Siemens Says Desigo CC Files Flagged as Malware by Security Engines
ICS/OT
A PowerShell script included in patch files appears to be triggering false positives by multiple security engines.
Siemens is informing customers that patch files for its Desigo CC building management system are erroneously being flagged as malware by multiple cybersecurity solutions.
Desigo CC integrates HVAC, lighting, security, fire safety, power, and other building subsystems into a single open platform for centralized monitoring and control.
The industrial giant recently learned that patch files released for Desigo CC versions 7 through 9 are being detected as malicious by various antivirus engines, as confirmed by tests on VirusTotal.
Siemens says it’s working with cybersecurity vendors to address the inaccurate file classification, but it suspects that the false-positive detections are caused by a PowerShell script compiled as an executable.
The script is included in a ‘patchHelper’ shipped with Desigo CC patches. Siemens believes that file system operations, registry modifications, and execution with elevated...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
