Stuxnet - Siemens S7 Clear Memory

One of the issues with Stuxnet is that in certain cases it will directly modify the PLC firmware and not just user logic. Erasing the CPU memory, including the MMC card, would completely clear out the memory on the S7 controllers and remove the worm.

In case you are not certain how to do this, we have provided the relevant section from the Siemens CPU 31xC and CPU 31x: Installation Manual.

Please remember that you must be certain that the STEP7 project file used to download the program after the memory reset is uninfected, otherwise you start all over again.  Stuxnet hid in STEP7 project files it to re-infect the ES when the project file was opened (Special thanks to Joel Langill for help confirming this).

Downloadable PDF Data sheet for the Modbus TCP Enforcer - describes features and benefits for modbus security Siemens S7 Clear Memory - Application Note (728kb)

Related Links

Stuxnet Central - a hub for the information that Tofino Security has created regarding Stuxnet, along with links to key industry materials

Tofino Industrial Security Solution Product Information