Analyzing Stuxnet with Siemens

Two security experts at the 2011 Siemens Automation Summit talked about lessons learned during the Stuxnet affair.

07/12/2011


ISS SourceThey walked into the Lion’s Den and came out unscathed. Two security experts went into the 2011 Siemens Automation Summit and talked about lessons learned during the Stuxnet affair.

Joel Langill, chief security officer at SCADAHacker, and Eric Byres, chief technology officer at Byres Security, gave a talk Tuesday at the 2011 Siemens Automation Summit entitled “How Stuxnet spreads: A study of infection paths in best practice systems."

“Stuxnet was a well engineered worm,” Byres said. “This attack could have happened to any one of the vendors. It just happened the Iranian nuclear site was running Siemens products. Siemens was the bystander shot in the middle of the gunfire.”

As a result of his highly complex and impressive piece of software, security professionals will be studying Stuxnet for years to come.

“Stuxnet is dead and gone,” Byres said. “Why study Stuxnet? Because the bad guys learned a lot from Stuxnet and we have to do the same. How do I protect a client from the son of Stuxnet?”

When you really look at it, the worm was very clean software. “It was amazingly well written software, Byres said. “It was a better grade of software than what is installed in most commercial systems.”

The big news when the world first became aware of Stuxnet was people believed the worm entered control systems via a USB key. While that may have happened, it doesn’t seem right that users would ban the use of USB drives. They do serve a quality purpose.

“Don’t think of this as a USB problem,” Langill said. “It was a removable media problem.” One of the things you have to remember, Langill said, is this was not an Internet-based attack. Instead, this all happened on the local area network.

The worm did infect some 100,000 computers and infected at least 22 manufacturing sites, which Byres actually believes was more around the 50 number.

One of the shocking thoughts about Stuxnet was the worm was able to penetrate and damage a nuclear site, which has some of the toughest security in any industry. What happens, Byres asked, when another worm comes around and takes over a less secure environment?

The odd part of the entire attack was Siemens does have a solid layered security architecture in the systems targeted for attack.

As mentioned the attack could have happened on a USB stick, however it could also have come as a result of infected project files, transmitted in an email, an infected laptop among other possibilities.

“If someone wants to put a virus on your site, they will be able to,” Byres said. “It depends on what you do with that afterward is what is important. There was so many ways it could spread.”

Some of the things the industry learned from Stuxnet was modern industrial control systems or SCADA systems are highly complex and interconnected; there are multiple pathways; you have to assume an air gap is unrealistic; focusing security on specific obvious pathways is not a good idea, and users have to complete a simple overall holistic view of the system, Byres said.

- Edited by Amanda McLeman, Plant Engineering, www.plantengineering.com



The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by Control Engineering subscribers. Vote now (if qualified)!
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
Each year, a panel of Control Engineering and Plant Engineering editors and industry expert judges select the System Integrator of the Year Award winners in three categories.
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
HMI effectiveness; Distributed I/O; Engineers' Choice Award finalists; System Integrator advice; Inside Machines
Women in engineering; Engineering Leaders Under 40; PID benefits and drawbacks; Ladder logic; Cloud computing
Robotic integration and cloud connections; SCADA and cybersecurity; Motor efficiency standards; Open- and closed-loop control; Augmented reality
Programmable logic controllers (PLCs) represent the logic (decision) part of the control loop of sense, decide, and actuate. As we know, PLCs aren’t the only option for making decisions in a control loop, but they are likely why you’re here.
This digital report explains how motion control advances and solutions can help with machine control, automated control on assembly lines, integration of robotics and automation, and machine safety.
This article collection contains several articles on how advancements in vision system designs, computing power, algorithms, optics, and communications are making machine vision more cost effective than ever before.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Control room technology innovation; Practical approaches to corrosion protection; Pipeline regulator revises quality programs
Cloud, mobility, and remote operations; SCADA and contextual mobility; Custom UPS empowering a secure pipeline
Infrastructure for natural gas expansion; Artificial lift methods; Disruptive technology and fugitive gas emissions
Automation Engineer; Wood Group
System Integrator; Cross Integrated Systems Group
Jose S. Vasquez, Jr.
Fire & Life Safety Engineer; Technip USA Inc.
This course focuses on climate analysis, appropriateness of cooling system selection, and combining cooling systems.
This course will help identify and reveal electrical hazards and identify the solutions to implementing and maintaining a safe work environment.
This course explains how maintaining power and communication systems through emergency power-generation systems is critical.
click me