Monday, 31 May 2021 13:20

Claroty detects severe memory protection bypass vulnerability in Siemens PLCs, Siemens launches further updates

By

Claroty says the vulnerability in Siemens PLCs may allow an unauthenticated attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch attacks. As a response, Siemens rolls mitigation measures to reduce risks.

Achieving native code execution on an industrial control system such as a programmable logic controller (PLC) is an end-goal relatively few advanced attackers have achieved. These complex systems have numerous in-memory protections that would have to be hurdled in order for an attacker to not only run code of their choice, but also remain undetected, according to Claroty.

Previous work has required physical access and connections to the PLC, or techniques that target engineering workstations and other links to the PLC in order to gain that level of code execution. Claroty, meanwhile, has taken those efforts a step further using a newly-discovered vulnerability that bypasses the PLC sandbox within Siemens’ Simatic S7-1200 and S7-1500 PLC CPUs to run native code in protected areas of memory.

Affected devices are vulnerable to a memory protection bypass through a specific operation. A remote unauthenticated attacker with network access to TCP port 102 could potentially write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks.

This disclosure is an outcome of Siemens and Claroty’s existing partnership, which fosters not only tight cooperation between the research teams and the vendor on disclosures, but also in the security of the overall industrial ecosystem. Siemens has released an official advisory SSA-434534 that notifies its users of this vulnerability, and also released updates for various products, including S7-1500 and S7-1200, that remediate the vulnerability. Users are urged to update to the latest versions.

Siemens says it is preparing further updates for products where updates are not yet available; Siemens also provided specific mitigation measures that users can apply to reduce the risk. Siemens and Claroty wish to emphasise that users apply the S7-1200 and S7-1500 CPU updates as well as those for other affected products given the critical nature of this vulnerability.

Previous work
PLC vulnerability research, from the attacker perspective, is to achieve unrestricted and undetected code execution on the PLC. This means, being able to hide code deep inside the PLC, undetected by the operating system, or any diagnostic software.

Over the years Siemens has seen many attempts to achieve such a capability on Siemens PLCs. First, Siemens had Stuxnet, which gained user-level code execution on the old Simatic S7-300 and S7-400 by manipulating the local Step 7 projects files. Next, Siemens witnessed the Rogue7 attack.

The researchers behind Rogue7 were able to create a rogue engineering station which can masquerade as the TIA portal to the PLC and inject any messages favourable to the attacker.

The same year, researchers Ali Abbasi and Tobias Scharnowski presented how they physically attacked the Simatic 1200 to gain code execution on Siemens S7 PLCs.

Claroty’s research
Claroty has levelled up this research, demonstrating a new remote attack that allows it to gain native code execution on Siemens S7 PLCs. The attack targets deep in the kernel and avoids any detection because it is able to escape the user sandbox and write a shellcode into protected memory regions.

The integrity of a PLC is crucial to operators and engineers, and an attacker’s goal would be to damage that integrity by hiding code on the controller and elevating privileges. In order to escape, or jailbreak, the native Simatic S7-1200 and S7-1500 sandboxes, Claroty used its memory protection bypass vulnerability. The vulnerability bypasses existing protections within the execution environment of the PLC, including a sandbox where engineering code would normally run. Claroty was able to use this vulnerability to escape the sandbox in order to gain direct access to memory, then write and inject shellcode to execute our attack on Siemens 1200/1500 PLCs.

Escaping the sandbox means an attacker would be able to read and write from anywhere on the PLC, and could patch an existing VM opcode in memory with malicious code to root the device.

Claroty, for example, was able to inject ARM/MIPS shellcode directly to an internal operating system structure in such a way that when the operating system uses a specific opcode, Claroty’s malicious shellcode would execute, giving remote code execution. Claroty used this technique to install a kernel-level program with some functionality that is completely hidden to the operating system.

Read 1985 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here
BACK TO LATEST NEWS here

GET READY FOR XCONF AUSTRALIA 2022

Thoughtworks presents XConf Australia, back in-person in three cities, bringing together people who care deeply about software and its impact on the world.

In its fifth year, XConf is our annual technology event created by technologists for technologists.

Participate in a robust agenda of talks as local thought leaders and Thoughtworks technologists share first-hand experiences and exchange new ways to empower teams, deliver quality software and drive innovation for responsible tech.

Explore how at Thoughtworks, we are making tech better, together.

Tickets are now available and all proceeds will be donated to Indigitek, a not-for-profit organisation that aims to create technology employment pathways for First Nations Peoples.


Click the button below to register and get your ticket for the Melbourne, Sydney or Brisbane event

GET YOUR TICKET!

PROMOTE YOUR WEBINAR ON ITWIRE

It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://itwire.com/itwire-update.html and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV https://www.youtube.com/c/iTWireTV/videos which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.

MORE INFO HERE!

BACK TO HOME PAGE
Kenn Anthony Mendoza

Kenn Anthony Mendoza is the newest member of the iTWire team. Kenn is also a contributing writer for South China Morning Post Style, and has written stories on Korean entertainment, Asian and European royalty, Millionaires and Billionaires, and LGBTQIA+ issues. He has been published in Philippine newspapers, magazines, and online sites: Tatler PhilippinesManila BulletinCNN Philippines LifePhilippine StarManila Times, and The Daily Tribune. Kenn now covers all aspects of technology news for iTWire.com.

Share News tips for the iTWire Journalists? Your tip will be anonymous