Analyzing Stuxnet with Siemens

Two security experts at the 2011 Siemens Automation Summit talked about lessons learned during the Stuxnet affair.

07/12/2011


ISS SourceThey walked into the Lion’s Den and came out unscathed. Two security experts went into the 2011 Siemens Automation Summit and talked about lessons learned during the Stuxnet affair.

Joel Langill, chief security officer at SCADAHacker, and Eric Byres, chief technology officer at Byres Security, gave a talk Tuesday at the 2011 Siemens Automation Summit entitled “How Stuxnet spreads: A study of infection paths in best practice systems."

“Stuxnet was a well engineered worm,” Byres said. “This attack could have happened to any one of the vendors. It just happened the Iranian nuclear site was running Siemens products. Siemens was the bystander shot in the middle of the gunfire.”

As a result of his highly complex and impressive piece of software, security professionals will be studying Stuxnet for years to come.

“Stuxnet is dead and gone,” Byres said. “Why study Stuxnet? Because the bad guys learned a lot from Stuxnet and we have to do the same. How do I protect a client from the son of Stuxnet?”

When you really look at it, the worm was very clean software. “It was amazingly well written software, Byres said. “It was a better grade of software than what is installed in most commercial systems.”

The big news when the world first became aware of Stuxnet was people believed the worm entered control systems via a USB key. While that may have happened, it doesn’t seem right that users would ban the use of USB drives. They do serve a quality purpose.

“Don’t think of this as a USB problem,” Langill said. “It was a removable media problem.” One of the things you have to remember, Langill said, is this was not an Internet-based attack. Instead, this all happened on the local area network.

The worm did infect some 100,000 computers and infected at least 22 manufacturing sites, which Byres actually believes was more around the 50 number.

One of the shocking thoughts about Stuxnet was the worm was able to penetrate and damage a nuclear site, which has some of the toughest security in any industry. What happens, Byres asked, when another worm comes around and takes over a less secure environment?

The odd part of the entire attack was Siemens does have a solid layered security architecture in the systems targeted for attack.

As mentioned the attack could have happened on a USB stick, however it could also have come as a result of infected project files, transmitted in an email, an infected laptop among other possibilities.

“If someone wants to put a virus on your site, they will be able to,” Byres said. “It depends on what you do with that afterward is what is important. There was so many ways it could spread.”

Some of the things the industry learned from Stuxnet was modern industrial control systems or SCADA systems are highly complex and interconnected; there are multiple pathways; you have to assume an air gap is unrealistic; focusing security on specific obvious pathways is not a good idea, and users have to complete a simple overall holistic view of the system, Byres said.

- Edited by Amanda McLeman, Plant Engineering, www.plantengineering.com



No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Integrated mobility; Artificial intelligence; Predictive motion control; Sensors and control system inputs; Asset Management; Cybersecurity
Big Data and IIoT value; Monitoring Big Data; Robotics safety standards and programming; Learning about PID
Motor specification guidelines; Understanding multivariable control; Improving a safety instrumented system; 2017 Engineers' Choice Award Winners
This digital report will explore several aspects of how IIoT will transform manufacturing in the coming years.
Motion control advances and solutions can help with machine control, automated control on assembly lines, integration of robotics and automation, and machine safety.
This article collection contains several articles on the Industrial Internet of Things (IIoT) and how it is transforming manufacturing.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Mobility as the means to offshore innovation; Preventing another Deepwater Horizon; ROVs as subsea robots; SCADA and the radio spectrum
Future of oil and gas projects; Reservoir models; The importance of SCADA to oil and gas
Big Data and bigger solutions; Tablet technologies; SCADA developments
Automation Engineer; Wood Group
System Integrator; Cross Integrated Systems Group
Jose S. Vasquez, Jr.
Fire & Life Safety Engineer; Technip USA Inc.

(copy 5)

click me