Feeds

The TRUTH about mystery Trojan found in SPAAACE

Mystery ISS malware fingered

The Power of One eBook: Top reasons to choose HP BladeSystem

The mystery malware inadvertently brought into space by scientists which then infected the International Space Station has been identified as a gaming Trojan.

The historical infection actually happened five years ago in 2008 but was propelled back into the news again last week as the result of a recent speech by Eugene Kaspersky, boss of Russian antivirus firm Kaspersky Lab.

Speaking the members of the Australian media during a presentation at the Canberra Press Club, Kaspersky said that malware was everywhere and that even Windows machines used by scientists on the International Space Station had been affected with malware.

Virus and Trojans on computers on the orbital platform have continued to prove an occasional problem, according to Kaspersky, who explained that malware pathogens hitched a ride on removable media carried up onto the space station by astronauts.

Kaspersky said: "Scientists, from time to time, they are coming to space with USBs which are infected. I'm not kidding. I was talking to a Russian space guys and they said from time to time there are virus epidemics in the space station."

The remarks are recorded (shortly after the 18-minute mark) in a video of the presentation put together by SC Magazine (below).

Kaspersky didn't identify the malware at the time, and the listening press pack didn't ask, but he has since identified the malware as Gammima-AG, a Trojan designed to steal online gaming passwords. The Russian antivirus boss referred to earlier reports of the incident - which caused no damage or disruption but illustrates the point that Windows systems everywhere are wide open to infection. It also highlights how USB sticks can easily spread digital nasties.

During the same speech in Australia, Kaspersky separately revealed that Stuxnet had infected the internal network of a Russian nuclear plant after causing chaos in Iran's nuclear enrichment programme, something that unlike the ISS infection does represent new information.

Kaspersky said he heard about the infection from a "friend of mine" at the unnamed nuclear plant. "[The staff] sent a message their nuclear plant network which was disconnected from the internet... was badly infected by Stuxnet," Kaspersky said.

The malware apparently reached the air-gapped network of the nuke plant via, stop us if you've guessed this already, an infected USB stick. Neither independent experts nor Kaspersky suggest the malware did any particular harm but the spread of such a notorious pathogen is none the less noteworthy.

Stuxnet

Stuxnet famously hobbled high-speed centrifuges at Iran's uranium enrichment facility at Natanz in 2009 and 2010 after infecting computers connected to SCADA industrial control systems at the plant. Stuxnet was reportedly developed as part of a wider US-Israeli information warfare effort, codenamed Operation Olympic Games, that began under the presidency of George W Bush.

The worm was detected after it escaped onto the internet, and was first described by Belarussian firm VirusBlokAda in June 2010. Subsequent analysis revealed that although Stuxnet spread indiscriminately across Windows systems, its malware payload only came into play in screwing up the operation of industrial control systems from Siemens. Additionally, it only activated when the kit was being used to control high-speed equipment such as Iran's nuke purifying centrifuges. Nothing would happen to the same type of kit within a milk-bottling factory or an escalator control mechanism that became infected.

Kaspersky never said that Stuxnet infected the ISS, a point he has since been obliged to re-emphasise (here and here) following misleading reports by some media outlets. He said that the space station has a SCADA system but it is controlled and managed by a Linux-based systems.

Re-bootnote

Back in May we reported how the ISS crew would soon be trading in their old Windows XP laptops for Debian-powered systems. The ISS has over 140 laptops on board, around 80 of which are working at any one time, many of which are connected to the space station's Operations Local Area Network (Ops LAN).

United Space Alliance (USA), the Earth-based contractor which maintains Ops LAN, is migrating the systems away from Windows XP (which is due to go into retirement next May) to one that gave it greater control and offered greater stability.

The move to Linux vastly reduces the possibility of future malware infection even thought it might cause headaches in finding open-source builds of current Windows-based scientific applications, among other issues.

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.