Network Virus & PLCs

[Maxkling]

I think it’s easy for someone unknowing see an issue and identify it as a “hack”. Network storms can cause havoc that seem like a “hack”. A switch fails and stops switching and fails into forward all packets can cause havoc. Spanning tree causing a network convergence from bad uplinks or bad connections can cause havoc. There are so many things other than a hack that are more realistic.

 

[mk42]

The main problem of Stuxnet was Windows. There was a basic communication dll for communication to the Siemens plc which was replaced with a faked one, which modified the code you see at the controller and also placed different code in the plc. It does not need deep understanding of how to do this also on Rockwell or other controllers, but you need the 0-day exploits in Windows to distribute this over the network.

I think there ended up being an exploit on the WinCC SCADA side as well, a hardcoded password for the DB or something. But regardless, you're right, it was the 3 different Windows 0 days that made it all possible. Once you own the computer, anything is possible.