Red Balloon’s research has determined that multiple architectural vulnerabilities exist in the Siemens SIMATIC and SIPLUS S7-1500 series PLC that could allow attackers to bypass all protected boot features, resulting in persistent arbitrary modification of operating code and data.
Red Balloon’s latest research consists of discovering multiple, critical architectural vulnerabilities in the Siemens S7-1500 series that allow for bypass of all protected boot features. This discovery has potentially significant implications for industrial environments as these unpatchable hardware root-of-trust vulnerabilities could result in persistent arbitrary modification of S7-1500 operating code and data. Exploitation of these vulnerabilities could allow offline attackers to generate arbitrary encrypted firmware that are bootable on all Siemens S7-1500 series PLC CPU modules. Furthermore, these vulnerabilities allow attackers to persistently bypass integrity validation and security features of the ADONIS operating system and subsequent user space code. Red Balloon has reported these vulnerabilities to Siemens, and Siemens has confirmed them.
The vulnerabilities exist because the Siemens custom System-on-Chip (SoC) does not establish a tamper proof Root of Trust (RoT) in the early boot process. The Siemens RoT is implemented through the integration of a dedicated cryptographic secure element — the ATECC CryptoAuthentication chip. However, this architecture contains flaws that can be leveraged to compromise the system. Failure to establish a RoT on the device allows attackers to load custom-modified bootloaders and firmware.
The fundamental vulnerabilities — improper hardware implementations of the RoT using dedicated cryptographic-processor — are unpatchable and cannot be fixed by a firmware update since the hardware is physically unmodifiable. To limit the effects of potential exploitation of these vulnerabilities, Red Balloon has recommended several mitigations to Siemens which include: implement runtime integrity attestation; add asymmetric signature check for firmware at bootup scheme; and encrypt the firmware with device specific keys that are generated on individual devices.
Siemens reaction
Siemens has published the following note:
Affected models of the S7-1500 CPU product family do not contain an Immutable Root of Trust in
Hardware. With this the integrity of the code executed on the device can not be validated during load-time.
An attacker with physical access to the device could use this to replace the boot image of the device and
execute arbitrary code.
As exploiting this vulnerability requires physical tampering with the product, Siemens recommends to
assess the risk of physical access to the device in the target deployment and to implement measures to
make sure that only trusted personnel have access to the physical hardware.
The vulnerability is related to the hardware of the product. Siemens has released new hardware versions
for several CPU types of the S7-1500 product family in which this vulnerability is fixed and is working on
new hardware versions for remaining PLC types to address this vulnerability completely. See the chapter
“Additional Information” below for more details.
Ver nota publica: SSA-482757: Missing Immutable Root of Trust in S7-1500 CPU devices
Affected S7-1500 PLCs:
- SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ00-0AB0)
- SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0)
- SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0)
- SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0)
- SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)
- SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0)
- SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0)
- SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0)
- SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0)
- SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK00-0AB0)
- SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0)
- SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0)
- SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0)
- SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0)
- SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0)
- SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0)
- SIMATIC S7-1500 CPU 1512SP F-1PN (6ES7512-1SK00-0AB0)
- SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0)
- SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DK00-0AB0)
- SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DK01-0AB0)
- SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL00-0AB0)
- SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0)
- SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0)
- SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL00-0AB0)
- SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0)
- SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL02-0AB0)
- SIMATIC S7-1500 CPU 1513R-1 PN (6ES7513-1RL00-0AB0)
- SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM00-0AB0)
- SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM01-0AB0)
- SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM02-0AB0)
- SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM00-0AB0)
- SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM01-0AB0)
- SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM02-0AB0)
- SIMATIC S7-1500 CPU 1515R-2 PN (6ES7515-2RM00-0AB0)
- SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TM01-0AB0)
- SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UM01-0AB0)
- SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN00-0AB0)
- SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN01-0AB0)
- SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0)
- SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN00-0AB0)
- SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN01-0AB0)
- SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN02-0AB0)
- SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3TN00-0AB0)
- SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3UN00-0AB0)
- SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3AP00-0AB0)
- SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3FP00-0AB0)
- SIMATIC S7-1500 CPU 1517H-3 PN (6ES7517-3HP00-0AB0)
- SIMATIC S7-1500 CPU 1517T-3 PN/DP (6ES7517-3TP00-0AB0)
- SIMATIC S7-1500 CPU 1517TF-3 PN/DP (6ES7517-3UP00-0AB0)
- SIMATIC S7-1500 CPU 1518-4 PN/DP (6ES7518-4AP00-0AB0)
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
- SIMATIC S7-1500 CPU 1518-4F PN/DP (6ES7518-4FP00-0AB0)
- SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)
- SIMATIC S7-1500 CPU 1518HF-4 PN (6ES7518-4JP00-0AB0)
- SIMATIC S7-1500 CPU 1518T-4 PN/DP (6ES7518-4TP00-0AB0)
- SIMATIC S7-1500 CPU 1518TF-4 PN/DP (6ES7518-4UP00-0AB0)
- SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK (6ES7518-4AP00-3AB0)
- SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK (6ES7518-4FP00-3AB0)
- SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN (6ES7513-2GL00-0AB0)
- SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN (6ES7513-2PL00-0AB0)
- SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN (6ES7516-2GN00-0AB0)
- SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN (6ES7516-2PN00-0AB0)
- SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK00-2AB0)
- SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-2AB0)
- SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-7AB0)
- SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-2AB0)
- SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-7AB0)
- SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK01-1AB0)
- SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK02-1AB0)
- SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK01-4AB0)
- SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK02-4AB0)
- SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK00-2AB0)
- SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK01-2AB0)
- SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK02-2AB0)
- SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL00-2AB0)
- SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-2AB0)
- SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-7AB0)
- SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-2AB0)
- SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-7AB0)
- SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL00-2AB0)
- SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL01-2AB0)
- SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL02-2AB0)
- SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM01-2AB0)
- SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM02-2AB0)
- SIPLUS S7-1500 CPU 1515F-2 PN RAIL (6AG2515-2FM02-4AB0)
- SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL (6AG2515-2FM01-2AB0)
- SIPLUS S7-1500 CPU 1515R-2 PN (6AG1515-2RM00-7AB0)
- SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL (6AG2515-2RM00-4AB0)
- SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-2AB0)
- SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-7AB0)
- SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-2AB0)
- SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-7AB0)
- SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-2AB0)
- SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-7AB0)
- SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL (6AG2516-3AN02-4AB0)
- SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL (6AG2516-3AN01-4AB0)
- SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN00-2AB0)
- SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN01-2AB0)
- SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN02-2AB0)
- SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-2AB0)
- SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-4AB0)
- SIPLUS S7-1500 CPU 1517H-3 PN (6AG1517-3HP00-4AB0)
- SIPLUS S7-1500 CPU 1518-4 PN/DP (6AG1518-4AP00-4AB0)
- SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)
- SIPLUS S7-1500 CPU 1518F-4 PN/DP (6AG1518-4FP00-4AB0)