Control Systems : Pentesting PLCs 101 (Part 1/2)
40mHacking Mitsubishi PLC Without Access To Firmware
39mIn-Field Emulation & Fuzzing of PLCs to Uncover the Next Zero-Day in Industrial Control Systems
19mIoT Security Exposed: From PLC Flaws to the Imperative of SBOM