4 ms·
I work with PLCs and read the paper the article links to and it looks legitimate. They do note that the PLC program is stopped for 10 seconds when the worm inf
by snowwindwaves 10y ago
I work with PLCs and read the paper the article links to and it looks legitimate. They do note that the PLC program is stopped for 10 seconds when the worm infects a new host which may or may not give it away depending on the process the PLC is controlling.
I guess I'll start putting a password on my programs, although they point out that the protection was all based in the IDE and could be removed by writing directly to PLC.
- janci 10y agoPassword protection enforced at the client seems to be Siemens way of doing security. I discovered this flaw in their heat pump controller when I was working on monitoring system for the pump. I had to disassemble their Java applet that was used to show temperature information and configure the controller to replicate the protocol used. Password protection? Client reads the password from the controller and compares it to user-provided string. If there is a match, client continues to read/write data, if not, client asks for password again. No password verification on controller at all.
- rasz_pl 10y agohey, at least they started moving away from passwords hardcoded in firmware.