Slashdot Mirror

← Back to Stories (view on slashdot.org)

Siemens Fixes SCADA Flaws

Posted by Soulskill on from the and-so-soon dept.

itwbennett writes "Siemens has fixed a pair of bugs in its S7-1200 controller, which is used to control machines on factory floors, power stations and chemical plants. The bugs were discovered earlier this year by NSS researcher Dillon Beresford, who planned to disclose the bugs at Black Hat in August. The US Department of Homeland Security said that Siemens' patches fix 'a portion' of the problems Beresford has discovered and that it 'continues to work with Siemens and Mr. Beresford on the other reported problems.'"

36 comments

  1. Cool by SheeEttin · · Score: 1

    Cool. Glad to see they fixed it in short order. I am anxiously awaiting the time when these fixes are put in place. I'll set my clock for... 7 years. That should be enough.

    1. Re:Cool by jhoegl · · Score: 1

      But... but thats when the 2024 bug scare will start.
      No one wants to see robotic arms start killing humans because they think its 1924 and they should exist, thus making them go crazy.

    2. Re:Cool by slashqwerty · · Score: 1

      I am actually quite surprised. I fully expected Siemens to hand the guy some hush money so he would cancel his presentation. This could be the first time in years that the black hat conference has run without canceling a controversial presentation.

    3. Re:Cool by datapharmer · · Score: 1

      This isn't their first opportunity. They've had since May at the least: http://www.prweb.com/releases/2011/5/prweb8458069.htm

      --
      Get a web developer
    4. Re:Cool by drinkypoo · · Score: 1

      Cool. Glad to see they fixed it in short order

      Do I detect a note of sarcasm? Say, wasn't this talk already delayed to give Siemens time to find their ass with both hands and a map?

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  2. Firewalls by IntentionalStance · · Score: 1

    SCADA networks are usually on a completely separate domain from the corporate network. It'll be behind two sets of firewalls controlled by anal retentive engineers

    1. Re:Firewalls by Anonymous Coward · · Score: 1

      so...not an air gap, then.

    2. Re:Firewalls by Anonymous Coward · · Score: 0, Insightful

      Don't forget the set of firewall exceptions that allow management to access the controls remotely through Windows Remote Desktop.

      If it's not an air gap, it's never good enough.

    3. Re:Firewalls by DarthBart · · Score: 0

      That's not "completely separate domain". That's "same domain with some sandboxing".

      There's still the chance of some prick tossing sand in from the other box.

    4. Re:Firewalls by thegarbz · · Score: 3, Interesting

      There's still the chance of some prick tossing sand in from the other box.

      If there is then you haven't set it up properly. These aren't enterprise firewalls designed to allow maximum user friendlies while limiting a small set of nasties from entering from the outside. These are default deny all, and on a very select case by case basis allow one way data back out to certain machines on certain ports.

      This is several layers deep in a corporate network, the firewall gear is not part of the standard package, the data historian or other products that rely on data from the process networks are not part of a standard package, so you'd need to penetrate in at least that far just to see what you're up against next. To get through something like this you would need to know details beforehand.

      For any attack like this to be feasible you would need rather large amounts of inside information. If you're that close to the inside information chances are you're within touching distance of the control system itself, in which case nothing is usually safe

    5. Re:Firewalls by IntentionalStance · · Score: 1
      Correct

      The default position will be that nothing and I mean nothing in the corporate domain will be able to open a TCP connection to anything in the SCADA domain.

      and the guys in charge of this will take it all the way to senior management if you even look like you are thinking of breaking this rule.

      and you'll have to sign some serious career limiting documents before the guys in suits will sanction this.

      or at least that's how it's been at place I have worked where they have SCADA networks and my specialist topic is data integration so I tend to bump into these issues fairly often

    6. Re:Firewalls by Anonymous Coward · · Score: 2, Interesting

      In my experience vendors of SCADA management tools are never able to exactly tell me which firewall ports need to be open to enable their applications to work. Most firewalls will end up looking as Swiss cheese (enabling all communications from one IP address to another).

      Good luck with your security ... It usually takes about 2 firewall hops to go from the internal Internet connected network to the SCADA network.

      Most of those management servers are now web-based (or web services based), but are never tested for web application security.

    7. Re:Firewalls by jroysdon · · Score: 1

      That's correct. The executives with their neck on the line won't go for it because if it is a misstep NERC/FERC will be all over them with fines and audit spot checks forever.

      The best solution is to not connect SCADA systems with IP to any external network, firewall or not. Serial-based RTUs are totally acceptable to pass data and isolate networks from IP and most of the problems there.

      The next level of protection needed in SCADA is protocol specific command-by-comamnd firewalling (ICCP, DNP3, etc.) of key hosts. There are a few vendors, but this is a very green, very niche market. However, this would allow for protection of PLCs and "less-smart" devices that are more easily abused (think Stuxnet), even within the secured SCADA networks.

    8. Re:Firewalls by Anonymous Coward · · Score: 0

      If it's connected, you're doing it to pass traffic somewhere. If that's the case someone will figure out a way to use it as a communication channel if they think hard enough about it.

    9. Re:Firewalls by DerPflanz · · Score: 1

      When we install S7's (with our own SCADA/visualisation solution) we insist that we have VPN access from our offices, to ensure the SLA and reaction time guarantees.

      So, yes separate networks, but certainly not completely off the internet. The separation of networks is mostly a performance and reliability measure (you don't want NETBIOS, ERP and webbrowsing trafic on the industrial LAN), not about security.

      --
      -- The Internet is a too slow way of doing things, you'd never do without it.
    10. Re:Firewalls by aix+tom · · Score: 2

      Good luck getting Windows to run on 2560k, which is the memory the biggest of those things have.

      I also have seen Windows for x86, x86_64, Itanium and in the NT4 days for Alpha processors. Never for, say, 315T-2 DP processors.

      The most likely attack vector here would not be a network to the device itself, it would be something that infects the windows (or still DOS in some cases) notebook that is carried around the plant and plugged in the serial port for software updates and maintenance.

    11. Re:Firewalls by RobinH · · Score: 1

      SCADA networks are usually on a completely separate domain from the corporate network. It'll be behind two sets of firewalls controlled by anal retentive engineers

      Thanks for making me snort my coffee. Two problems: a Siemens S7 PLC is a PLC, not a SCADA system. They are extremely different things. It's like confusing a toaster and a kitchen. Everyone seems to miss this. Problem two: while up until a few years ago, PLC's didn't have network connectivity, so they couldn't be connected to ethernet (they now are routinely), SCADA systems are almost all ethernet capable, and in my experience, they are rarely even put on a separate VLAN, much less behind a firewall. Besides, Stuxnet was designed to transmit via USB thumbdrives and laptops which are used by everyone in industrial control systems. In my experience, control systems are the least secure systems on the planet, which is scary because they control stuff in the real world! If you want to follow the (very sad) security state of industrial control systems, follow ICS-CERT.

      --
      "I have never let my schooling interfere with my education." - Mark Twain
    12. Re:Firewalls by thegarbz · · Score: 1

      Serial is fine for many smaller projects such as control of a couple of turbines but breaks down quickly as the data points scale up. For a small partial-upgrading refinery you won't have the bandwidth to get the required data out of of the DCS into a historian and a protocol that can run over TCP becomes close to your only option, the most popular being OPC.

    13. Re:Firewalls by sjames · · Score: 1

      The SCADA controllers are managed by software that runs on a Windows box. That box is connected to the SCADA network. Often, that box is also connected to the internet through a firewall. Better hope they don't poke too many holes in the firewall for the convenience of management, such as, allowing remote desktop.

    14. Re:Firewalls by Anonymous Coward · · Score: 0

      And OPC don't play nicely with firewalls. At least, legacy OPC.

  3. It must of been difficult. by iiiears · · Score: 1

    Thousands of lines of code on likely more than one type of hardware. (Did they audit their compiler?) We are obliged to rely on technology from womb to tomb i hope they get better quality assurance in place.

    --
    15TW = 15,000 Nuclear Reactors. (Approx. one accident a month.)
  4. "Some" by symbolset · · Score: 4, Insightful

    The headline is missing the word "some" somewhere in it.

    --
    Help stamp out iliturcy.
    1. Re:"Some" by iiiears · · Score: 1

      Funny. It escaped me that some flaws are beneficial. This was leveraged to save lives. - Technology is surprises.

      --
      15TW = 15,000 Nuclear Reactors. (Approx. one accident a month.)
    2. Re:"Some" by symbolset · · Score: 1

      Stop that. We like to pretend.

      --
      Help stamp out iliturcy.
  5. I hope by Anonymous Coward · · Score: 0
    I hope the researcher said:

    Sure I'll postpone disclosure. If you pay me what you should have paid someone to do the amount of work I did.

    But he probably didn't.

  6. S7-1200 is a very low end plc, and only very new. by Anonymous Coward · · Score: 1

    The S7-1200 would never be used in a power station, it's too low end, and very new.
    I wouldn't use it anything more that a packaging machine.
    It's the model that is less than $1000 US.

  7. Siemens... by Anonymous Coward · · Score: 0

    ...bribing politicians since 1847.

  8. Attacking the Grid by Anonymous Coward · · Score: 0

    "For example, in March, Rubén Santamarta notified US ICS-CERT of a vulnerability in BroadWin WebAccess, a web browser-based HMI product. ICS-CERT forwarded the vulnerability information to BroadWin. Unfortunately, BroadWin was not able to validate the vulnerability and said it was false. So Mr. Santamarta publicly released details of the vulnerability including exploit code". link

  9. drinkypoo we detect cowardice & trolling from by Anonymous Coward · · Score: 0

    http://tech.slashdot.org/comments.pl?sid=2225174&cid=36390518

    The funniest part is that when you search google for slashdot site queries on drinkypoo, all of these questions drinkypoo runs from show up.

    (Hilarious: You're exposing yourself to the planet as a troll, drinkypoo, just by running away from that question in the link above).

  10. Re:drinkypoo we detect cowardice & trolling fr by Anonymous Coward · · Score: 0

    Why don't you two get a room?

  11. Siemens Fixes SCADA Flaws 29 by Anonymous Coward · · Score: 0

    This information is really helpful. visit my website"

  12. Re:S7-1200 is a very low end plc, and only very ne by Anonymous Coward · · Score: 0

    The S7-1200 would never be used in a power station, it's too low end, and very new.
    I wouldn't use it anything more that a packaging machine.
    It's the model that is less than $1000 US.

    There are vulnerabilities in the protocol as well which allow an attacker to do the exact same thing to the S7-300 and S7-400 which are used in power stations. The S7-1200 uses the same protocol ( i.e. replay attacks ) as the S7-300 and S7-400. Expect much more... The researcher is sitting on way more than what he disclosed. I saw a presentation he gave at a hacker space in Austin, TX. He was controlling every aspect of the PLC. It was like Stuxnet on steroids! Siemens is obviously trying to keep the issue with the 300/400 quiet so they don't get pwned.

  13. More fun to watch drinkypoo run by Anonymous Coward · · Score: 0

    like the trolling coward he is

  14. Re:S7-1200 is a very low end plc, and only very ne by Anonymous Coward · · Score: 0

    Try $100 with built-in Ethernet
    Compared to a S7-400, it is nothing but a smart relay