Password protected PLC's

[CetinOzdil]

Hello,

Just discovered this project and already feels pretty advanced. I jump on testing immediately and noticed that there is no implementation of password protection (for different security/access levels). Do you have any intention to implement it?

Thank you for great work!

[thomas-v2]

That's not something I am working on. It need's at first step developing an Iso-On-TCP / TLS Man in the Middle, to see if it's different to the authentication before TLS was added.

[Nick135]

Hello Thomas,
with the SIMATIC S7-PLCSIM Advanced (also included in Run MyVirtual Machine), it's possible to use Password protection.

[Ich-Eben]

Hello guys,

I did what Thomas suggested and wrote a little Iso-On-TCP mitm proxy.
With this we are now able to decrypt the TLS traffic going back and forth between TIA and the PLC.
After I checked the telegrams, I figured out that the password exchange work as following:

1. TIA sends a GetVarSubstreamed package with address 1842 to the PLC
2. The PLC answers with the access level encoded as a number of 1-4 (e.g. 1 = full access / no password and 4 = no access / password)
3. TIA sends again a GetVarSubstreamed package, this time with the address 303
4. The PLC answers with a challenge in form of a 20 bytes array
5. TIA hashes the password with sha1 and xors the result with the 20 bytes challenge
6. The result is sent back to the PLC with an SetVariable package and the address 304

I implemented the password process in the driver and it works fine for me (Testet with PLCsimAdvV4.0 and firmware 2.9). You can find my implementation here: feature-password

@thomas-v2 Let me know if you are interested in a PR.

Just be aware that I still only have a very rough understanding of the s7 protocol. What is e.g. the difference between a GetVarSubstreamed and a normal GetVar package?
I also struggle with git, as I’ve only used it for single user scenarios so far.

[StefanoRivolta-Previero]

Hi, this solution seems to work fine up to PLCsimAdv V5.0 and firmware V3.0

When switching to Firmware V3.1 and up or to PLCsimAdv V6.0 and up, it doesn't work anymore. It's likely due to the changes Siemens implemented to the users, passwords and access control in V3.1. Even with Legacy Access enabled, and the passwords set for Full Access and HMI Access it doesn't work. I've tried it on both PLCsimAdv V6.0 and on an actual CPU S7 1516F-3 with both firmware V3.0 and V3.1. When V3.1 is loaded it stops working, even if the CPU in the project is set as FW V3.0.

When the protection level is set to 3 or lower (HMI Access, no password) and the project FW is set to 3.0 it works fine (without password). When the project FW is 3.1 and you give the HMI Access rule to the Anonymous user, it also works fine (without password). The culprit seems to be the password.

Also, I'm not sure how it would work with FW >3.1 and without legacy access (access levels), as there doesn't seem to be a way to send to the plc both a user and a password. Even the Siemens documentation is a bit weird on this (https://support.industry.siemens.com/cs/document/109955142/configure-an-hmi-connection-to-an-s7-1500-cpu-with-fw-v3-1?dti=0&lc=en-ME)

If you look at point 2 it seems to suggest that you still need to use the legacy full access control password even if you then disable the legacy access levels. Weird.

Regardless, I'm not really experienced enough to figure it out myself, surely you guys understand this much better, as I'm kind of lost.

If you need help recreating the issue, I'll gladly help. You can also send me a DM. I'll also open an issue to keep track of it better.

Thank you