Analyzing Stuxnet with Siemens

Two security experts at the 2011 Siemens Automation Summit talked about lessons learned during the Stuxnet affair.


ISS SourceThey walked into the Lion’s Den and came out unscathed. Two security experts went into the 2011 Siemens Automation Summit and talked about lessons learned during the Stuxnet affair.

Joel Langill, chief security officer at SCADAHacker, and Eric Byres, chief technology officer at Byres Security, gave a talk Tuesday at the 2011 Siemens Automation Summit entitled “How Stuxnet spreads: A study of infection paths in best practice systems."

“Stuxnet was a well engineered worm,” Byres said. “This attack could have happened to any one of the vendors. It just happened the Iranian nuclear site was running Siemens products. Siemens was the bystander shot in the middle of the gunfire.”

As a result of his highly complex and impressive piece of software, security professionals will be studying Stuxnet for years to come.

“Stuxnet is dead and gone,” Byres said. “Why study Stuxnet? Because the bad guys learned a lot from Stuxnet and we have to do the same. How do I protect a client from the son of Stuxnet?”

When you really look at it, the worm was very clean software. “It was amazingly well written software, Byres said. “It was a better grade of software than what is installed in most commercial systems.”

The big news when the world first became aware of Stuxnet was people believed the worm entered control systems via a USB key. While that may have happened, it doesn’t seem right that users would ban the use of USB drives. They do serve a quality purpose.

“Don’t think of this as a USB problem,” Langill said. “It was a removable media problem.” One of the things you have to remember, Langill said, is this was not an Internet-based attack. Instead, this all happened on the local area network.

The worm did infect some 100,000 computers and infected at least 22 manufacturing sites, which Byres actually believes was more around the 50 number.

One of the shocking thoughts about Stuxnet was the worm was able to penetrate and damage a nuclear site, which has some of the toughest security in any industry. What happens, Byres asked, when another worm comes around and takes over a less secure environment?

The odd part of the entire attack was Siemens does have a solid layered security architecture in the systems targeted for attack.

As mentioned the attack could have happened on a USB stick, however it could also have come as a result of infected project files, transmitted in an email, an infected laptop among other possibilities.

“If someone wants to put a virus on your site, they will be able to,” Byres said. “It depends on what you do with that afterward is what is important. There was so many ways it could spread.”

Some of the things the industry learned from Stuxnet was modern industrial control systems or SCADA systems are highly complex and interconnected; there are multiple pathways; you have to assume an air gap is unrealistic; focusing security on specific obvious pathways is not a good idea, and users have to complete a simple overall holistic view of the system, Byres said.

- Edited by Amanda McLeman, Plant Engineering,

No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Choosing controllers: PLCs, PACs, IPCs, DCS? What's best for your application?; Wireless trends; Design, integration; Manufacturing Day; Product Exclusive
Variable speed drives: Smooth, efficient, electrically quite motion control; Process control upgrades; Mobile intelligence; Product finalists: Vote now; Product Exclusives
Machine design tips: Pneumatic or electric; Software upgrades; Ethernet advantages; Additive manufacturing; Engineering Leaders; Product exclusives: PLC, HMI, IO
This article collection contains the 5 most referenced articles on improving the use of PID.
Learn how Industry 4.0 adds supply chain efficiency, optimizes pricing, improves quality, and more.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Cyber security cost-efficient for industrial control systems; Extracting full value from operational data; Managing cyber security risks
Drilling for Big Data: Managing the flow of information; Big data drilldown series: Challenge and opportunity; OT to IT: Creating a circle of improvement; Industry loses best workers, again
Pipeline vulnerabilities? Securing hydrocarbon transit; Predictive analytics hit the mainstream; Dirty pipelines decrease flow, production—pig your line; Ensuring pipeline physical and cyber security

(copy 5)