New virus targets industrial secrets

Siemens says a new Windows virus takes aim at its SCADA management systems

Siemens is warning customers of a new and highly sophisticated virus that targets the computers used to manage large-scale industrial control systems used by manufacturing and utility companies.

Siemens learned about the issue on July 14, Siemens Industry spokesman Michael Krampe said in an e-mail message Friday. "The company immediately assembled a team of experts to evaluate the situation. Siemens is taking all precautions to alert its customers to the potential risks of this virus," he said.

Security experts believe the virus appears to be the kind of threat they have worried about for years -- malicious software designed to infiltrate the systems used to run factories and parts of the critical infrastructure.

Some have worried that this type of virus could be used to take control of those systems, to disrupt operations or trigger a major accident, but experts say an early analysis of the code suggests it was probably designed to steal secrets from manufacturing plants and other industrial facilities.

"This has all the hallmarks of weaponized software, probably for espionage," said Jake Brodsky, an IT worker with a large utility, who asked that his company not be identified because he was not authorized to speak on its behalf.

Other industrial systems security experts agreed, saying the malicious software was written by a sophisticated and determined attacker. The software does not exploit a bug in the Siemens system to get onto a PC, but instead uses a previously undisclosed Windows bug to break into the system.

The virus targets Siemens management software called Simatic WinCC, which runs on the Windows operating system.

"Siemens is reaching out to its sales team and will also speak directly to its customers to explain the circumstances," Krampe said. "We are urging customers to carry out an active check of their computer systems with WinCC installations and use updated versions of antivirus software in addition to remaining vigilant about IT security in their production environments."

Late Friday, Microsoft issued a security advisory warning of the issue, saying it affects all versions of Windows, including its latest Windows 7 operating system. The company has seen the bug exploited only in limited, targeted attacks, Microsoft said.

The systems that run the Siemens software, called SCADA (supervisory control and data acquisition) systems, are typically not connected to the Internet for security reasons, but this virus spreads when an infected USB stick is inserted into a computer.

Once the USB device is plugged into the PC, the virus scans for a Siemens WinCC system or another USB device, according to Frank Boldewin, a security analyst with German IT service provider GAD, who has studied the code. It copies itself to any USB device it finds, but if it detects the Siemens software, it immediately tries to log in using a default password. Otherwise it does nothing, he said in an e-mail interview.

That technique may work, because SCADA systems are often badly configured, with default passwords unchanged, Boldewin said.

The virus was discovered last month by researchers with VirusBlokAda, a little-known antivirus firm based in Belarus, and reported Thursday by security blogger Brian Krebs.

To get around Windows systems that require digital signatures -- a common practice in SCADA environments -- the virus uses a digital signature assigned to semiconductor maker Realtek. The virus is triggered anytime a victim tries to view the contents of the USB stick. A technical description of the virus can be found here (pdf).

It's unclear how the authors of the virus were able to sign their code with Realtek's digital signature, but it may indicate that Realtek's encryption key has been compromised. The Taiwanese semiconductor maker could not be reached for comment Friday.

In many ways, the virus mimics proof-of-concept attacks that security researchers like Wesley McGrew have been developing in laboratories for years. The systems it targets are attractive to attackers because they can provide a treasure-trove of information about the factory or utility where they're used.

Whoever wrote the virus software may have been targeting a specific installation, said McGrew, founder of McGrew Security and a researcher at Mississippi State University. If the authors had wanted to break into as many computers as possible, rather than a specific target, they would have tried to exploit more popular SCADA management systems such as Wonderware or RSLogix, he said.

According to experts there are several reasons why someone might want to break a SCADA system "There may be money in it," McGrew said. "Maybe you take over a SCADA system and you hold it hostage for money."

Criminals could use the information from a manufacturer's WinCC system to learn how to counterfeit products, said Eric Byres, chief technology officer with security consultancy Byres Security. "This looks like a grade A case of focused IP-harvesting," he said. "This looks focused and real."

Robert McMillan covers computer security and general technology breaking news for The IDG News Service. Follow Robert on Twitter at @bobmcmillan. Robert's e-mail address is robert_mcmillan@idg.com

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags AutomotivesecurityManufacturingVirusBlokAdasoftwareenergyindustry verticalsmalwareSiemens Industry

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?