Siemens PLCs Still Vulnerable to Stuxnet-Like Cyberattacks

Programmable logic controllers (PLCs) that had been susceptible to the Stuxnet assault are nonetheless in use globally and barely have safety controls deployed — which means they’re nonetheless in danger.

Greater than 10 years after Stuxnet, new analysis reveals customers hardly ever change on safety controls resembling utilizing passwords, and really feel updates are too cumbersome to be utilized.

Colin Finck, tech lead of reverse engineering and connectivity at Enlyze, says the Siemens proprietary protocol which is used to learn and write knowledge in addition to to program the S7 PLC. Nonetheless, that is solely protected by obfuscation, which the researchers had been in a position to bypass.

Finck and his colleague Tom Dohrmann, software program engineer, reverse engineering and connectivity, will current their findings at Black Hat Europe in London subsequent week, in a chat titled “A Decade After Stuxnet: How Siemens S7 Is Nonetheless an Attacker’s Heaven.”

Nonetheless Feeling the Stuxnet Results

Within the 2010 assault, the Stuxnet attackers exploited a number of zero-day vulnerabilities in Microsoft Home windows to in the end acquire entry to Siemens software program and the PLCs. This was achieved to achieve entry to and successfully harm high-speed centrifuges on the Iranian Bushehr nuclear energy plant.

The affect of Stuxnet was big, because it remotely broken round a thousand centrifuges, and the worm’s controllers had been additionally in a position to analyze communication protocols between the PLCs to take advantage of additional technological weaknesses. It additionally paved the way in which for issues to come back: After Stuxnet, various industrial control-related assaults had been detected over time, together with BlackEnergy and Colonial Pipeline.

Finck tells Darkish Studying that after the Stuxnet assaults passed off, Siemens developed a revised protocol for the PLCs that added “numerous obfuscation and cryptography layers.” Nonetheless, the researchers in current probing had been in a position to bypass that obfuscation to provide them the power to learn and write directions for the PLCs, and in the end cease the controller working in a proof of idea.

A press release from Siemens despatched to Darkish Studying acknowledged that the degrees of obfuscation don’t provide sufficient safety, and a Safety Bulletin from October 2022 acknowledged that two of the PLCs “use a built-in world non-public key which can’t be thought of anymore as sufficiently protected.”

The assertion added: “Siemens has deprecated this earlier model of the communication protocol and encourages everybody emigrate to V17 or later to allow the brand new TLS [Transport Layer Security]-based communication protocol.”

Improved Firmware

That the majority current Siemens firmware launched in 2022 does embrace TLS, however Finck claims there is no such thing as a “long-term service for cybersecurity points” and requires Siemens to offer higher means to replace firmware “as a result of proper now, it is huge open to anyone who might simply entry it over the Web.”

In its assertion, Siemens mentioned it’s conscious of the discuss scheduled for Black Hat Europe and acknowledged that the discuss “will describe the main points of the legacy PG/PC and HMI communication protocol as used between TIA Portal/HMIs and SIMATIC S7-1500 SW Controller in variations earlier than V17.”

The corporate acknowledged that no beforehand unknown safety vulnerabilities shall be disclosed in this discuss and that Siemens is in shut coordination with the researchers. Siemens really helpful customers to use mitigations, together with:

Although the researchers praised the response by Siemens, they famous that PLC firmware isn’t up to date by customers, “and there is not a longtime replace course of to rapidly roll out [updates] to a fleet of machines.”

Finck says doing updates is “in all probability a tedious guide course of to stroll to each machine, plug one thing in and replace the firmware,” and thus, Siemens wants to supply higher replace processes so clients have an incentive to deploy these updates.

Within the meantime, he says, “you higher not have a direct connection to all PLCs proper now, as a result of aforementioned safety issues.”