Over the last week or so I have been talking about how easy random stuxing of a control system could be. Yesterday Ralph Langner, the man responsible for identifying the man-in-the-middle component of the Stuxnet attack, demonstrated in his blog just how easy that attack could be. He provided us with just 4 lines of code for a Siemens PLC that would shut down the output of the PLC on a predetermined date.
This is, in effect, the bullet that an attacker would use to Stux a control system. Additional code could be hung on this bullet to make it more effective, but this could certainly disrupt manufacturing operations.
If this is the bullet, the attack still needs a method of getting it to the PLC. Ralph shares some thoughts on how that could be accomplished, but it is clear that little more than access to the network upon which the PLC resides is all that is required to deliver that bullet to the intended target.
Stuxing is moving just this much closer to reality.
Subscribe to:
Post Comments (Atom)
Posts
No comments:
Post a Comment