Feeds

Stuxnet worm slithers into China, heralds alien invasion

Conspiracy? Cock-up? Or Conspiracy?

Top 5 reasons to deploy VMware with Tegile

Analysis The infamous Stuxnet worm has reportedly begun spreading in China.

The worm, which targets supervisory control and data acquisition (SCADA) systems, has infected "millions of computers" across the country, AFP reports.

Local anti-virus outfit Rising International told the official Xinhua news agency that six million individuals and nearly 1,000 corporate accounts across China had been infected with the worm. However Yu Xiaoqiu, an analyst with the China Information Technology Security Evaluation Centre, said it hadn't witnessed any damage as a result of apparent infestation, an observation that raises doubts about Rising International's estimates.

Seven steps to sabotage

The sophisticated malware is designed to sabotage industrial plant control systems, specifically those running Siemens Simatic WinCC SCADA system software. Stuxnet exploits four Windows zero-day vulnerabilities, stolen signed certificates and a variety of other trickery with the ultimate aim of reprogramming the programmable logic controllers (PLCs) of control systems. The PLCs targeted by Stuxnet are programmed using Windows-based development environment called Step 7. The malware reconfigures a Step 7 setup which hides its presence on compromised components, making it a kind of rootkit for industrial control systems.

A diagram illustrating how Stuxnet works, based on an analysis by Symantec, can be found here.

Cyber-semtex

Stuxnet was first detected by Belarussian anti-virus firm VirusBlokAda in late June, and confirmed by other security firms shortly afterwards in July. Other SCADA-system strains of malware have been detected before but the sophistication of Stuxnet together with its first detection in systems in Iran have sparked the theory that it was designed by Mossad and targeted at disrupting operations at Iran's new nuclear reactor in Bushehr. Iran has reportedly responded to the outbreak by blocking command and control channels associated with Stuxnet across its entire internet infrastructure.

Some security analysts have described Stuxnet as the first cyber super-weapon.

The bible code and UFOs...

The Stuxnet code contains reference to 9 May 1979, the date a prominent Jewish businessman, Habib Elghanian, was executed in Iran. Also the malware contains a string called Myrtus which corresponds to Myrtle, a figure from the Book of Esther who informs the informs the king of a plot against the Jews, prompting a royal authorisation for reprisals. Esther was born as Hadassah which means Myrtle.

Details like this, of course, make fantastic material for weaving elaborate conspiracy theories but do little to establish one way or another whether the worm was targeted at Iran, much less its nuclear facilities. Some argue that the Mossad worm targeting Iran idea is too neat and might be some sort of misdirection.

In fact stats from Russian anti-virus firm Kaspersky Lab suggest far more systems in India (86,000) and Indonesia (34,000) have been infected than the 14,000 systems hit in Iran. One report links Stuxnet infection with the blow-out of an Indian TV satellite system back in July, the link being the use of SCADA systems from Siemens. Other reports suggest Russian sub-contractors from Siemens on the Bushehr plant job might have spread the infection when they went to work in other countries.

In the absence of hard facts about the worm all sorts of wild speculation and conspiracy theories have flourished, including a surprising volume of discussions linking Stuxnet to UFOs and even suggesting it might be a prelude to alien invasion*. Yup. It all ties back to harvested UFO tech from Roswell and, just as plausibly, the replacement of Paul McCartney by a stand-in all these years.

Back to reality

Back on planet Earth anti-virus firm F-Secure has compiled the best FAQ on Stuxnet that we've seen to date.

The Stuxnet worm was high on the agenda of presentations at the Virus Bulletin conference in Vancouver this week. Symantec ran a proof of concept demo of what code that had similar capabilities to Stuxnet could do to mess with the operation of a Siemens PLC SCADA test rig. The demo featured an air-pump connected to a controller, balloons, confetti and and explosion. Delegates were invited to imagine what might happen with a similarly compromised controller that was connected to an oil pipeline or (though this was not said) a centrifuge in a uranium processing plant. ®

Bootnote

*We're grateful to Vmyths's Rob Rosenberger for this observation.

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.