Analyzing Stuxnet with Siemens

Two security experts at the 2011 Siemens Automation Summit talked about lessons learned during the Stuxnet affair.


ISS SourceThey walked into the Lion’s Den and came out unscathed. Two security experts went into the 2011 Siemens Automation Summit and talked about lessons learned during the Stuxnet affair.

Joel Langill, chief security officer at SCADAHacker, and Eric Byres, chief technology officer at Byres Security, gave a talk Tuesday at the 2011 Siemens Automation Summit entitled “How Stuxnet spreads: A study of infection paths in best practice systems."

“Stuxnet was a well engineered worm,” Byres said. “This attack could have happened to any one of the vendors. It just happened the Iranian nuclear site was running Siemens products. Siemens was the bystander shot in the middle of the gunfire.”

As a result of his highly complex and impressive piece of software, security professionals will be studying Stuxnet for years to come.

“Stuxnet is dead and gone,” Byres said. “Why study Stuxnet? Because the bad guys learned a lot from Stuxnet and we have to do the same. How do I protect a client from the son of Stuxnet?”

When you really look at it, the worm was very clean software. “It was amazingly well written software, Byres said. “It was a better grade of software than what is installed in most commercial systems.”

The big news when the world first became aware of Stuxnet was people believed the worm entered control systems via a USB key. While that may have happened, it doesn’t seem right that users would ban the use of USB drives. They do serve a quality purpose.

“Don’t think of this as a USB problem,” Langill said. “It was a removable media problem.” One of the things you have to remember, Langill said, is this was not an Internet-based attack. Instead, this all happened on the local area network.

The worm did infect some 100,000 computers and infected at least 22 manufacturing sites, which Byres actually believes was more around the 50 number.

One of the shocking thoughts about Stuxnet was the worm was able to penetrate and damage a nuclear site, which has some of the toughest security in any industry. What happens, Byres asked, when another worm comes around and takes over a less secure environment?

The odd part of the entire attack was Siemens does have a solid layered security architecture in the systems targeted for attack.

As mentioned the attack could have happened on a USB stick, however it could also have come as a result of infected project files, transmitted in an email, an infected laptop among other possibilities.

“If someone wants to put a virus on your site, they will be able to,” Byres said. “It depends on what you do with that afterward is what is important. There was so many ways it could spread.”

Some of the things the industry learned from Stuxnet was modern industrial control systems or SCADA systems are highly complex and interconnected; there are multiple pathways; you have to assume an air gap is unrealistic; focusing security on specific obvious pathways is not a good idea, and users have to complete a simple overall holistic view of the system, Byres said.

- Edited by Amanda McLeman, Plant Engineering,

No comments
Consulting-Specifying Engineer's Product of the Year (POY) contest is the premier award for new products in the HVAC, fire, electrical, and...
Consulting-Specifying Engineer magazine is dedicated to encouraging and recognizing the most talented young individuals...
The MEP Giants program lists the top mechanical, electrical, plumbing, and fire protection engineering firms in the United States.
Salary survey: How much are you worth?; Dedicated outdoor air systems; Energy models and lighting
Fire, life safety in schools; Fire protection codes; Detection, suppression, and notification; 2015 Commissioning Giants; Emergency and standby power in hospitals
HVAC and building envelope: Efficient, effective systems; Designing fire sprinkler systems; Wireless controls in buildings; 2015 Product of the Year winners
Designing positive-energy buildings; Ensuring power quality; Complying with NFPA 110; Minimizing arc flash hazards
Implementing microgrids: Controlling campus power generation; Understanding cogeneration systems; Evaluating UPS system efficiency; Driving data center PUE, efficiency
Optimizing genset sizing; How the Internet of Things affects the data center; Increasing transformer efficiency; Standby vs. emergency power in mission critical facilities
As brand protection manager for Eaton’s Electrical Sector, Tom Grace oversees counterfeit awareness...
Amara Rozgus is chief editor and content manager of Consulting-Specifier Engineer magazine.
IEEE power industry experts bring their combined experience in the electrical power industry...
Michael Heinsdorf, P.E., LEED AP, CDT is an Engineering Specification Writer at ARCOM MasterSpec.