Feeds

Stuxnet worm slithers into China, heralds alien invasion

Conspiracy? Cock-up? Or Conspiracy?

Next gen security for virtualised datacentres

Analysis The infamous Stuxnet worm has reportedly begun spreading in China.

The worm, which targets supervisory control and data acquisition (SCADA) systems, has infected "millions of computers" across the country, AFP reports.

Local anti-virus outfit Rising International told the official Xinhua news agency that six million individuals and nearly 1,000 corporate accounts across China had been infected with the worm. However Yu Xiaoqiu, an analyst with the China Information Technology Security Evaluation Centre, said it hadn't witnessed any damage as a result of apparent infestation, an observation that raises doubts about Rising International's estimates.

Seven steps to sabotage

The sophisticated malware is designed to sabotage industrial plant control systems, specifically those running Siemens Simatic WinCC SCADA system software. Stuxnet exploits four Windows zero-day vulnerabilities, stolen signed certificates and a variety of other trickery with the ultimate aim of reprogramming the programmable logic controllers (PLCs) of control systems. The PLCs targeted by Stuxnet are programmed using Windows-based development environment called Step 7. The malware reconfigures a Step 7 setup which hides its presence on compromised components, making it a kind of rootkit for industrial control systems.

A diagram illustrating how Stuxnet works, based on an analysis by Symantec, can be found here.

Cyber-semtex

Stuxnet was first detected by Belarussian anti-virus firm VirusBlokAda in late June, and confirmed by other security firms shortly afterwards in July. Other SCADA-system strains of malware have been detected before but the sophistication of Stuxnet together with its first detection in systems in Iran have sparked the theory that it was designed by Mossad and targeted at disrupting operations at Iran's new nuclear reactor in Bushehr. Iran has reportedly responded to the outbreak by blocking command and control channels associated with Stuxnet across its entire internet infrastructure.

Some security analysts have described Stuxnet as the first cyber super-weapon.

The bible code and UFOs...

The Stuxnet code contains reference to 9 May 1979, the date a prominent Jewish businessman, Habib Elghanian, was executed in Iran. Also the malware contains a string called Myrtus which corresponds to Myrtle, a figure from the Book of Esther who informs the informs the king of a plot against the Jews, prompting a royal authorisation for reprisals. Esther was born as Hadassah which means Myrtle.

Details like this, of course, make fantastic material for weaving elaborate conspiracy theories but do little to establish one way or another whether the worm was targeted at Iran, much less its nuclear facilities. Some argue that the Mossad worm targeting Iran idea is too neat and might be some sort of misdirection.

In fact stats from Russian anti-virus firm Kaspersky Lab suggest far more systems in India (86,000) and Indonesia (34,000) have been infected than the 14,000 systems hit in Iran. One report links Stuxnet infection with the blow-out of an Indian TV satellite system back in July, the link being the use of SCADA systems from Siemens. Other reports suggest Russian sub-contractors from Siemens on the Bushehr plant job might have spread the infection when they went to work in other countries.

In the absence of hard facts about the worm all sorts of wild speculation and conspiracy theories have flourished, including a surprising volume of discussions linking Stuxnet to UFOs and even suggesting it might be a prelude to alien invasion*. Yup. It all ties back to harvested UFO tech from Roswell and, just as plausibly, the replacement of Paul McCartney by a stand-in all these years.

Back to reality

Back on planet Earth anti-virus firm F-Secure has compiled the best FAQ on Stuxnet that we've seen to date.

The Stuxnet worm was high on the agenda of presentations at the Virus Bulletin conference in Vancouver this week. Symantec ran a proof of concept demo of what code that had similar capabilities to Stuxnet could do to mess with the operation of a Siemens PLC SCADA test rig. The demo featured an air-pump connected to a controller, balloons, confetti and and explosion. Delegates were invited to imagine what might happen with a similarly compromised controller that was connected to an oil pipeline or (though this was not said) a centrifuge in a uranium processing plant. ®

Bootnote

*We're grateful to Vmyths's Rob Rosenberger for this observation.

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
KER-CHING! CryptoWall ransomware scam rakes in $1 MEEELLION
Anatomy of the net's most destructive ransomware threat
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.