Siemens S7-1500 Security

Has anybody experienced having their PLC hacked,
We recently finished a machine refurb in Latin america, we provided them with an HMS lan/wan modem so that we could support them. Despite it being part of the agreement they dragged their heels in connecting it and after we left site, sure enough, they needed support but the mode still wasn't connected.Using Teamviewer they wanted us to load our program on to their laptop which had TIA portal on it citing that the modem the secure. However, I became suspicious of them and refused any other method than vpn. After a standoff of a couple of days they relented and connected the modem.
As soon as I went on line I could see the PLC program didn't match the one I'd left. On uploading the PLC, apart from 1 FC every block was deleted, all the DBs OBs and FCs. The PLC password and the Knowhow password on the block that was left were still the same as the ones I'd set.
Once I pointed this out to them and asked for an explanation they disconnected the modem. Several days later they emailed to say that there had been a network connection problem and they cycled the power and hey ho, the machine was all working again and them trying to say the program was never tampered with.
I suspect they tried to copy the memory card and have either succeeded or put back the original one.
A colleague told me there are ways to circumvent the Know how protection and a friend who works in the paper industry told me that all manufacturers have a backdoor method of getting round passwords albeit this not being public knowledge. Certainly in the UK Siemens would tell you there is no method to get round the password other than deleting the memory card. I suspect in the country where this machine is, there may be a less than scrupulous agent assisting them.

Which CPU?

Cpu 1513-1pn

It is definitely possible to crack the know-how protection on the 300s & 400s. I haven't heard of any cracks for the Simatic Manager block encryption and the know how protect on the 1500.

Supposedly the newer methods actually encrypt the source code behind a password, whereas the older one was just a flag that Step 7 promised to honor.

I know Siemens also has options to lock a block to a specific serial number, either the PLC or the memory card.

What I don't know is how secure the PLC password stuff is when you just take the memory card out and put it in a computer. I would HOPE they thought ahead to that vector, but I've never dug into it myself.

I suppose your next course of action is based on whether they have paid or not.

They owe us quite a bit which is why I think they are trying so hard to hack it, I'm not sure if they have actually succeeded yet though, so I'm hoping they haven't managed it.
I've been doing this for 35 years, never had a customer act like this before, normally I leave all our code on site and trust the customer never to touch it without our direction, however, whilst on this site I started getting a bad feeling about the way they were acting, so I pass-worded everything, something which I don't normally do.

It is never a good situation when both sides of a transaction don't trust each other.
If you don't normally password protect your code, why are you so concerned about their attempts to get into it?
It sounds like you need to establish some ground rules for ongoing support. Such as that your support only extends to versions of code validated by you. If you connect remotely and find the program doesn't match the last sanctioned version you reserve the right to disconnect and refuse support without payment.

I found this yesterday if the customer 'Trusts' teamviewer and you do not trust the customer.
http://www.plcs.net/downloads/index...w to setup Teamviewer VPN.pdf&directory=Misc&

I agree about the trust, normally we have a good relationship with our customers before we would entertain taking on a project, and that was the case for this job, however halfway through it, they made the director who was responsible for giving us the order , redundant and sacked the factory manager, both of whom spoke good english.
All the people left are nervous for their jobs and trying to score points all the time to make themselves look good to their seniors. On top of that, there is now a language barrier.
The maintenance manager made some bad decisions which we had to point out to his boss as it held us up by 2 weeks, after that the relationship just became frosty.

JosephMont, Wow, that's useful, thanks for that

No problem. I use this site as a resource so I love being able to help others use it this way as well.

interesting thread, I too was having the same problem

Compared to the S7-300/400 CPU and block protection, the 1500 uses real cryptographic algorithms, which I'd say are secure if Siemens has not put any backdoors in it.

But if I want to get the program/CPU password, I'd act like your special customer:

Install a keylogger on the programming device, and say to the plc programmer, that he has to use our programming device. I'll get all passwords you have entered without hacking or exploiting anything. Only social engineering needed

It was for exactly that reason I refused to use team viewer

JosephMont said:

I found this yesterday if the customer 'Trusts' teamviewer and you do not trust the customer.
http://www.plcs.net/downloads/index...w to setup Teamviewer VPN.pdf&directory=Misc&

Click to expand...

I can confirm that this works like a charm with Beckhoff PLCs. I described my experience in this topic - http://forums.mrplc.com/index.php?/...emotely-with bckhoff-plc and beckhoff hmiipc/.