Stuxnet Worm Saga
http://cogitoergosum.co.cc/2010/10/04/stuxnet-worm-saga/
Stuxnet worm potential to re-infect cleaned PCs
Posted on October 5, 2010 by David Kolle
A security researcher today revealed yet another way that the Stuxnet
worm spreads, a tactic that can re-infect machines that have already
been scrubbed of the malware.
The new information came on the heels of admissions by Iranian
officials that Stuxnet had infected at least 30,000 of the country’s
Windows PCs, including some of the machines at the Bushehr nuclear
reactor in southwestern Iran.
The worm, which has been dubbed the world’s most sophisticated malware
ever, targets Windows PCs that oversee industrial-control systems,
called “SCADA” systems, that in turn manage and monitor machinery in
power plants, factories, pipelines and military installations.
Previously, researchers had spotted several propagation methods in
Stuxnet that ranged from spreading via infected USB flash drives to
migrating between machines using multiple unpatched Windows bugs.
Liam O Murchu, manager of operations on Symantec’s security response
team and one of a handful of researchers who have been analyzing
Stuxnet since its public appearance in July, said today he’d found
another way that the worm spreads. According to O Murchu, Stuxnet also
injects a malicious DLL into every Step 7 project on a compromised PC,
ensuring that the worm spreads to other, unaffected PCs whenever an
infected Step 7 file is opened.
Step 7 is the Siemens software used to program and configure the
German company’s industrial control system hardware. When Stuxnet
detects Step 7 software, it tries to hijack the program and pass
control to outsiders.
“All Step 7 projects [on a compromised computer] are infected by
Stuxnet,” O Murchu said in an interview today. “Anyone who opens a
project infected by Stuxnet is then compromised by the worm.”
O Murchu said that the Step 7 propagation vector would insure that
already-cleaned PCs would be re-infected if they later opened a
malicious Step 7 project folder. “You could imagine the scenario where
someone had cleaned the computer of Stuxnet, but before they did that,
they backed up the project,” he said. “When the project was later
restored [to the now-clean] PC, it would be re-infected.”
Another possibility, said O Murchu, is that Stuxnet’s makers hoped to
infect systems at a central SCADA-programming authority, which would
then pass along the worm to PCs at several facilities that would use
the Step 7 files to configure the local control hardware.
Siemens has admitted that 14 plants, many of them in Germany, were
infected with Stuxnet, but it has not provided details on how the worm
wriggled into those facilities.
The just-discovered way that Stuxnet spreads means that cleaning up
after the worm will be more difficult, O Murchu said.
Earlier, O Murchu and others who have dug into Stuxnet, argued that
the malware’s complex construction and advanced techniques indicated
it was the work of a state-backed group. The Step 7 infection vector
is another clue of that, O Murchu said today.
“This is a very remarkable feature,” he said. “Step 7 is fairly
proprietary software, and whoever created Stuxnet had to know that
program very well. It’s certainly not something simple.”
Over the weekend, Iranian officials acknowledged that Stuxnet had
infected tens of thousands of Windows PCs in the country, including
some at the Bushehr nuclear reactor.
Other security analysts have speculated that the worm was designed to
cripple the Bushehr reactor. Several Western governments, including
the U.S., suspect that Iran will reprocess Bushehr’s spent fuel to
produce weapons-grade plutonium for use in nuclear warheads.
On Sunday, the deputy head of Iran’s Atomic Energy Organization said
that Stuxnet had not affected Bushehr’s control systems, and that
experts had taken steps to block the worm from spreading.
Share this:
——————————————————————————–
Possibly related posts: (automatically generated)
■Worm spreads through Yahoo messenger
■Stuxnet Worm Is Straight Out of a Cyber Espionage Thriller
■Stuxnet Close-Up: All You Need to Know About the Mighty Malware
■New Clues Point to Israel as Author of Blockbuster Worm, Or Not
-38.026383 145.306933
About David Kolle
David is an Account Manager for Pitney Bowes Business Insight (PBBI) a
leading software & data organisation. Drummer for Rock Band Urban
View all posts by David Kolle → This entry was posted in Internet,
Malware, MicroSoft, Security, Virus and tagged Symantec, Windows,
Viruses, SCADA, Stuxnet, Microsoft Windows, Iran, USB flash drive,
Liam O Murchu, O Murchu, Stuxnet worm, melware. Bookmark the
permalink.
← Top Yahoo execs resignFacebook improves photo uploader, image
quality →LikeBe the first to like this post.0 Responses to Stuxnet
worm potential to re-infect cleaned PCs
navanavonmilita says:
Your comment is awaiting moderation.
October 5, 2010 at 9:36 am
My dear David,
Long time no see.
Iran government is denying the Stuxnet worm infection. Maybe, a damage
control.
Iran: Nuclear delay due to leak, not computer worm
Network NewsX Profile
http://www.washingtonpost.com/wp-dyn/content/article/2010/10/04/AR201…
By ALI AKBAR DAREINI
The Associated Press
Monday, October 4, 2010; 12:13 PM
TEHRAN, Iran — A months-long delay in starting up Iran’s first nuclear
power plant is the result of a small leak, not a computer worm that
was found on the laptops of several plant employees, the country’s
nuclear chief said Monday.
The leak occurred in a storage pool where the plant’s fuel is being
held before being fed into the reactor core, and it has been fixed,
said Ali Akbar Salehi, who is also Iran’s vice president. He did not
specify whether it was nuclear fuel or another material that leaked.
He first announced the delay on Thursday but without giving a reason.
Iranian officials say they have vigorously battled the Stuxnet
computer worm, which they suspect is part of a covert plot by the West
to damage Iran’s nuclear work. The United States, Israel and others
accuse Iran of seeking to use the Bushehr power plant and other civil
nuclear sites as a cover for a secret program to develop atomic
weapons.
Iran denies any nuclear weapons ambitions and says its program is only
for peaceful purposes like power generation and medical research.
The malicious computer code, designed to take over industrial sites
like power plants, has also emerged in India, Indonesia and the U.S.
But it has spread the most in Iran.
Though it infected several personal computers of workers at the
Bushehr plant, Iran says the facility’s main systems were not
affected. Still, that was the first public sign to emerge that the
code has hit computers linked to Iran’s nuclear program.
The delay at Bushehr has no connection with Stuxnet, Salehi said,
according to a report in the official IRNA news agency.
“During a washing process prior to loading the actual nuclear fuel, a
small leak was observed in a pool next to the reactor and was fixed.
This leak delayed activities for a few days,” IRNA quoted Salehi as
saying.
At the plant’s inauguration on Aug. 21, Salehi had said loading the
fuel into the reactor core would take place over two weeks and the
plant would then produce electricity two months later in November.
Now, he says, fuel will be transferred to the core in mid-October and
that the plant will produce electricity in early 2011.
Iran’s deputy industry minister, Mohsen Hatam, said technicians have
removed the Stuxnet malware from all affected systems in Iranian
industry.
“All (infected) platforms have been scanned, cleaned and sent back to
their respective industries,” Hatam was quoted as saying by state TV
on Sunday.
In a progress update a day earlier, Intelligence Minister Heidar
Moslehi also announced the arrests of several nuclear spies, but he
gave no details and did not clearly link the suspects with the
investigation into Stuxnet.
Who created the Stuxnet code and what its precise target is, if any,
remains a mystery. Some foreign experts have speculated it was
designed to target Tehran’s nuclear program.
The web security firm Symantec Corp. says the computer worm was likely
spawned by a government or a well-funded private group. It was
apparently constructed by a small team of as many as five to 10 highly
educated and well-funded hackers, Symantec says.
The Bushehr plant has stood outside the current controversy over
Iran’s nuclear program since Russia will be providing the fuel for the
plant and supervising its disposal.
But other aspects of Iran’s nuclear work, especially its enrichment of
uranium, are of concern to the United States and other world powers.
Enrichment can be used to produce weapons as well as make fuel for
power plants.
http://cogitoergosum.co.cc/
…and I am Sid Harth
Conflict, News, Views and Reviews, Propaganda, Religious
fundamentalism, Terrorism
04/10/2010
« The pot Calling the Kettle Black