Computer worm to destroy Iran's nuclear reactor!?

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts
  • Bratot
    Senior Member
    • Sep 2008
    • 2855

    Computer worm to destroy Iran's nuclear reactor!?

    A highly sophisticated computer worm that has spread through Iran, Indonesia and India was built to destroy operations at one target: possibly Iran's Bushehr nuclear reactor.

    That's the emerging consensus of security experts who have examined the Stuxnet worm. In recent weeks, they've broken the cryptographic code behind the software and taken a look at how the worm operates in test environments. Researchers studying the worm all agree that Stuxnet was built by a very sophisticated and capable attacker -- possibly a nation state -- and it was designed to destroy something big.

    Though it was first developed more than a year ago, Stuxnet was discovered in July 2010, when a Belarus-based security company discovered the worm on computers belonging to an Iranian client.

    Since then it has been the subject of ongoing study by security researchers who say they've never seen anything like it before. Now, after months of private speculation, some of the researchers who know Stuxnet best say that it may have been built to sabotage Iran's nukes.

    Last week Ralph Langner, a well-respected expert on industrial systems security, published an analysis of the worm, which targets Siemens software systems, and suggested that it may have been used to sabotage Iran's Bushehr nuclear reactor. A Siemens expert, Langner simulated a Siemens industrial network and then analyzed the worm's attack.

    Experts had first thought that Stuxnet was written to steal industrial secrets -- factory formulas that could be used to build counterfeit products. But Langner found something quite different. The worm actually looks for very specific Siemens settings -- a kind of fingerprint that tells it that it has been installed on a very specific Programmable Logic Controller (PLC) device -- and then it injects its own code into that system.
    Because of the complexity of the attack, the target "must be of extremely high value to the attacker," Langner wrote in his analysis.

    Langner is set to present his findings at a closed-door security conference in Maryland this week, which will also feature a technical discussion from Siemens engineers.

    Langner said he wasn't yet ready to speak to a reporter at length ("the fact of the matter is this stuff is so bizarre that I have to make up my mind how to explain this to the public," he said via e-mail) but others who have examined his data say that it shows that whoever wrote Stuxnet clearly had a specific target in mind.

    "It's looking for specific things in specific places in these PLC devices. And that would really mean that it's designed to look for a specific plant," said Dale Peterson, CEO of Digital Bond.

    This specific target may well have been Iran's Bushehr reactor, now under construction, Langner said in a blog posting. Bushehr reportedly experienced delays last year, several months after Stuxnet is thought to have been created, and according to screen shots of the plant posted by UPI, it uses the Windows-based Siemens PLC software targeted by Stuxnet.

    Peterson believes that Bushehr was possibly the target. "If I had to guess what it was, yes that's a logical target," he said. "But that's just speculation."

    Langner thinks that it's possible that Bushehr may have been infected through the Russian contractor that is now building the facility, JSC AtomStroyExport. Recently AtomStroyExport had its Web site hacked, and some of its Web pages are still blocked by security vendors because they are known to host malware. This is not an auspicious sign for a company contracted with handling nuclear secrets.

    Tofino Security Chief Technology Officer Eric Byres is an industrial systems security expert who has tracked Stuxnet since it was discovered. Initially he thought it was designed for espionage, but after reading Langner's analysis, he's changed his mind. "I guessed wrong, I really did," he said. "After looking at the code that Ralph hauled out of this thing, he's right on."

    One of the things that Langner discovered is that when Stuxnet finally identifies its target, it makes changes to a piece of Siemens code called Organizational Block 35. This Siemens component monitors critical factory operations -- things that need a response within 100 milliseconds. By messing with Operational Block 35, Stuxnet could easily cause a refinery's centrifuge to malfunction, but it could be used to hit other targets too, Byres said. "The only thing I can say is that it is something designed to go bang," he said.

    Whoever created Stuxnet developed four previously unknown zero-day attacks and a peer-to-peer communications system, compromised digital certificates belonging to Realtek Semiconductor and JMicron Technology, and displayed extensive knowledge of industrial systems. This is not something that your run-of-the-mill hacker can pull off. Many security researchers think that it would take the resources of a nation state to accomplish.

    Last year, rumors began surfacing that Israel might be contemplating a cyber attack on Iran's nuclear facilities.

    Bushehr is a plausible target, but there could easily be other facilities -- refineries, chemical plants or factories that could also make valuable targets, said Scott Borg, CEO of the U.S. Cyber Consequences Unit, a security advisory group.

    "It's not obvious that it has to be the nuclear program," he said. "Iran has other control systems that could be targeted."

    Iranian government representatives did not return messages seeking comment for this story, but sources within the country say that Iran has been hit hard by the worm. When it was first discovered, 60 percent of the infected Stuxnet computers were located in Iran, according to Symantec.
    Now that the Stuxnet attack is public, the industrial control systems industry has come of age in an uncomfortable way. And clearly it will have more things to worry about

    "The problem is not Stuxnet. Stuxnet is history," said Langner in an e-mail message. "The problem is the next generation of malware that will follow."

    The purpose of the media is not to make you to think that the name must be changed, but to get you into debate - what name would suit us! - Bratot
  • Frank
    Banned
    • Mar 2010
    • 687

    #2
    I enjoyed the read actually made me laugh

    Comment

    • Bratot
      Senior Member
      • Sep 2008
      • 2855

      #3
      Cyber takes centre stage in Israel's war strategy

      Reuters Africa 09/28/2010



      Cyber warfare has quietly grown into a central pillar of Israel's strategic planning, with a new military intelligence unit set up to incorporate high-tech hacking tactics, Israeli security sources said on Tuesday.

      The purpose of the media is not to make you to think that the name must be changed, but to get you into debate - what name would suit us! - Bratot

      Comment

      • George S.
        Senior Member
        • Aug 2009
        • 10116

        #4
        well they say the biggest cyber threat are the chinese & they will stop at nothing.From stealing trade secrets to busting in the pentagon.
        "Ido not want an uprising of people that would leave me at the first failure, I want revolution with citizens able to bear all the temptations to a prolonged struggle, what, because of the fierce political conditions, will be our guide or cattle to the slaughterhouse"
        GOTSE DELCEV

        Comment

        • fyrOM
          Banned
          • Feb 2010
          • 2180

          #5
          In a Computer Worm, a Possible Biblical Clue

          A reference in computer code to the Book of Esther may or may not be a sign of an Israeli origin to the Stuxnet worm.


          Published: September 29, 2010

          Deep inside the computer worm that some specialists suspect is aimed at slowing Iran’s race for a nuclear weapon lies what could be a fleeting reference to the Book of Esther, the Old Testament tale in which the Jews pre-empt a Persian plot to destroy them.

          A Possible Target

          That use of the word “Myrtus” — which can be read as an allusion to Esther — to name a file inside the code is one of several murky clues that have emerged as computer experts try to trace the origin and purpose of the rogue Stuxnet program, which seeks out a specific kind of command module for industrial equipment.

          Not surprisingly, the Israelis are not saying whether Stuxnet has any connection to the secretive cyberwar unit it has built inside Israel’s intelligence service. Nor is the Obama administration, which while talking about cyberdefenses has also rapidly ramped up a broad covert program, inherited from the Bush administration, to undermine Iran’s nuclear program. In interviews in several countries, experts in both cyberwar and nuclear enrichment technology say the Stuxnet mystery may never be solved.

          See link for full story…

          Comment

          Working...
          X