Siemens Metaverse Leak

 Was Unaware of Siemens Metaverse, but here an example. Was this connected to ChatGPT use? In SecurityAffairs.    NVIDIA Connection. 

Siemens Metaverse, a virtual space built to mirror real machines, factories, and other highly complex systems, has exposed sensitive data, including the company’s office plans and internet of things (IoT) devices.

While metaverse is no longer a buzzword, amid the sudden popularity of ChatGPT and similar AI tools, those virtual worlds are still here, presenting exciting opportunities for companies, users, and, unfortunately, threat actors.

Siemens, a German multinational with over $71 trillion in revenue and 300,000 employees worldwide, has also jumped on the metaverse bandwagon. In 2022, it partnered with NVidia, an American multinational technology company, to build the industrial metaverse.

Recently, the Cybernews research team has discovered that Siemens Metaverse – a platform that aims to create digital ‘twins’ of its factories and offices – was leaking sensitive information.

If attackers got to the exposed data, it could have had devastating consequences for the company and other big corporations using its services, including ransomware attacks.

Siemens, on the other hand, said it considered the issue to be non-critical and added that it had been mitigated.

Metaverse leak: what we discovered

On March 1, the Cybernews research team discovered an environment file hosted on a metaverse.siemens.com domain. It contained ComfyApp credentials and endpoints. It also discovered Siemens leaking four sets of WordPress users, and three sets of backend and authentication endpoint URLs on different endpoints of the affected systems.

The WordPress sets only exposed user names and avatar pictures, but all four Siemens WordPress-based subdomains were vulnerable to a flaw that WordPress itself fixed in 2017, leaving researchers wondering whether there are more severe vulnerabilities on these sites.

Backend and authentication endpoint URLs, used to verify users before giving them access, could lead to attackers testing them for vulnerabilities and exploiting them.

The most worrying discovery was that of exposed office management platform ComfyApp user credentials. The Siemens-owned app helps with workspace management, meaning it’s hungry for sensitive data including floor plans, information about internet of things (IoT) devices, employee calendars, and interior pictures.

We can’t say for sure how much of the aforementioned data could be accessed using the ComfyApp credentials alone.

Siemens Metaverse

“We sincerely hope that threat actors didn’t discover the leak before Siemens managed to fix it,” said Cybernews researchers. “Having access, they could exfiltrate a treasure trove of sensitive data, given that Siemens manufactures and maintains a lot of technologies and machines used by critical infrastructure.”

The Cybernews team added: “Siemens customers include multi-billion [dollar] companies, handling extremely sensitive data, and attackers would definitely find it very valuable.”

A highly attractive target

So what if someone logs in and takes a peek at your office plans and pictures, even your calendar? Employees are well aware they shouldn’t let a stranger into their office, so why would the rules be any different when it comes to the digital workplace?

“After snooping around the digital office, attackers could simply show up in the physical office as if they’ve worked there for years, knowing all the spaces and being familiar with office devices, such as smart air conditioners. That just makes it easier for attackers to break in,” Cybernews researchers said.

And they won’t break in just to steal a pen. More likely, they’ll plug in an infected USB drive that could eventually even lead to ransomware.

Since the metaverse is built in such a way that it should have up-to-date factory data, attackers could even extract some trade secrets like manufacturing techniques.

“There are a lot of opportunities for threat actors here. But since it’s one of the first cases where the metaverse technologies are used in cases where they can leak sensitive real-world data, it is not very clear what methodologies would be adopted by threat actors to gain the most out of exploiting such issues,” the research team said.

If you want to have more info on Metaverse problems, give a look at the original post here, 

About the author: Jurgita Lapienytė, Chief Editor at CyberNews

Industrial Metaverse

 A transparent collection of interacting digital Twins?

HUMANS AND TECHNOLOGY

The emergent industrial metaverse

An interface between the real and digital worlds will transform how we work, live, and interact.

By MIT Technology Review Insightsarchive page, March 29, 2023

In partnership withSiemens

The industrial metaverse—a metaverse sector that mirrors and simulates real machines, factories, cities, transportation networks, and other highly complex systems—will offer to its participants fully immersive, real-time, interactive, persistent, and synchronous representations and simulations of the real world. 

The emergent industrial metaverse

Download the report

Existing and developing technologies, including digital twins, artificial intelligence and machine learning, extended reality, blockchain, and cloud and edge computing, will be the building blocks of the industrial metaverse. These will converge to create a powerful interface between the real and digital worlds that is greater than the sum of its individual parts. 

Annika Hauptvogel, head of technology and innovation management at Siemens, describes the industrial metaverse as “immersive, making users feel as if they’re in a real environment; collaborative in real time; open enough for different applications to seamlessly interact; and trusted by the individuals and businesses that participate”—far more than simply a digital world. 

The industrial metaverse will revolutionize the way work is done, but it will also unlock significant new value for business and societies. By allowing businesses to model, prototype, and test dozens, hundreds, or millions of design iterations in real time and in an immersive, physics-based environment before committing physical and human resources to a project, industrial metaverse tools will usher in a new era of solving real-world problems digitally.   ... ' 

Siemens on EV Development

 Siemens on V Development

Drive vehicle electrification and manage increasing complexity by transforming electric vehicle development

Until recently, electric vehicles were costly to develop and buy, leaving OEMs and customers uncertain of their future potential. But startups have disrupted the automotive industry by innovating new technologies at lightning speed, reducing battery prices, and opening up the possibility of commercializing electric vehicles with mass-market appeal. Additionally, OEMs face a steep rise in engineering complexity due to an influx of environmental regulations and growing consumer demand for vehicle connectivity.

Download the eBook to discover how automakers can successfully compete in the vehicle electrification space and manage increasing complexity while maintaining traditional car lines.

Optimize EV design and production with a comprehensive digital twin solution

Automakers mastered the art of designing, validating, and building vehicles with internal combustion engines (ICEs) over the last century. However, as vehicles evolve with new technologies, the processes and tools used to develop them must also evolve. A comprehensive digital twin bridges the virtual and physical worlds, simulating and validating performance to optimize product design, improve quality, make better decisions, and get the products customers want to market faster. Siemens' vehicle electrification solution allows original equipment manufacturers (OEMs) to develop electric vehicles (EVs) faster, more efficiently, and with the level of confidence that only comes from the comprehensive digital twin.

Implement a collaborative environment across all disciplines to improve EV development

The advantages of Siemens' vehicle electrification solution helps OEMs manage complexity and leverage data for a competitive advantage. Design optimization enhances by incorporating generative design, advanced simulation, and early virtual validation. Smart manufacturing drives highly efficient production and creates the factory of the future by promoting the ability to adopt advances in technology effectively. Insights from a closed-loop management system and the cost-efficient virtual commissioning of assets and data enable OEMs to get it right the first time.

Download the eBook to learn how Siemens is helping OEMs develop the next generation of safe and reliable electric vehicles with a mass-market appeal to drive change for mobility. ..... ' 

Siemens: How to Deliver Products to Market Faster by Integrating Electrical, Mechanical, PLM, and MBSE.

Former colleague now VP at Siemens sends along a Webinar alert

Via Suzanne Kopcha,   Vice President Strategy at Siemens Digital Industries Software

Register for our holistic engineering #webinar on April 26. We’ll cover how to deliver products to market faster by integrating electrical, mechanical, PLM, and MBSE.

April 26, 2022, 07:00 AM EDT,  April 26, 2022, 01:00 PM EDT

E/E Systems & E/E Architecture Design Complexity | Siemens Capital

Signup:   Capital’s role within the Siemens Xcelerator portfolio

April 26, 2022, 07:00 AM EDT, April 26, 2022, 01:00 PM EDT

Siemens Xcelerator as a Service

Through our webinar, learn how to drive enterprise-level productivity and innovation by digitalizing your approach to Electrical and Electronic (E/E) systems development. By armoring up with a solution like Capital and its integrations (Teamcenter, NX, Polarion), engineers can capitalize on three key elements (systems, software, and electrical) to sift through E/E architecture design complexity and manage their product lifecycle end-to-end. Gain a new holistic engineering approach to electrical product complexity and development while discovering how to improve design reuse, data quality, machine reliability, and process traceability.

Teamcenter: integrating electrical computer aided design with product lifecycle management

For holistic product development that drives greater efficiency and productivity, consider integrating the Capital and Teamcenter software systems. Through this integration, engineers gain an embedded active workspace where departments can cross-collaborate on the holistic engineering of E/E systems. For example, a blended Capital-Teamcenter software provides electrical engineers with easy access to enterprise data, direct visibility into tasks and extended design information to ensure processes are followed. They are also provided with requirements integration, product configuration integrations, BOM design and publication options, lifecycle management procedures and much more.

NX: integrating electrical computer aided design with mechanical computer aided design

Reduce wire harness delivery time by breaking down siloes between electrical computer aided design and mechanical computer aided design. Our Capital and NX software integration drives a holistic design approach between disciplines. While mechanical engineers design physical wire harnesses in NX, electrical engineers concurrently develop E/E systems in Capital. Through this connected engineering process, organizations increase visibility into the holistic design process, reduce the number of design change approvals and ensure greater precision between mechanical and electrical functions.

Polarion: integrating electrical computer aided design with model-based systems engineering

Take control of your electrical and IT/applications infrastructure with Capital-Polarion integration. While Capital provides the foundation for developing E/E architecture, Polarion is a model-based system engineering tool where engineers develop their own IT applications to manage the product development process. When Capital and Polarion are synchronized, engineers gain a holistic approach to creating digital applications that manage the E/E development and overall engineering process. The Capital-Polarion integration uses an active, embedded workspace, helping designers immediately locate requirements, tasks and other fundamental work items.  ...

Digital Twins, Simulation, Design

 Like drawing the relationship to general simulation, which has been around for a long time.

Digital twins improve real-life manufacturing

Using simulations can ease the complex development process and provide insights into how products are performing in the real world. 

By MIT Technology Review Insightsarchive page

January 5, 2022, In association withSiemens Digital Industries Software

Before reality, there’s simulation. 

A 2021 missile-inceptor test conducted by aerospace and US defense technology provider Raytheon Technologies held no surprises because the company had already tested almost every aspect of the launch in simulation. Siemens and space agency NASA’s Jet Propulsion Laboratory worked together on a digital twin of the Mars Science Laboratory on the Curiosity rover to solve heat dissipation problems caused by the radioisotope power generator. And tire and rubber manufacturer Bridgestone uses digital twins to simulate the performance of its tires using data from actual vehicles to develop a price-per-kilometer service in Europe. 

Digital twins improve real-life manufacturing

Download the full report

Real-world data paired with digital simulations of products—digital twins—are providing valuable insights that are helping companies identify and resolve problems before prototypes go into production and manage products in the field, says Alberto Ferrari, senior director of the Model-Based Digital Thread Process Capability Center at Raytheon. 

“As they say, ‘All the models are wrong, but some of them are useful,’” Ferrari says. “Digital twins, supported with data—as real facts—are a way to identify models that are really useful for decision-making.” 

The concept has started to take off, with the market for digital-twin technology and tools growing by 58% annually to reach $48 billion by 2026, up from $3.1 billion in 2020. Using the technology to create digital prototypes saves resources, money, and time. Yet the technology is also being used to simulate far more, from urban populations to energy systems to the deployment of new services. 

Take manufacturers as varied as Raytheon and Swedish distillery Absolut Vodka, which are using the technology to design new products and streamline their manufacturing processes, from the supply chain through production and, eventually, to recycling and disposal. Singapore, London, and several Texas Gulf Coast cities have created digital twins of their communities to tackle facets of city management, including modeling traffic patterns on city streets, analyzing building trends, and predicting the impact of climate change. And companies such as Bridgestone and drone-service provider Zipline are using the technology paired with operational data to help launch new services. 

Companies have adopted digital twins as part of their digital transformations, a way to simulate performance, identify weaknesses, and operate services more efficiently. Any company’s digital initiative should explore whether some facet of its product, operations, or environment can be simulated to gain insight. 

Simulating design and manufacturing 

The digital-twin technologies of today have their foundations in the computer-aided design (CAD) and computer engineering tools developed more than three decades ago. Those software systems allowed engineers to create virtual simulations to test changes in product designs. Engineers designed a product component, such as an airfoil, on a computer and then tasked a modeler or sculptor to craft the item in clay, wood, or stock components for physical testing.   ..... ' 

Zscaler and Siemens Join for Zero Trust

Interesting example of Zero trust security, for operational and IOT systems

Zscaler and Siemens join to bring zero-trust security to operational technology systems

 Analysis by Zeus Kerravala

Zscaler Inc. and Siemens AG announced an interesting partnership this week wherein the two vendors are bringing zero-trust security to operational technology systems.

OT systems are most commonly found in industrial networks but are seeing increased adoption in other industries. Historically, OT systems ran on their own proprietary networks that were often isolated from the company’s data networks. Industry leaders have been predicting that information technology and OT systems would eventually come together, but that has been slow to materialize in industrial settings.

Some OT systems have been integrated with IT networks, such as building facilities like alarm systems, LED lighting and heating and air conditioning systems as part of smart building initiatives, but that has been more the exception than the norm in industrial settings.

The COVID-19 pandemic forced many organizations down the IT-OT path as workers required access to the OT systems from home and the most cost-effective way to do that was to enable VPN access through the data network. That enables workers to remotely manage and control systems and diagnose problems.

Although VPNs were successful in connecting workers to industrial systems quickly, they are not ideal because they create a back door into the industrial “internet of things” environments. That greatly expands the organization’s attack surface and exposes the business to large-scale network attacks.

Some organizations have turned to firewall-based network segmentation, and that can work, but it is very complicated to set up and is even more difficult to keep updated in dynamic environments. That’s because every time a device moves, the segmentation policies must be updated. Coarse-grained segmentation is widely used, but businesses have struggled with fine-grained segmentation, which is needed in IoT environments to minimize the impact of a breach.  ... ' 

Siemens Covid Resources

his was recently pointed out to me by a Siemens contact:

Siemens Healthineers:  COVID-19: Scientific publications
This collection of information about the COVID-19 pandemic from trusted sources offers useful information to clinicians and healthcare providers fighting the virus worldwide. The content linked on this page includes clinical studies, the latest data, webinars, and clinicians’ first-hand experiences .... " 

Protecting Control Systems from Hackers

Was asked to produce a comment on this area, previously mentioned, probably one of the most important aspects of advanced infrastructure.

New Approach Could Protect Control Systems From Hackers

This algorithm creates “background noise” during data transmission to alert officials to hacking
By Michelle Hampson   in IEEE Spectrum

Some of the most important industrial control systems (ICSs), such as those that support power generation and traffic control, must accurately transmit data at the milli- or even mirco-second range. This means that hackers need interfere with the transmission of real-time data only for the briefest of moments to succeed in disrupting these systems. The seriousness of this type of threat is illustrated by the Stuxnet incursion in 2010, when attackers succeeded in hacking the system supporting Iran’s uranium enrichment factory, damaging more than 1000 centrifuges.

Now a trio of researchers has disclosed a novel technique that could more easily identify when these types of attacks occur, triggering an automatic shutdown that would prevent further damage.

The problem was first brought up in a conversation over coffee two years ago. “While describing the security measures in current industrial control systems, we realized we did not know any protection method on the real-time channels,” explains Zhen Song, a researcher at Siemens Corporation. The group began to dig deeper into the research, but couldn’t find any existing security measures. ... "

Robots Unloading Trucks

Classic problem, closer to solution.   Its surprising that this problem of solving the problem of dealing with relative disorder.  Another step forward.

Robots Edge Closer to Unloading Trucks in Amazon-Era Milestone in SupplyChainBrain

As FedEx Corp. and United Parcel Service Inc. beef up automation to keep pace with surging e-commerce and a potential threat from Amazon.com Inc., they’ve been stumped at a crucial stage: loading and unloading trucks.

Robot makers are getting close to solving part of that puzzle.

Siemens AG and Honeywell International Inc. have built machines that pull packages from the back of a tractor-trailer and place them on conveyor belts, whizzing the parcels off for sorting. Making robots that can load trucks is more complicated, although clearing that hurdle isn’t far off.

“The biggest challenge in our world is: Every single package is different in size, shape, weight, color, material,” said Ted Dengel, managing director of operations technology at FedEx’s ground-delivery unit. “It makes it a very tricky problem.”

The devices, unveiled at a recent automation conference in Chicago, hold out the promise of increasing productivity while reducing the need for one of the most grueling jobs in logistics. Couriers are relying on automation to grapple with the rise of online shopping, which is fueling record demand but pressuring profit margins. Amazon’s plan to handle more of its own shipping and offer more one-day deliveries is only upping the ante. .... " 

Siemens and Artificial Intelligence

Been taking a closer look at what German industrial conglomerate Siemens is doing and thinking in the space of AI.  Good section on their thoughts, approaches and direction.   Also about replacing jobs and people.

The Brain Behind: Artificial Intelligence

Innovations at Siemens
“Software can be very intelligent. But it cannot replace people.”

Rolf-Dieter Heuer is confident that clever machines can help us  –  in research, industry and daily life. In an interview, the former director general of CERN and long-standing president of the German Physics Association (DPG) explains why we will still need intelligent people as well. ... "

See also Siemens.com.  And the Wikipedia outlines its history.

I also recently wrote about Siemens doing process mining and modeling, a particular interest of mine.

Siemens and Process Mining

Note always the potential connection between process mining and business process modeling, to set the stage for more value, and to guide future process mining.

Siemens and Process Mining    By Lindsay Clark in Computer Week

German industrial conglomerate Siemens has turned to process mining to reveal inefficiencies in the way it pays suppliers, organises logistics and runs order-to-cash processes
When global manufacturing giant Siemens created a central data lake, it had no idea it would generate such positive business benefits. Compliance was the main reason it started to collect data from its disparate ERP and finance systems and put them in one place, from 2008 using an Oracle database, and then from 2012 using SAP’s Hana technology.

But from 2014, it began to realise the data could do more than help the organisation mitigate risk and provide financial reporting. Using a technique called process mining, the company began to reveal inefficiencies in the way it pays its suppliers, organises logistics and runs its order-to-cash process, creating savings for the business in the 10s of millions of Euros.  .... "

Siemens: Getting Robots and Workers to Cooperate

Like that this approach is addressing elements and architecture of process, and that the design and operation of  these elements is also a big part of doing something intelligently.  New component elements of business process modeling?   Looking deeper.

This AI Factory Boss Tells Robots And Humans How To Work Together  in FastCompany.

Siemens’s future “artificially intelligent” factory is aimed at a new trend in automation: telling robot and human workers how to help each other make things.

Robots are consistent, indefatigable workers, but they don’t improvise well. Changes on the assembly line require painstaking reprogramming by humans, making it hard to switch up what a factory produces. Now researchers at German industrial giant Siemens say they have a solution: a factory that uses AI to orchestrate the factory of the future, by both programming factory robots and handing out assignments to the humans working alongside them.

“Instead of programming [each robot], what we do is say, this is a machine that can do this [task], this is a machine that has the following capabilities,” says Florian Michahelles, who heads the Siemens Web of Things research group in Berkeley, CA. An AI program that Michahelles and his team have developed, called a “reasoner,” figures out the steps required to make a product, such as a chair; then it divides the assignments among machines based their capabilities, like how far a robotic arm can reach or how much weight it can lift.  ...  "

Spider Robotics for 3D Printing

This reminds me of swarm robotics, which have a similar approach to scale.  And an approach that cooperated towards a goal.

Why Spider Robots Could Be The Next Big Thing In 3-D Printing
By Jason Compton

Three-dimensional printing has long had a serious limitation: You can’t make an object larger than the print bed. Consequently, 3-D printers for large-scale objects have taken up a lot of space and required a lot of heavy machinery to move the nozzle around.

Taking a cue from nature, technicians at Siemens may have solved the problem. Instead of building a bigger, better 3-D printer, the company has designed compact “spider robots” that work together to weave large objects seemingly from thin air. .... "