# Security Challenges in Industry 4.0 PLC Systems
## 3 Risk Sources in OT Systems
### Software in Network Systems
#### 3.3.4 Other Software in Computers and Servers
The problem of up-to-date software related to servers concerns mainly the classic construction of an industrial control network, based on a server located inside the plant (in the local communication network). Cloud-based information-processing systems usually offer the latest technological solutions related to the software of their web servers. Nevertheless, outdated software of industrial servers affects the cybersecurity of internal networks in a similar way as the up-to-date software of PCs operating with the use of this network. A significant amount of malware is contained in devkit for network systems based on old Windows Server systems. **Anti-Virus Software**  
The basic tool for protection against malware on PCs is antivirus software. The vast majority of successfully carried out hacking attacks related to industrial networks began by infecting a PC resulting from opening an infected attachment in an e-mail or visiting a properly prepared website [72]. Despite this, as many as 57% of production units do not have anti-virus software in their security system [70]. Additionally, as the CyberX report shows, as many as 67% of companies with antivirus software have exclusive automatic updates of the malware database. Due to the dynamic cooperation of software producers with the management and reporting units on potentially dangerous situations established under the NIS Directive, fear of being up-to-date with the list of threats has become a much simpler task and one of the most important elements of cybersecurity. **Flame**  
Flame is a complex malware discovered in 2012 by Kaspersky Lab [90]. It is characterized by a combination of several elements to be classified in the group of Trojan viruses, viruses bypassing authorization and computer worms. Source code analysis of this malware revealed links to the Stuxnet virus. As with Stuxnet, this malware was discovered in the Middle East and this region was the main target of the attacks. The principle of operation of this malware turned out to be a collision attack, which consisted of generating two different strings of characters, which after processing give the same checksum on the output. Thanks to this, Flame was able to forge and use Microsoft Windows Update certificates to sign its code. The analysis of this malware showed that it ran for 5 years and the complete source code consisted of almost 20 different modules and took up 20 MB. Unlike Stuxnet, Flame was only used for comprehensive data stealing from business units in the Middle East. **Duqu**  
Duqu is a backdoor [91] malware whose main purpose is to collect information from the infected Windows operating system and forward it to the server managing the attack. It was discovered in 2011, and its source code indicates a close link to the Stuxnet worm. The main targets of the attack were, as in the case of Stuxnet and Flame, the countries of the Middle East. Duqu did not attack SCADA systems and PLCs as was the case of Stuxnet worm. However, this tool was designed only to launch a hacker attack targeting industrial systems, and its purpose was not to sabotage but to steal data from computers. Duqu collected data in the form of screenshots and sent it in encrypted transmission to a remote server. An interesting aspect of the operation is the fact that it is not detectable by antiviruses because Duqu was attacking through ring0; so, at the level of the operating system kernel (to which antivirus software simply cannot access). The first infection probably took place as a result of opening an infected email attachment. Duqu is only set to run for 36 days and then automatically removes itself from the system.