Home -> Resources -> SCADA/ICS Exploits - > Dillon Beresford - Exploiting Siemens S7 PLCs
Dillon Beresford at Black Hat 2011
Background
Dillon Beresford initially gained recognition in the
SCADA/ICS security community when he cancelled his
presentation on Siemens S7 vulnerabilities that he
discovered at TakeDownCon in May after last minute
discussions with ICS-CERT and Siemens.
During Black Hat 2011 USA in Las Vegas, Dillon presented his
much awaited presentation that included not only these
initial vulnerability discoveries, but some additional ones
that he uncovered following the original May disclosure.
During his presentation at Black Hat, Dillon covered his
newly discovered Siemens Simatic S7-1200 PLC
vulnerabilities. Links to both the paper and presentation
are provided below. He also demonstrated how an
attacker could impersonate the Siemens Step 7 PLC
communication protocol using some PROFINET-FU over ISO-TSAP
and take control.
Paper / Presentation
Dillon Beresford Speaks to Press at Black Hat 2011
Black Hat 2011 USA - Las Vegas
All of the presentation from the recent Black Hat 2011 USA conference in Las Vegas, as well as speaker briefings and white papers are available online. I was most impressed by Jerome Radcliffe who talked about hacking insulin pumps. It was interesting to hear him talk about "vendor irresponsibility" regarding vulnerability disclosure and "lack of authentication" between devices ... sounds a lot like SCADA/ICS.
About Dillon Beresford
Dillon Beresford is an independent security researcher who also works as a security analyst at NSS Labs. He has tested the world's leading Network IPS, IDS, HIPS, AV, and NGFW products. For the last few years Dillon has disclosed vulnerability advisories to US-CERT, ICS-CERT and CN-CERT. In 2011 he developed an exploit for one of the most popular high performance production SCADA/HMI software applications in China which is widely used in power, water conservancy, coalmine, environmental protection, defense and aerospace. In the past Dillon has presented on vulnerabilities affecting industrial control systems, embedded systems, software, and hardware. He has given presentations on a wide array of vulnerabilities primarily targeting devices and software in The People's Republic of China. His presentations have included vulnerabilities in Huawei devices running VxWorks, Beijing based WellinTech KingView SCADA and Beijing based NSFOCUS, Sunway China Unicom, China Telcom, China Railcom and AVCON.
