Siemens Issues SIMATIC Security AdvisorySiemens Issues SIMATIC Security Advisory

Siemens emphasized that the SIMATIC S7 advisory is unrelated to the Stuxnet worm, which sent shockwaves through the security world in 2010 when it took down computers at an Iranian nuclear facility.

"There's some confusion out there," a Siemens spokesman says. "The Stuxnet worm only affected our WinCC SCADA system running on Microsoft operating systems. That was almost a year ago. We issued a patch that is able to detect and remove Stuxnet."

The newly issued advisory specifically addresses the S7-200, S7-1200, S7-300, and S7-400 SIMATIC controllers. "The potential exists for an attacker with access to the product or the control system communication link, to intercept and decipher the product's password and potentially make unauthorized changes to the product's operation," Siemens said in a statement.

To prevent such hacks, Siemens hasn't issued a patch, but rather a list of preventative measures. "We're providing recommendations for plant managers to keep their networks secure by engaging in good practices such as changing passwords and having network firewalls," the Siemens spokesman says.

Industrial awareness
Any security warning, even a proactive advisory like new one from Siemens, is sure to spark discussion and even a bit of confusion. Some of the online stories discussing the S7 advisory seem to conflate it with Stuxnet.