4 ms·
To my knowledge the targeted PLC lacked any form of protection when infected.
by tored 5y ago
To my knowledge the targeted PLC lacked any form of protection when infected.
- ok123456 5y agoIt spread first as windows worm that exploited several 0-days. If the host didn't have the Siemens PLC device drivers with a configuration that matched the exact configuration of what they were expecting for the centrifuges, they payload was dormant and it just replicated. Only if it matched would it patch the PLC's programming upon re-connection to fake reporting that the speed was normal while it was actually spinning out of control.
- tored 5y agoThus the security model of DOS is still a problem even without internet connection.