Trojan horse scada attacks on Seimens

http://www.theregister.co.uk/2010/07/20/win_shortcut_vuln_exploit_code/

Somebody is definitely reading our discussions about shop floor automation security. First the NSA announces their program to promote secure automation, particularly for infrastructure, and now this.

TM

The day I find someone writing a virus, I will kill him! This virus attacks everything, not just automation.Beware!

Well, from reading that, the cause is insane idiocy on the part of Siemens. Requiring hard-coded administrator accounts and passwords is about as irresponsible as can be.

It's mentioned in the SME newsletter as well. Sorry, no links - came as an email.

From the email:


Technology
Malware Threatens Manufacturing Software Systems Worldwide.
Managing Automation (7/19, Chiappinelli) reported, "Manufacturers worldwide have been put on notice that an insidious virus targeting supervisory control and data acquisition (SCADA) systems is on the loose." The targets of the virus "are Siemens' SIMATIC WinCC and PCS7 software, integral components of the distributed control and SCADA systems that facilitate production operations in many process manufacturing companies."

The Wired (7/19, Zetter) "Threat Level" blog described the virus as "a sophisticated new piece of malware that targets command-and-control software installed in critical infrastructures" that "uses a known default password that the software maker hard-coded into its system. The password has been available online since at least 2008, when it was posted to product forums in Germany and Russia. The password protects the database used in Siemens' Simatic WinCC SCADA system, which runs on Windows operating systems."

Do a google new search for "siemens virus" and you get more details and risks. Wow.

http://www.businessweek.com/idg/2010-07-19/after-worm-siemens-says-don-t-change-passwords.html

Another link with details.

It appears that the trojan is programmed by someone who knows the Siemens WinCC very well. It basically duplicate the control files to a remote site to steal company manufacturing know hows.

two thoughts? Ex employee, or VIPA!

Another article I just received.

http://www.controlengeurope.com/article.aspx?ArticleID=35267

Update from Siemens:

http://support.automation.siemens.com/WW/view/en/43877513

Siemens have a pressrealese about it:

http://www.sea.siemens.com/us/News/Industrial/Pages/WinCC_Update.aspx

Cannot beleive these have actually reposted the password (well I assume it is)

http://www.wired.com/threatlevel/2010/07/siemens-scada/?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+wired27b+%28Blog+-+27B+Stroke+6+%28Threat+Level%29%29

Additional story from CNet.com

http://news.cnet.com/8301-27080_3-20011159-245.html?amp

OG

NY Times article with response from Siemens

http://www.nytimes.com/2010/07/23/technology/23iht-siemens.html?src=busln

Newer versions of the SQL Server install - i.e. with PCS7 v7 - prompt you to select whether to use the default password or a specific password.

I presume that setting something other than default password avoids this issue?