The automation company, Schneider Electric, reveals a weakness in its engineering system. This weakness unintentionally enables cyber criminals to remotely interfere with the company’s operations.
Programmable logic controllers or PLCs are special computers or machines that have the ability to control and monitor the mechanical processes in manufacturing plant, factories, refineries and even public utilities like power stations. For Schneider Electric, these hardware devices are operated with a software called Unity Pro. This computer program provides the interface for engineers to maneuver the PLCs.
The software package comes with a simulator which the engineers can test the code for errors before actually installing them on those industrial controllers. It is in this simulator that the vulnerability has been discovered. A cybersecurity firm called Indegy was able to unearth this flaw. They explained that the simulator is open for hackers to execute malicious programming scripts on any Windows computer where the software is installed. These codes could give the hackers the ability to debug the program which essentially gives them the opportunity to compromise the software.
Because Unity Pro is primarily installed on PLCs, a breach on the software can enable the raiders to reformulate the instruction codes on this hardware so that it disrupts the production and other critical processes. The antagonist will also get the chance to sneak into classified files and gather information on the company’s intellectual property.
The Indegy researchers also noted that the simulator uses a specific port on the network to communicate data. This permits engineers to deliver control codes compiled in a corrective format to the simulator. Any computer can easily send APX files to the Unity Pro simulator. They don’t even need authentication to do that. Hence, the researchers discovered that they can write this APX files so that it can contain malicious registry instructions to disturb the workstations normal functions.
The real matter of concern is the ability to debug the software which comes together with the process. The simulator does not come with a sandbox code for testing.
Moreover, industrial workstations usually have security privileges. They often come exempt from certain security measures such as firewalls. Schneider Electric assures, however, that a security breach can only be possible when only the only the simulator program is running on the PLC or if it is not protected with a password.
Hence, the company made sure that in the latest release of the software, the simulator is not permitted to be set in motion without an associated program. Nevertheless, the user has the option to choose which application to run the simulator and select a password to protect the program.
The automation company is also confident that potential assailants will not be able to easily access just any computer on the network because of the strong security measures employed in its overall IT network.
