Skip navigation
All Places > PI Developers Club > Blog > 2010 > July
2010

Plenty has been written about the "Stuxnet" malware that is targeting certain SCADA systems. As might be expected hype is out pacing the available facts, mostly due to amplification in mainstream media before proper analysis has been made public. Let's discuss some facts before speculating on potential impact on PI.

 

The malware can propagate via USB, network shares and Web Distributed Authoring and Versioning (see Microsoft Advisory 2286198). Simply opening a folder is enough to start execution. Windows Both Microsoft and Symantec have significant instrumentation and are sharing infection count data with a geographic break down.  Perhaps the data is reassuring if there are few infections in your region.

 

Security experts have been busy analyzing the malware. Much of this work is very good and has been made public to the extent allowed without fouling law enforcement. I recommend the series of blog posts from Symantec as providing the most interesting details.

 

In a nutshell the exploit payload installs a rootkit and then looks for the vulnerable SCADA component. On success the attacker collects information from the control system.  There is no evidence of actions that could result in "kinetic" consequence or otherwise cause a plant process disturbance. 

 

As "Stuxnet" is deconstructed there is plenty of speculation (or will the hype just fade per opinion at Verizon).  Some will take the view owner operators were just lucky this time which could spawn more cyber regulation and further heighten standards for critical infrastructure protection. Unfortunately standards have little impact on legacy equipment and if you need a keyboard and mouse it isn't all that practical to fill USB ports with epoxy.

 

A win on the law enforcement side of this event would be great result but don't hold your breath. [IMHO operators and vendors collectively as stakeholders have a long way to go in handling incidents and providing deep forensic data that is needed to really help nail cyber criminals.]

 

Closer to home, I am wondering if a "Stuxnet" like attack could be successful in targeting PI. After all, PI has the same data as the control system and likely much more of it. It sounds kind of silly these days but deployment patterns allowing read only access without a password were fairly common in PI versions prior to Windows integrated security.

 

Recent PI Systems disable blank passwords by default (the explicit login method is disabled as well). Likewise, AF installation defaults are consistent with security practices that prevent an attacker from enabling SQL extended command procedures. As such several parts of "Stuxnet" attack vector are mitigated.

 

Don't celebrate too soon. I expect the rootkit would load if an infected USB were attached to a PI Server without effective malware prevention procedures. Game over once malware becomes a trusted part of the operating system.

 

Microsoft's analysis is still in progress and it will be interesting to see if the Windows shell vulnerability is applicable on Server Core (since there is no GUI, there are no shortcuts or icon processing). On the other hand, Microsoft's patch criteria only considers if the dll is present on disk - even if there is no access vector to exploit the vulnerability. I'm also looking forward to a more complete explanation of kernel patch protection bypass and how expired certificates still seem to allow the rootkit to load.

 

Fortunately, in most cases good security practices have prevented "Stuxnet" from reaching the target control systems and fully executing the malicious payload. The problem is that such security vigilance is taking too much effort for our customers. Even worse, attackers are learning how to use our own applications against us. Software security initiatives need to accelerate, known vulnerabilities must be eliminated, and applications must be better instrumented to help with forensics. In turn customers must accelerate upgrades and streamline management of change procedures.

 

To be fair, open access to PI data is often intentional.  Simply put - it's safer to promote use of data in PI rather than allow non-essential access to the control system. However, as information grows in importance greater protections for the enabling applications and data streams makes sense. While information isn't yet a line item on the corporate ledger as predicted by Admiral Hopper, increasing the value of data is at the center of all of our work.

 

 

You might have already gotten the announcement about this, but the Agenda v1.0 is now available for OSIsoft vCampus Live! 2010.

 

Go check it out on the registration website (and don't forget to watch the "How to convince your boss" tutorial )

 

See you in September!

 

OSIsoft-vCampus-Live_2100_-2010-_2D00_-Download-Agenda.png

Hurry up and register today to save money (Early Bird registration ends July 21st - that is today!)

 

All the details and the registration at www.osisoft.com/vCampusLive2010... looking forward to see you at the Palace Hotel!

 

(interested in presenting something at the event - there are 2 more spots open! submit your paper in this discussion thread)

 

960x160_5F00_vCampus2010_5F00_v3.jpg

As progress continues towards the first release of PI for StreamInsight, an updated Community Technology Preview (CTP) is now available along with updated samples.

 

PI for StreamInsight enables developers building applications with Microsoft StreamInsight data access to the PI System

 

For more information about StreamInsight and the Adapters refer to the vCampus Webinar on StreamInsight

 

CTP location
vCampus > Download Center > Select the Category as PreRelease > Entry "PI System Adapters for StreamInsight"
Samples location
vCampus > Download Center > Select the Category as Extras > Entry: "StreamInsight Sample Projects"

 

Updates, changes and features  - some we haven't mentioned before! - are listed below

  • Input adapter value (structure) can contain the value flags (annotated, substituted, questionable)
  • Output adapter can write the tag value flag questionable
  • Tag access modified to enable tag searching
  • Significant CTI enhancements
    • 6 new strategies for issuing a CTI, including
      • Wall clock support
      • Ability to advance time based on individual events from a tag
  • Cover streams - Ability to identify non occurring events with support for left anti-semi join
  • Payload population options
    • PI event
    • Point attribute(s)
    • Field constants - provided by programming environment
    • Input adapter - ability to include timestamp in payload
    • Output adapter - use source timestamp instead of StreamInsight timestamp
  • Ability to add tracing output using adapter configuration
  • Security access to the PI System using Windows authentication
  • Lots of plumbing work to make it sing (read: internals for functionality and performance)

--
Glenn Moffett | OSIsoft - Product Management

 

PI Developers Club

Overlay a characteristic curve in an XY Plot

Some time ago I got a request to display a characteristic curve on an XY plot. A characteristic curve is an idealized graphical representation of two dependent (physical) measurements. An example of this is the current–voltage characteristic of a diode.

 

In this particular case the request was a best practice curve to appear on an XY plot along with the normal PI data. This had to be done for a wind turbine and should show 'wind speed' versus 'power generated' as PI data and as an idealized wind speed to power relationship.

 

As you know all data in PI archives are stored as time series, so I thought I am out of luck. Overlaying a simple graphic would work, but what happens when the user zooms in? In this little example we will use VBA to overlay an XY plot with dynamic PI data and an XY plot with static data, keeping them overlaid while you zoom and change the time range.

 

XYPic01.jpg

 

Talking to my “relational” colleague Frank caused him to come up with the characteristic curve stored in an access database, just a column for pressure and temperature as an example:

Line

Pressure

Temperature

0

1

5

10

10

17

15

20

20

20

25

22

30

23

35

27

40

30

45

32

50

35

55

45

60

65

65

75

70

85

75

85

80

80

85

75

90

72

95

70

100

70

And use that as a data source for an XY plot. For convenience we create a System Data source in Control Panel>All Control Panel Items>Administrative Tools>Data Sources (ODBC):

 

XYPic02.jpg

 

After this we can simply use it in PI ProcessBook to create a new ODBC Dataset:

 

XYPic03.jpg XYPic04.jpg XYPic05.jpg

 

And we can build a XY plot from this:

 

XYPic06.jpg XYPic07.jpg

 

Next to this plot we are going to create an XY plot with SINUSOID and SINUSOIDU:

 

XYPic08.jpg XYPic09.jpg

 

That was easy. Now we could set the background of our SINUSOID XY Plot to none and carefully move it above the characteristic curve – but this would only be slightly better than a simple bitmap in the background of the trend. So here is how vCampus comes in – let us automate the movement of the trends!

 

We assume, that we have renamed the left XY plot to XYPlotChar (for the left one, the ODBC Data) and the right one to XYPlotReal (for the right one, the PI Data)

 

First we add two command buttons to the display. For demonstrational purposes we want to overlay and separate the two trends:

 

XYPic10.jpg

Now let’s take a look at the code:

    1. First make sure that we do define all variables:

' Define all variables

Option Explicit

 

    1. As there is no VB color code for none, define one:

' We do not have a standard color code for none

Const vbNone = -1

 

    1. Limit the amount of code, so going for one SUB needs a switch:

' Switch between overlay and separate

Const myOverlay = 0

Const mySeparate = 1

Dim myButton As Boolean

 

    1. The myButton is necessary later, so let us initialize it properly:

' Initialization

Private Sub Display_Open()

   myButton = False

End Sub

 

    1. The worker routine is called MyFormat, here it is called from the overlay button …

' The Overlay button

Private Sub btnOverlay_Click()

   Call MyFormat(myOverlay)

End Sub

 

    1. … here it is called from the separate button (the myButton should make sure that the TimeRangeChange event does not interfere with us here) …

' The Separate button

Private Sub btnSeparate_Click()

   myButton = True

   Call MyFormat(mySeparate)

   myButton = False

End Sub

 

    1. … and finally from the zoom event!

' The ZOOM event

Private Sub XYPlotReal_Zoom()

   Call MyFormat(myOverlay)

End Sub

 

    1. Add the TimeRangeChange event handler to support the revert button, but make sure nothing happens if the seperate button is hit:

' The TimeRangeChange event

Private Sub XYPlotReal_TimeRangeChange(ByVal StartTime As String, ByVal EndTime As String)

    If myButton = False Then

       Call MyFormat(myOverlay)

    End If

End Sub

 

    1. Here is the code for MyFormat:

' My formatting routine:

'    opt: myOverlay to overlay the XY Plots

'         mySeparate to separate the XY Plots

Private Sub MyFormat(opt As Integer)


    ' First the position.

    If opt = mySeparate Then

       ' Separate:

        XYPlotChar.Height = 700

        XYPlotReal.Height = 700

        XYPlotChar.Width = 1000

        XYPlotReal.Width = 1000

        XYPlotChar.Left = -14950

        XYPlotReal.Left = -13900

        XYPlotChar.Top = 14950

        XYPlotReal.Top = 14950

    Else

        ' Overlayed:

        XYPlotChar.Height = XYPlotReal.Height

        XYPlotChar.Width = XYPlotReal.Width

        XYPlotChar.Left = XYPlotReal.Left

        XYPlotChar.Top = XYPlotReal.Top

    End If


    ' Now let us define the XY definition ...

    Dim myXYCharDefinition As XYDefinition

    Dim myXYRealDefinition As XYDefinition


    ' ... and get it.

    Set myXYCharDefinition = XYPlotChar.GetDefinition

    Set myXYRealDefinition = XYPlotReal.GetDefinition


    ' We need to loop through the tags, so get an integer

    Dim myTag As Integer


    ' Set the Definition.

    If opt = mySeparate Then

        ' For the separate plots.


        For myTag = 1 To 2

           ' Adjust the formating of the scale ...

           myXYRealDefinition.Tags.Item(myTag).ScaleFormat = _

                 myXYCharDefinition.Tags.Item(myTag).ScaleFormat

           ' ... and set the charactersitic curve ...

           myXYCharDefinition.Tags.Item(myTag).SetScaleConfiguration _

                 False, _

                 pbScaleAutorange, _

                 0, _

                 pbScaleAutorange, _

                 1

           ' ... and the data identically to AutoRange.

           myXYRealDefinition.Tags.Item(myTag).SetScaleConfiguration _

                 False, _

                 pbScaleAutorange, _

                 0, _

                 pbScaleAutorange, _

                 1

        Next myTag

        myXYCharDefinition.XYTitle = "Characteristic Curve"


        ' Apply the definition

        XYPlotChar.SetDefinition myXYCharDefinition

        XYPlotReal.SetDefinition myXYRealDefinition

    Else

        ' For the overlay plots.


        For myTag = 1 To 2

           ' We have to keep the scales in sync,

           ' so we need to remember them somewhere.

           Dim myMin As Double

           Dim myMax As Double

           Dim MaxScale As pbMinMaxEnum

           Dim MinScale As pbMinMaxEnum

           ' Get the type ...

           MaxScale = myXYRealDefinition.Tags.Item(myTag).Max

           MinScale = myXYRealDefinition.Tags.Item(myTag).Min

           ' ... and set the variables accordingly for the maximum ...

           Select Case MaxScale

              Case pbScaleAutorange

                 myMax = myXYRealDefinition.Tags.Item(myTag).AutorangeMax

              Case pbScaleAbsolute

                 myMax = myXYRealDefinition.Tags.Item(myTag).AbsoluteMax

              Case pbScaleDatabase

                 MsgBox "ERROR!"

           End Select

           ' ... and the minimum.


           Select Case MinScale

              Case pbScaleAutorange

                 myMin = myXYRealDefinition.Tags.Item(myTag).AutorangeMin

              Case pbScaleAbsolute

                 myMin = myXYRealDefinition.Tags.Item(myTag).AbsoluteMin

              Case pbScaleDatabase

                 MsgBox "ERROR!"

           End Select

           ' Now set the values ...

           myXYCharDefinition.Tags.Item(myTag).SetScaleConfiguration _

               False, _

               pbScaleAbsolute, _

               myMin, _

               pbScaleAbsolute, _

               myMax

       Next myTag

        myXYCharDefinition.XYTitle = ""


       ' ... and apply them

        XYPlotChar.SetDefinition myXYCharDefinition

    End If

  

    'After we adjusted the scales, now let us take a look at the formatting.

    Dim myXYCharFormatAs XYFormat

    Dim myXYRealFormatAs XYFormat

 

    'Get the format

    Set myXYCharFormat = XYPlotChar.GetFormat

    Set myXYRealFormat = XYPlotReal.GetFormat

 

    ' The characteristic curve

    With myXYCharFormat

        .DisplayScaleInside = True

        .ShowCoefficient = False

        .ShowDescription = False

        .ShowEngUnits = False

        .ShowGrids = myXYRealFormat.ShowGrids

        .ShowLinearCorrelation = myXYRealFormat.ShowLinearCorrelation

        .ShowTagName = False

        .ShowValue = False

        .ShowTitle = myXYRealFormat.ShowTitle

        If opt = mySeparate Then

           .Elements.Item(pbXYPen1).Color = vbBlue

        Else

           .Elements.Item(pbXYPen1).Color = vbRed

        End If

    End With

    XYPlotChar.SetFormat myXYCharFormat

 

    ' The real plot

    Set myXYRealFormat = XYPlotReal.GetFormat

    With myXYRealFormat

        .DisplayScaleInside = True

        .ShowCoefficient = False

        .ShowDescription = False

        .ShowEngUnits = False

        .ShowTagName = False

        .ShowValue = False

        .Elements.Item(pbXYPen1).Color = vbBlue

    End With

    XYPlotReal.SetFormat myXYRealFormat

  

    ' Just a white background ...

    XYPlotChar.BackgroundColor = vbWhite

    If opt = mySeparate Then

        XYPlotReal.BackgroundColor = vbWhite

    Else

        XYPlotReal.BackgroundColor = vbNone

    End If

  

End Sub

Now we have a characteristic curve from an ODBC data source ...

 

XYPic11.jpg

 

... that properly reacts on zoom and time range change!

 

XYPic12.jpg

 

Files MS Access Database & PDI are attached to this post

Filter Blog

By date: By tag: