hello friends

My s7-300 (314c-2pn/dp) seems to have been attacked by malware. How can this be fixed? 

system has abnormal and out-of-program reactions.

 RE: Do Androids Dream of Electric Sheep?

elc.siemens

hello friends

My s7-300 (314c-2pn/dp) seems to have been attacked by malware. How can this be fixed? 

system has abnormal and out-of-program reactions.

It is an unlikely case that the PLC has malware. Have you uploaded the program and compare it with a known offline sample? Hard to say from only your description. Malware is not impossible for your PLC but less likely. Industrial PCs are more vulnerable. A targeted attack is more likely but only for a open system.

More common, more likely scenarios:

• Short circuits or faulty sensors trigger actions that is not expected
• The program process triggers that happen without regard of legal sequence.
• Short circuit or EMF interference to actuators.
• Bug in software that came forward because of some change in the system (like move sensor or sensor trigger more than once because of material density)
  
• Mechanical system out of alignment or vibration that interfere with encoder triggering.
• Feature built in by manufacturer to force a call-out

• Improper use of indirect addressing which override process function or data.
• Processor or memory on PLC is damaged or storage is corrupt. Age or environmental influences (vibration, power fluctuations, - )
• Damaged communication partners.
• (Password protected) Libraries supplied by equipment suppliers are flawed.
  

• Open access to PLC is used by someone to hack the PLC with forced commands.
  
• SCADA or PC program is accessing the wrong data areas (and perhaps wrong PLC).
• The PC that loaded the program is infected with malware. The malware added code (password protected) blocks into the project that was not placed by the designer.
  

Contact a Siemens Professional if your heart is set on the malware option.

Hello elc.siemens,

this is an information created by Siemens ProductCERT:

Siemens ProductCERT

Siemens ProductCERT is happy to help you for topics related to security incidents and vulnerabilities in Siemens products.

Please find a description here: https://siemens.com/cert and please contact productcert@siemens.com for an investigation if this is what you are looking for.

Best regards
CS Moderator

Hello AutoGen_1801304

thank you for your detailed information.

Best regards

Kianoush Ashrafi