{"id":1114,"date":"2023-01-19T10:17:10","date_gmt":"2023-01-19T10:17:10","guid":{"rendered":"https:\/\/inprotech.es\/?p=1114"},"modified":"2025-02-17T10:59:18","modified_gmt":"2025-02-17T10:59:18","slug":"s7comm-protocol-security-analyzed","status":"publish","type":"post","link":"https:\/\/inprotech.es\/en\/s7comm-protocol-security-analyzed\/","title":{"rendered":"S7Comm protocol: security analyzed"},"content":{"rendered":"

The S7 Communication protocol\u00a0 (hereafter S7Comm) is a Siemens\u00a0 proprietary protocol that first appeared in 1994 with the launch of Simatic S7 products such as S7-200, S7-300 and\u00a0<\/span>S7-400, although it is currently\u00a0<\/span>integrated by all SIMATIC S7 and C7\u00a0<\/span>CPU devices and is independent of the\u00a0<\/span>bus used, as this protocol can be used\u00a0<\/span>both through Industrial Ethernet and\u00a0<\/span>through other physical or network\u00a0<\/span>layers such as over RS-485 for MPI\u00a0<\/span>(Multi-Point-Interface) or Profibus [1].<\/span><\/p>\n

This protocol is mainly used for data\u00a0<\/span>exchange, as well as for access from\u00a0<\/span>other devices such as HMI or SCADA.<\/span><\/p>\n\n

 <\/p>\n

As this is a proprietary protocol, there is\u00a0<\/span>not much information publicly available\u00a0<\/span>about it, although there are several\u00a0<\/span>projects that can help to understand it,\u00a0<\/span>such as Snap7 [2], which is an open\u00a0<\/span>source library that can be used to\u00a0<\/span>interact with Siemens S7 products and\u00a0<\/span>includes extensive technical\u00a0<\/span>documentation on the operation of this\u00a0<\/span>protocol.<\/span><\/p>\n

Another large open source project that\u00a0<\/span>includes information on this S7 protocol\u00a0<\/span>is PLC4X [3], which includes a set of\u00a0<\/span>libraries to implement communication\u00a0<\/span>between PLCs with different industrial\u00a0<\/span>protocols through its API, including S7.\u00a0<\/span><\/p>\n

When we talk about the S7Comm\u00a0<\/span>protocol, we could really be referring to\u00a0<\/span>both S7Comm and its most recent\u00a0<\/span>version, S7Comm Plus, of which there is\u00a0<\/span>very little information and which\u00a0<\/span>includes, as a new feature, an\u00a0<\/span>encryption layer. Throughout this\u00a0<\/span>article, we will only talk about the\u00a0<\/span>S7Comm protocol, which is mainly used\u00a0<\/span>for connections between PLCs and PC\u00a0<\/span>stations.<\/span><\/p>\n

\"\"
Figura 1. Profinet vs S7Comm Plus vs S7 Comm<\/figcaption><\/figure>\n

 <\/p>\n

Technical description<\/h2>\n

Generally, the communication designed\u00a0<\/span>by Siemens follows the traditional\u00a0<\/span>master-slave (or client-server) model.\u00a0<\/span>where a master (or client) PC sends S7\u00a0<\/span>requests to the slave (or server) PLC <\/span>device).<\/span><\/p>\n

The implementation of the S7 protocol\u00a0<\/span>over TCP\/IP is based on the blockoriented ISO transport service.\u00a0<\/span>This protocol is encapsulated in the\u00a0<\/span>TPKT and ISO-COTP protocols, allowing\u00a0<\/span>the transfer of the PDU (Protocol Data\u00a0<\/span>Unit) via TCP, using by default TCP\/102\u00a0<\/span>port for communications.<\/span><\/p>\n

Each of the data blocks that are\u00a0<\/span>transmitted are so-called PDUs, the\u00a0<\/span>length of which is negotiated during\u00a0<\/span>connection setup.<\/span><\/p>\n

The protocol is function and\/or\u00a0<\/span>command oriented, which means that\u00a0<\/span>the transmission generally consists of\u00a0<\/span>an S7 request and a response to that\u00a0<\/span>request. Each of these commands\u00a0<\/span>consists of the following commands\u00a0<\/span>fields, the last two being optional:<\/span><\/p>\n