C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Understanding the Retirement of SimaticRights.exe in SIMATIC PCS 7 V9.0 - Stuxnet Legacy to Native Security Hardening

Understanding the Retirement of SimaticRights.exe in SIMATIC PCS 7 V9.0 - Stuxnet Legacy to Native Security Hardening

The utility SimaticRights.exe is absent from SIMATIC PCS 7 V9.0 installation DVDs because it is completely obsolete and has been retired by Siemens. SimaticRights.exe was a specialized interim security hardening tool introduced during the WinCC V7.0 SP3 / PCS 7 V7.1 era following the 2010 Stuxnet incident to retrofit existing legacy project shares and SQL database access rights with restricted Windows user permissions. Starting in PCS 7 V8.2 and fully established in V9.0 and V9.1, automated security hardening is natively embedded into the installation pipeline via Simatic Security Control (SimaticSecurityControl.exe), Windows 10/Server 2016 security templates, and hardened SQL Server 2014/2017 permissions, eliminating the need for manual permission patching.

Table of Contents

Historical Context: The Stuxnet Incident and Legacy Security Hardening

In 2010, the industrial automation landscape changed permanently with the discovery of the Stuxnet worm. Stuxnet targeted Siemens Step 7 and WinCC systems by exploiting vulnerabilities in Windows shortcut handling (.lnk), hardcoded database default passwords, and overly permissive local Windows file sharing permissions (where project folders were shared with Everyone: Full Control).

In response, Siemens launched an aggressive security hardening campaign across the SIMATIC software portfolio. For existing installations running WinCC V7.0 and PCS 7 V7.1, Siemens released the SimaticRights.exe utility to retrofit existing plant project directories with strict Windows Discretionary Access Control Lists (DACLs).

What Did SimaticRights.exe Do in PCS 7 V7.0 / V7.1?

In legacy installations (WinCC V7.0 SP3 DVD under Tools\SimaticRights\), running SimaticRights.exe performed the following automated security remediation tasks:

  1. Stripping 'Everyone' Permissions: Scanned all project directories (*.mcp, GraCS, SQL database folders) and removed generic Everyone and Authenticated Users access.

  2. Injecting SIMATIC HMI Security Group: Applied explicit NTFS permissions granting read/write rights strictly to members of the local Windows security group SIMATIC HMI.

  3. SQL Server Access Control: Re-authenticated SQL Server database instance permissions, restricting direct database queries to authenticated Siemens processes (CCAlgRtServer, PdlRuntime).

Architectural Evolution: Modern Security in PCS 7 V8.2, V9.0, and V9.1

Engineers upgrading to SIMATIC PCS 7 V9.0 searching for SimaticRights.exe cannot find it because the software architecture was completely redesigned to be Secure by Default:

  • Integrated Permissions at Project Creation: When SIMATIC Manager V9.0 creates a new project or migrates an older project, it creates the project folders with hardened NTFS permissions automatically.

  • Encrypted Simatic Shell: Inter-station communication on the Terminal Bus uses encrypted multicast tokens, blocking unauthorized station eavesdropping.

  • Modern Windows OS Security: Operating under Windows 10 Enterprise LTSB and Windows Server 2016/2019 enforces User Account Control (UAC), mandatory code signing, and AppLocker compatibility.

The Role of Simatic Security Control (SimaticSecurityControl.exe)

The functional successor to manual security patching tools is Simatic Security Control:

  • Automatically executed at the conclusion of every PCS 7 installation.

  • Configures Windows Firewall exception rules for all necessary Siemens ports (OPC, Terminal Bus, SQL Server, NetPro).

  • Configures DCOM access permissions and launch limits for SIMATIC HMI.

  • If network policies or group policies alter Windows firewall or DCOM settings, an engineer can rerun SimaticSecurityControl.exe from the Start Menu (Siemens Automation > Security Control) to restore certified factory security rules in seconds.

Comparative Evolution Matrix: Legacy SimaticRights vs Modern Security Hardening

The following table compares the legacy SimaticRights.exe utility against modern PCS 7 V9.0 security mechanisms:

Security DimensionLegacy Era (WinCC V7.0 / PCS 7 V7.1)Modern Era (PCS 7 V9.0 / V9.1)Security UtilitySimaticRights.exe (Manual execution)SimaticSecurityControl.exe (Automated engine)Project File DACLsInitially open (Everyone), patched laterHardened by default upon project creationDatabase SecurityStatic SQL logins, retrofitted by toolSQL Server 2014/2017 Windows Authentication + Virtual Service AccountsTerminal Bus SecurityUnencrypted broadcast tokensEncrypted Simatic Shell Communication (AES)Operating SystemWindows XP / Windows Server 2003Windows 10 Enterprise LTSB / Windows Server 2016/2019Manual Action Required?Yes (Run utility after installation)No (Natively embedded into setup pipeline)

Step-by-Step Procedure to Verify System Security Hardening in PCS 7 V9.0

To ensure that an Engineering Station or OS Server is properly hardened without legacy utilities, follow these steps:

  1. Verify Windows Security Group Memberships:
    - Open Computer Management (compmgmt.msc) -> Local Users and Groups > Groups.
    - Verify that your engineering user belongs to SIMATIC HMI, Siemens TIA Engineer, and Administrators.
    - Confirm that unauthorized guest accounts are disabled.

  2. Execute Simatic Security Control:
    - Click Windows Start -> search for Simatic Security Control.
    - Click Make settings.
    - The tool audits and repairs Windows Firewall, DCOM, and registry settings, reporting green checkmarks.

  3. Verify Project Folder NTFS Security:
    - In Windows Explorer, right-click your project directory -> Properties > Security.
    - Verify that group SIMATIC HMI has Modify / Full Control permissions, and Everyone is absent.

  4. Verify Encrypted Simatic Shell Communication:
    - Open Windows Explorer -> right-click Simatic Shell -> Settings....
    - Ensure Encrypted Communication is active with an aligned plant encryption password.

Verification

Verify security hardening compliance through these checks:

  1. Confirm that Simatic Security Control reports: 'Security settings were successfully applied'.
  2. In Windows Defender Firewall with Advanced Security, verify that inbound rules for Siemens products (e.g., CCRemoteService, SQL Server) are active.
  3. In SIMATIC Manager, open your multiproject. Verify that compiling, downloading, and remote OS management execute cleanly without DCOM access denied errors.
  4. Confirm that external network vulnerability scanners (e.g., Nessus) detect no open, unauthenticated project file shares.

Limitations and Operational Precautions

  • Do Not Run Legacy Tools on Modern Systems: Never copy SimaticRights.exe from an old V7.0 DVD and run it on Windows 10 or PCS 7 V9.0. The legacy utility can corrupt modern Windows 10 security descriptors and SQL Server 2017 service accounts.
  • Domain Group Policy Conflicts: In enterprise corporate networks, domain GPOs must not strip the SIMATIC HMI group's local rights. Coordinate with plant IT to place industrial PCs in dedicated, policy-restricted Organizational Units (OUs).
  • Antivirus Integration: Whitelist certified Siemens directories according to official PCS 7 antivirus whitepapers to avoid file-locking conflicts.

Engineer FAQ

Why was SimaticRights.exe discontinued?

It was discontinued because its functionality was integrated natively into the core PCS 7 installation engine and Simatic Security Control, making a standalone manual utility obsolete.

Was SimaticRights.exe present on PCS 7 V8.2 DVDs?

On some V8.2 installation media, it was retained as a legacy utility under Additional_Products for backward-compatibility migrations from V7.0, but it was not required for native V8.2 projects.

What is SimaticSecurityControl.exe?

SimaticSecurityControl.exe is the modern automated security tool delivered with PCS 7 and TIA Portal that configures Windows Firewall, DCOM permissions, and registry keys for industrial communication.

Can I run Simatic Security Control without restarting?

Yes. Simatic Security Control applies firewall and registry settings dynamically. A system restart is rarely required unless DCOM core services are refreshed.

Where can I find the Siemens Industrial Cybersecurity Guidelines?

Siemens publishes comprehensive cybersecurity guidelines compliant with IEC 62443 on the Siemens Industry Online Support portal.

Technical References

Related Articles

Related Tags

  • SimaticRights
  • Simatic Security Control
  • Cybersecurity
  • PCS 7 V9.0
  • DCOM
  • Windows Firewall
  • SIMATIC HMI
6 respuestas