Incident: Siemens Industrial Control Systems Vulnerabilities Lead to Critical Infrastructure Sabotage

Published Date: 2011-08-03

Postmortem Analysis
Timeline 1. The software failure incident involving vulnerabilities in Siemens industrial control systems, including a hard-coded password, was reported in an article published on August 3, 2011 [7303]. Therefore, the software failure incident likely occurred around July 2011.
System 1. Siemens industrial control systems, including the S7-300 PLC model [7303].
Responsible Organization 1. The software failure incident was caused by vulnerabilities in Siemens industrial control systems, including a hard-coded password, discovered by a security researcher [7303].
Impacted Organization 1. Siemens industrial control systems were impacted by the software failure incident [7303].
Software Causes 1. Hard-coded password "Basisk" in Siemens S7-300 PLC firmware [7303] 2. Vulnerabilities in several models of Siemens PLCs allowing attackers to reprogram the systems with malicious commands [7303] 3. Lack of authentication protection in Siemens PLCs allowing for replay attacks to bypass security measures [7303]
Non-software Causes 1. Lack of proper network segmentation and access control measures within the industrial control systems, allowing attackers to communicate directly with Siemens PLCs without needing to compromise the Step7 software [7303]. 2. Presence of hard-coded passwords in Siemens PLC firmware, such as the "Basisk" username and password, which were left embedded by engineers for testing purposes and not removed in subsequent systems [7303]. 3. Vulnerabilities in the architecture of the systems that allowed for replay attacks, where an attacker could intercept and replay legitimate commands to manipulate processes controlled by the PLCs [7303].
Impacts 1. The software failure incident exposed vulnerabilities in Siemens industrial control systems, including a hard-coded password, that could allow attackers to reprogram the systems with malicious commands to sabotage critical infrastructures and lock out legitimate administrators [7303]. 2. Attackers could communicate directly with Siemens PLCs without needing to compromise the Step7 software, potentially leading to unauthorized access, memory dumping, file deletion, and command execution [7303]. 3. The incident highlighted the lack of defense against a "replay attack," where attackers could intercept and replay commands to manipulate processes controlled by the PLCs, such as shutting down systems or causing malfunctions in critical infrastructure [7303]. 4. The vulnerabilities discovered by the security researcher could enable attackers to bypass authentication protection in the PLCs, reprogram them, issue "stop" commands to halt operations, and disable password protection, potentially leading to complete control over the PLCs [7303]. 5. The incident also revealed the presence of a hard-coded password, "Basisk," in some versions of Siemens S7-300 PLC firmware, which could grant unauthorized access to the PLCs and allow attackers to dump memory, gather intelligence, and potentially launch targeted attacks or worms [7303].
Preventions 1. Implementing proper access controls and authentication mechanisms to prevent unauthorized access to the PLCs, such as using strong passwords and multi-factor authentication [7303]. 2. Regularly updating and patching firmware and software to address known vulnerabilities and remove hardcoded passwords like "Basisk" [7303]. 3. Conducting thorough security assessments and audits of industrial control systems to identify and mitigate potential vulnerabilities before they can be exploited by attackers [7303]. 4. Educating employees on cybersecurity best practices, such as avoiding phishing attacks and not plugging in unknown USB sticks into critical systems [7303]. 5. Implementing network segmentation and monitoring to detect and prevent unauthorized network traffic and potential replay attacks [7303].
Fixes 1. Patching the vulnerabilities in the Siemens programmable logic controllers (PLCs) that allow attackers to reprogram the systems with malicious commands [7303]. 2. Implementing authentication mechanisms that cannot be easily bypassed, such as improving the hash generation and authentication process between Step7 machines and PLCs [7303]. 3. Restricting and limiting traffic or commands to specific IP addresses or specific computers with Step7 installed on them to prevent unauthorized communication with the PLCs [7303]. 4. Implementing session IDs that expire to prevent replay attacks on the PLCs [7303]. 5. Removing hardcoded passwords like "Basisk" from firmware versions of the PLCs and ensuring that testing credentials are not left in production systems [7303].
References 1. Security researcher Dillon Beresford with NSS Labs [7303]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) In the software failure incident reported in Article 7303, it was mentioned that Siemens had previously discovered a hard-coded password, "Basisk," in their S7-300 PLC firmware in 2009 and removed it from subsequent systems. However, the security researcher, Dillon Beresford, found that the password still existed in pre-2009 versions of the firmware, affecting the S7-300 PLCs [7303]. (b) The incident involving vulnerabilities in Siemens industrial control systems, as reported in Article 7303, highlighted that similar security issues had occurred before with Siemens products. The Stuxnet superworm, discovered in Iran the previous year, had targeted Siemens programmable logic controllers (PLCs) using the Step7 software. The newly discovered vulnerabilities by Dillon Beresford went beyond Stuxnet and affected several models of Siemens PLCs, allowing attackers to communicate directly with the PLCs without needing to compromise the Step7 software. This indicates a recurring issue with security vulnerabilities in Siemens products [7303].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the discovery of vulnerabilities in Siemens industrial control systems, particularly in the programmable logic controllers (PLCs). These vulnerabilities, including a hard-coded password "Basisk" and other security holes, were found in several models of Siemens PLCs, allowing attackers to reprogram the systems with malicious commands to sabotage critical infrastructures [7303]. (b) The software failure incident related to the operation phase is highlighted by the fact that attackers could communicate directly with Siemens PLCs without needing to compromise or use the Step7 software. This was possible because Siemens' PLCs do not restrict or limit which computers can communicate with them, and there are no rules in the PLC limiting traffic or commands to specific IP addresses or computers with Step7 installed on them. Additionally, the PLCs do not keep logs to identify the source of malicious commands received, making it difficult to trace back attacks initiated during operation [7303].
Boundary (Internal/External) within_system (a) The software failure incident reported in the article is primarily within_system. The vulnerabilities in Siemens industrial control systems, including hard-coded passwords and other security holes, were found within the system itself, allowing attackers to reprogram the systems with malicious commands and sabotage critical infrastructures [7303]. The vulnerabilities existed in several models of Siemens programmable logic controllers (PLCs) and were not caused by external factors but rather by flaws within the system's design and implementation.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The software failure incident in the Siemens industrial control systems was primarily due to vulnerabilities in the PLCs themselves, such as hard-coded passwords and lack of session expiration in the PLCs, allowing for replay attacks without human intervention [7303]. (b) The software failure incident occurring due to human actions: The vulnerabilities in the Siemens industrial control systems were discovered by a security researcher, Dillon Beresford, who found issues like hard-coded passwords and authentication bypass methods. Additionally, the presence of an Easter egg in the PLC firmware, depicting dancing chimpanzees and a German proverb, was likely introduced by developers for fun without the knowledge of Siemens [7303].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware can be seen in the discovery of vulnerabilities in Siemens industrial control systems, specifically in several models of Siemens programmable logic controllers (PLCs). One of the vulnerabilities included a hard-coded password embedded in the firmware of the S7-300 PLC model, which allowed unauthorized access and control of the device [7303]. (b) The software failure incident related to software can be observed in the various security holes and vulnerabilities found in Siemens PLCs, such as the ability for an attacker to communicate directly with a Siemens PLC without needing to compromise the Step7 software. These vulnerabilities allowed attackers to reprogram the PLCs, issue malicious commands, bypass authentication protection, and conduct replay attacks, ultimately leading to potential sabotage of critical infrastructures [7303].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The software failure incident reported in Article 7303 is malicious in nature. The vulnerabilities discovered in Siemens industrial control systems, including hard-coded passwords and other security holes, could allow attackers to reprogram the systems with malicious commands to sabotage critical infrastructures and even lock out legitimate administrators. The incident involves intentional actions by attackers to exploit these vulnerabilities for harmful purposes [7303]. (b) The software failure incident is also non-malicious in the sense that the vulnerabilities were not introduced with the intent to harm the system. For example, the hard-coded password "Basisk" was initially put in the system for testing purposes by developers, but they forgot to remove it, leading to a security vulnerability that could be exploited by attackers [7303].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The intent of the software failure incident: - The incident involved poor decisions made by Siemens engineers who embedded a hard-coded username and password ("Basisk") in some versions of firmware on its S7-300 PLC model, effectively creating a backdoor into the PLC that allowed attackers to reprogram the unit at will [7303]. - Siemens developers had initially put the hard-coded password in the system for testing purposes but forgot to remove it, leading to a significant security vulnerability [7303].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the discovery of vulnerabilities in Siemens industrial control systems, including a hard-coded password "Basisk" left embedded in some versions of firmware on its S7-300 PLC model. This hardcoded password provided a backdoor into the PLC, allowing an attacker to dump the device's memory, reprogram the unit, and potentially sabotage critical infrastructures [7303]. (b) The accidental aspect of the software failure incident is seen in the presence of an Easter egg in two versions of the S7-300 PLC firmware, which contained an html file depicting dancing chimpanzees and a German proverb. Siemens was not aware of this Easter egg in the firmware, and the security researcher is examining it to determine if it could potentially be used to send commands back to the PLC [7303].
Duration permanent (a) The software failure incident described in the article is more of a permanent nature. The vulnerabilities discovered in Siemens industrial control systems, including the hard-coded password, allowed attackers to reprogram the systems with malicious commands to sabotage critical infrastructures and lock out legitimate administrators [7303]. These vulnerabilities were inherent in the architecture of the systems and required more than just a patch to fix. Additionally, the lack of defense against a "replay attack" and the ability to communicate directly with the PLC without needing to use Siemens Step7 system indicate a fundamental flaw in the system's design, making it a permanent issue unless significant changes are made to the system's architecture and security protocols.
Behaviour omission, value, other (a) crash: The incident described in the article does not involve a crash where the system loses state and does not perform any of its intended functions. Instead, it focuses on vulnerabilities in Siemens industrial control systems that could allow attackers to reprogram the systems with malicious commands to sabotage critical infrastructures [7303]. (b) omission: The vulnerabilities discovered in Siemens PLCs could lead to the omission of performing intended functions. Attackers could bypass authentication protection in the PLCs, reprogram them, issue a "stop" command to halt them, or replay commands to sabotage processes controlled by the PLCs [7303]. (c) timing: The incident does not involve timing failures where the system performs its intended functions too late or too early. Instead, it focuses on security vulnerabilities that could allow attackers to communicate directly with Siemens PLCs and manipulate their operations [7303]. (d) value: The vulnerabilities identified in Siemens PLCs could lead to failures in the system performing its intended functions incorrectly. Attackers could reprogram the PLCs, issue malicious commands, or disable authentication protection, potentially causing the system to operate in unintended ways [7303]. (e) byzantine: The incident does not directly involve a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. However, the vulnerabilities in Siemens PLCs could allow attackers to manipulate the systems in various ways, potentially leading to inconsistent or unexpected behaviors [7303]. (f) other: The other behavior observed in this incident is the presence of a hardcoded password, "Basisk," in some versions of Siemens PLC firmware. This password, left embedded by Siemens engineers, acts as a backdoor into the PLC, allowing unauthorized access and control over the device, which is a significant security flaw [7303].

IoT System Layer

Layer Option Rationale
Perception actuator, processing_unit, network_communication, embedded_software (a) sensor: The software failure incident discussed in the articles does not directly relate to sensor errors. (b) actuator: The vulnerabilities discovered in Siemens industrial control systems, particularly in the PLCs, could potentially lead to failures due to contributing factors introduced by actuator errors. Attackers could reprogram the systems with malicious commands to sabotage critical infrastructures, such as causing the speed of motors or rotors to increase or causing valves to open or close on a pipeline [7303]. (c) processing_unit: The vulnerabilities found in Siemens PLCs, including hard-coded passwords and other security holes, could result in failures due to contributing factors introduced by processing errors. Attackers could communicate directly with a PLC, dump memory, delete files, execute commands, reprogram the unit, and disable authentication protection, giving them control over the PLCs [7303]. (d) network_communication: The software failure incident is closely related to failures due to contributing factors introduced by network communication errors. Attackers could bypass authentication protection, issue stop commands to halt PLCs, intercept and replay commands between systems, and communicate directly with PLCs without restrictions on traffic or commands to specific IP addresses or computers [7303]. (e) embedded_software: The vulnerabilities discovered in Siemens PLCs, such as hard-coded passwords and lack of defense against replay attacks, point to failures due to contributing factors introduced by embedded software errors. Attackers could exploit these vulnerabilities to gain unauthorized access, reprogram PLCs, disable authentication protection, and conduct replay attacks, potentially leading to system compromise and sabotage [7303].
Communication connectivity_level The software failure incident reported in the articles is related to the communication layer of the cyber physical system that failed at the connectivity level. The vulnerabilities discovered in Siemens industrial control systems, particularly in the programmable logic controllers (PLCs), allowed attackers to communicate directly with the PLCs without needing to compromise the Step7 software. Attackers could bypass authentication protection in the PLCs, reprogram them, issue "stop" commands to halt them, and even conduct replay attacks to sabotage processes controlled by the PLCs [7303]. These vulnerabilities were exploited at the network level, enabling attackers to interact with the PLCs without restrictions on traffic or commands to specific IP addresses or computers with Step7 installed on them [7303].
Application TRUE The software failure incident described in the article [7303] was related to vulnerabilities in Siemens industrial control systems, specifically in several models of Siemens programmable logic controllers (PLCs). These vulnerabilities included a hard-coded password, allowing attackers to reprogram the systems with malicious commands to sabotage critical infrastructures. The vulnerabilities allowed attackers to communicate directly with a Siemens PLC without needing to compromise the Step7 software, which is used to monitor and program Siemens PLCs. The security researcher discovered multiple security holes, including the hard-coded username and password "Basisk" in some versions of firmware on the S7-300 PLC model, which provided a backdoor access to the PLC. Additionally, the vulnerabilities allowed for bypassing authentication protection in the PLCs, issuing a "stop" command to halt them, and conducting replay attacks to intercept and replay commands to manipulate the PLCs. These issues highlight failures at the application layer of the cyber physical system due to bugs, security flaws, and incorrect usage of the systems.

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) There is no mention of people losing their lives due to the software failure incident in the articles. (b) There is no mention of people being physically harmed due to the software failure incident in the articles. (c) The software failure incident did not impact people's access to food or shelter. (d) The software failure incident impacted people's material goods, money, or data. The vulnerabilities in Siemens industrial control systems could allow attackers to reprogram the systems with malicious commands to sabotage critical infrastructures and even lock out legitimate administrators [7303]. (e) There is no mention of people having to postpone an activity due to the software failure incident in the articles. (f) Non-human entities were impacted due to the software failure incident. The vulnerabilities in Siemens PLCs could lead to sabotage of processes controlled by the PLCs, such as causing the speed of motors or rotors to increase on a centrifuge or causing valves to open or close on a pipeline [7303]. (g) There were observed consequences of the software failure incident, such as the potential for attackers to communicate directly with Siemens PLCs without needing to compromise the Step7 software, bypass authentication protection, and issue malicious commands [7303]. (h) The articles discuss potential consequences of the software failure incident that did not occur, such as the ability for an attacker to replay captured traffic repeatedly unless the PLC crashes and an administrator physically re-cycles it [7303]. (i) There is no mention of other consequences of the software failure incident in the articles.
Domain manufacturing (a) The failed system was intended to support the manufacturing industry. The vulnerabilities in Siemens industrial control systems, particularly in programmable logic controllers (PLCs), were targeted at critical infrastructures, commercial manufacturing plants, and facilities like nuclear plants, pharmaceutical plants, and automobile manufacturing plants [7303].

Sources

Back to List