DOS, Backdoor, and Easter Egg Found In Siemens S7

chicksdaddy writes with a post in Threat Post. From the article: "Dillon Beresford used a presentation at the Black Hat Briefings on Wednesday to detail more software vulnerabilities affecting industrial controllers from Siemens, including a serious remotely exploitable denial of service vulnerability, more hard-coded administrative passwords, and even an easter egg program buried in the code that runs industrial machinery around the globe. In an interview Tuesday evening, Beresford said he has reported 18 separate issues to Siemens and to officials at ICS CERT, the Computer Emergency Response Team for the Industrial Control Sector. Siemens said it is readying a patch for some of the holes, including one that would allow a remote attacker to gain administrative control over machinery controlled by certain models of its Step 7 industrial control software."

Re:Germans and humour...

[geekoid]

Adding more code to critical systems is NOT COOL. More bugs, more exploit. SCADA systems need to be developed by people who understand and enforce proper engineering and professionalism. This teenage hacker shot does NOT belong there.

IF the software industry would start enforcing engineering principles, most of these messes would even exist.

Re:Germans and humour...

[Infiniti2000]

Easter eggs are cool

No, Easter eggs (in software) are not cool. They cause problems in many ways.

1. Once discovered, they cause embarrassment to the employer.
2. They're a waste of resources (money) to the employer. The waste includes: time and money to actually implement or at a minimum opportunity cost for not working on real products, money spent removing the eggs, money spent repairing field items or possibly recall.
3. If discovered, the employee faces potentially significant consequences. Obviously, this is likely termination, but depending on the length of employment and other facts, this could also severely affect future employment opportunities.
4. This may do irreparable harm to the reputation of the employer. This could be long-lasting, too, as evidenced by your recollection of the Excel egg.
5. The egg itself may be a source of a security vulnerability.
6. The egg itself may have bugs and (besides a security vulnerability as mentioned above) cause a crash of the system.

Re:Only quickly scanned TFA....

[Anonymous Coward]

No, those systems should be on an isolated network. If they are internet facing, or there is an internet facing computer also on that network, then the utility company deserves all the havoc that comes to them.

Re:Gee thanks Mossad

[Anubis350]

I'm going to argue that Siemens created the problem by failing to secure their work against some rather embarrassing vulnerabilities. You think that if Stuxnet hadn't been created no-one would have eventually found these? Possible, I suppose, but doubtful, I mean someone had to be thinking along those lines in order to create stuxnet in the first place, and if one team can than so can another

Re:Germans and humour...

[Anonymous Coward]

As I'm myself working for a grid operator I'm allowed to say that easter eggs in word processors and spreadsheets are one thing, and easter eggs in critical infrastructure control systems are quite another. Hopefully everyone can agree an easter egg in the software that controls the space shuttle would not be amusing either...

Re:Oh Good, A Backdoor

[tlhIngan]

Actually, I'd hazard a guess that MOST SCADA systems are vulnerable. These things weren't designed with security in mind - they're supposed to run off closed networks separated from the Internet (easily done - most of these things predate the Internet).

Heck, the biggest "security issue" would've been access via OPC ("OLE for Process Control" - yes, that same stuff Microsoft touted - "Object Linking and Embedding" from Windows 3.x).

And yeah, most industrial entities probably lack the proper IT team and infrastructure - after all, most of their work involved keeping the network up and running for the controllers, keeping OPC working. The someone demands Internet connectivity on their desktop and they set up routers and firewalls (and don't know about stuff like data diodes).

Basically, stuff that was never designed for security ends up on the Internet.