Black Hat Europe 2023 - Details of the Legacy PG/PC and HMI Communication in SIMATIC S7-1500 SW Controller

Siemens is aware of the talk at the Black Hat Conference Europe (December 6, 2023, London), titled “A Decade After Stuxnet: How Siemens S7 is Still an Attacker’s Heaven”. The talk and the related research paper describe the details of the legacy PG/PC and HMI communication protocol as used between TIA Portal / HMIs and SIMATIC S7-1500 SW Controller in versions before V17. No previously unknown security vulnerabilities were disclosed in this talk. Siemens was in close coordination with the presenting company.

In general, Siemens recommends to:

• Apply client authentication using strong and individual access level passwords.
• Migrate to V17 or later to enable the new TLS-based communication protocol for all SIMATIC S7-1200/1500 PLCs including SW Controller (see Siemens Security Bulletin SSB-898115).
• Implement the defense-in-depth approach for plant operations and configure the environment according to Siemens’ operational guidelines for Industrial Security.

Note: Please be aware that links in the Blog Post may refer to external websites and content.