Feeds

Stuxnet worm slithers into China, heralds alien invasion

Conspiracy? Cock-up? Or Conspiracy?

SANS - Survey on application security programs

Analysis The infamous Stuxnet worm has reportedly begun spreading in China.

The worm, which targets supervisory control and data acquisition (SCADA) systems, has infected "millions of computers" across the country, AFP reports.

Local anti-virus outfit Rising International told the official Xinhua news agency that six million individuals and nearly 1,000 corporate accounts across China had been infected with the worm. However Yu Xiaoqiu, an analyst with the China Information Technology Security Evaluation Centre, said it hadn't witnessed any damage as a result of apparent infestation, an observation that raises doubts about Rising International's estimates.

Seven steps to sabotage

The sophisticated malware is designed to sabotage industrial plant control systems, specifically those running Siemens Simatic WinCC SCADA system software. Stuxnet exploits four Windows zero-day vulnerabilities, stolen signed certificates and a variety of other trickery with the ultimate aim of reprogramming the programmable logic controllers (PLCs) of control systems. The PLCs targeted by Stuxnet are programmed using Windows-based development environment called Step 7. The malware reconfigures a Step 7 setup which hides its presence on compromised components, making it a kind of rootkit for industrial control systems.

A diagram illustrating how Stuxnet works, based on an analysis by Symantec, can be found here.

Cyber-semtex

Stuxnet was first detected by Belarussian anti-virus firm VirusBlokAda in late June, and confirmed by other security firms shortly afterwards in July. Other SCADA-system strains of malware have been detected before but the sophistication of Stuxnet together with its first detection in systems in Iran have sparked the theory that it was designed by Mossad and targeted at disrupting operations at Iran's new nuclear reactor in Bushehr. Iran has reportedly responded to the outbreak by blocking command and control channels associated with Stuxnet across its entire internet infrastructure.

Some security analysts have described Stuxnet as the first cyber super-weapon.

The bible code and UFOs...

The Stuxnet code contains reference to 9 May 1979, the date a prominent Jewish businessman, Habib Elghanian, was executed in Iran. Also the malware contains a string called Myrtus which corresponds to Myrtle, a figure from the Book of Esther who informs the informs the king of a plot against the Jews, prompting a royal authorisation for reprisals. Esther was born as Hadassah which means Myrtle.

Details like this, of course, make fantastic material for weaving elaborate conspiracy theories but do little to establish one way or another whether the worm was targeted at Iran, much less its nuclear facilities. Some argue that the Mossad worm targeting Iran idea is too neat and might be some sort of misdirection.

In fact stats from Russian anti-virus firm Kaspersky Lab suggest far more systems in India (86,000) and Indonesia (34,000) have been infected than the 14,000 systems hit in Iran. One report links Stuxnet infection with the blow-out of an Indian TV satellite system back in July, the link being the use of SCADA systems from Siemens. Other reports suggest Russian sub-contractors from Siemens on the Bushehr plant job might have spread the infection when they went to work in other countries.

In the absence of hard facts about the worm all sorts of wild speculation and conspiracy theories have flourished, including a surprising volume of discussions linking Stuxnet to UFOs and even suggesting it might be a prelude to alien invasion*. Yup. It all ties back to harvested UFO tech from Roswell and, just as plausibly, the replacement of Paul McCartney by a stand-in all these years.

Back to reality

Back on planet Earth anti-virus firm F-Secure has compiled the best FAQ on Stuxnet that we've seen to date.

The Stuxnet worm was high on the agenda of presentations at the Virus Bulletin conference in Vancouver this week. Symantec ran a proof of concept demo of what code that had similar capabilities to Stuxnet could do to mess with the operation of a Siemens PLC SCADA test rig. The demo featured an air-pump connected to a controller, balloons, confetti and and explosion. Delegates were invited to imagine what might happen with a similarly compromised controller that was connected to an oil pipeline or (though this was not said) a centrifuge in a uranium processing plant. ®

Bootnote

*We're grateful to Vmyths's Rob Rosenberger for this observation.

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.