Siemens working on vulnerability that threatens critical infrastructure

Dillon Beresford

After two researchers agreed to keep under wraps vulnerabilities they discovered in hardware critical to the operation of many industrial infrastructure systems, the maker of that hardware, Siemens, announced it's working on a fix for the flaw.

“Siemens has been made aware of the irregularities in its Programmable Logic Controllers discovered by NSS Labs, and we appreciate the responsible disclosure provided by the company and its high level of professional integrity," the company headquartered in Berlin, Germany, said in a statement provided on May 20 to Government Security News.

"Siemens is working together with both NSS Labs and ICS-CERT, and we are in the process of testing patches and developing mitigation strategies," it continued.  "Siemens and ICS-CERT have validated that direct access to the product within an automation network is required for these irregularities to take place within the PLC." 

"We encourage end users to use internal measures to protect their own automation security and offer guidance through our industrial security services and security management services," it added. "We are in constant contact with our customers as to updates regarding this issue.”

Programmable Logic Controllers are a key component in Supervisory Control and Data Acquisition (SCADA) systems which are used to monitor and control industrial, infrastructure and facility-based processes — such things as fabrication, waste water treatment, oil and gas pipeline control, and electric power generation and transmission.

The vulnerability in the Siemens hardware came to light after two NSS Labs researchers, Dillon Beresford and Brian Meixell, canceled a presentation on the flaw scheduled for May 18 at TrackDownCon in Dallas, TX.

In a blurb about their presentation, the researchers promised to "demonstrate how motivated attackers could penetrate even the most heavily fortified facilities in the world, without the backing of a nation state."

The researchers backed out of their TrackDownCon forum after consulting with ICS-CERT, which is part of the U.S. Department of Homeland Security (DHS). "We went to them," NSS CEO Rick Moy explained. "It was a very collaborative process."

"When people say DHS, folks get this image of guys in black suits showing up," he added. "That wasn't the situation."