A widespread logic controller flaw raises the specter of Stuxnet

In 2009, the computer worm Stuxnet crippled hundreds of centrifuges inside Iran’s Natanz uranium enrichment plant by concentrating on the software program operating on the ability’s industrial computer systems, referred to as programmable logic controllers. The exploited PLCs had been made by the automation large Siemens and had been all fashions from the corporate’s ubiquitous, long-running SIMATIC S7 product collection. Now, greater than a decade later, Siemens disclosed today {that a} vulnerability in its S7-1500 collection may very well be exploited by an attacker to silently set up malicious firmware on the gadgets and take full management of them.

The vulnerability was discovered by researchers on the embedded system safety agency Pink Balloon Safety after they spent greater than a 12 months creating a technique to judge the S7-1500’s firmware, which Siemens has encrypted for added safety since 2013. Firmware is the low-level code that coordinates {hardware} and software program on a pc. The vulnerability stems from a fundamental error in how the cryptography is carried out, however Siemens can’t repair it by means of a software program patch as a result of the scheme is bodily burned onto a devoted ATECC CryptoAuthentication chip. Consequently, Siemens says it has no repair deliberate for any of the 122 S7-1500 PLC fashions that the corporate lists as being susceptible.

Siemens says that as a result of the vulnerability requires bodily entry to take advantage of by itself, prospects ought to mitigate the risk by assessing “the danger of bodily entry to the system within the goal deployment” and implementing “measures to be sure that solely trusted personnel have entry to the bodily {hardware}.” The researchers level out, although, that the vulnerability may probably be chained with different distant entry vulnerabilities on the identical community because the susceptible S7-1500 PLCs to ship the malicious firmware with out in-person contact. The Stuxnet attackers famously used tainted USB thumb drives as a inventive vector to introduce their malware into “air-gapped” networks and finally infect then-current S7-300 and 400 collection PLCs.

“Seimans PLCs are utilized in crucial industrial capacities all over the world, a lot of that are probably very enticing targets of assaults, as with Stuxnet and the nuclear centrifuges,” says Grant Skipper, a Pink Balloon Safety analysis scientist.

The ubiquity and criticality of S7-1500 PLCs are the 2 traits that motivated the researchers to do a deep dive into the safety of the gadgets. To a motivated and well-resourced attacker, any flaws may very well be value exploiting.