April 07, 2011 – All of us have heard about Stuxnet, the terrible cyber worm that is supposed to be targeting only Siemens PLCs used in plants all over the world.If you’ve not heard of it, here’s an excellent report.
Here is a video from a TED talk, given by Ralph Langner, a German Industrial Security expert about how they found out about the working of Stuxnet. ( For those of you who do not know TED, it stands for Technology, Entertainment and Design and is the world’s foremost organizer of conferences, where different experts in different fields talk about extremely interesting things to a general audience. TED has now made freely available the recordings of these conferences on the internet at http://www.ted.com).
So here’s what Ralph says about Stuxnet, the first known “mass market” industrial worm, but paradoxically targeted towards ONLY ONE consumer.
What are the implications of Stuxnet? It means that industrial sabotage, even disastrous industrial accidents are possible to be “generated” by such industrial worms. It means that even Distributed Control Systems or Emergency Shutdown systems, Safety Instrumented Systems and the like can be compromised and fooled into not preventing disasters. If say a foreign power, or even a rival business group were to target an important or critical industrial plant then all they need to do is to create a Stuxnet like worm that infiltrates the control system and causes enormous destruction, without leaving any footprint at all! The scariest part is that the control system or SIS need not be connected to the internet at all! A simple USB stick connected to an engineering station will do as well. Are we geared towards preventing such attacks? Do we, as industrial safety professionals, even think of it as a credible and present danger? Is it a recognized hazard? No, not at all. It’s time to wake up and smell the coffee.