Slashdot Mirror
Stuxnet May Represent New Trend In Malware
Trailrunner7 writes "As more information continues to come out about the Stuxnet worm and the vulnerabilities that it exploits, it's becoming increasingly clear that this kind of attack may be a preview of the attacks that are likely to become commonplace in the months and years ahead. The most interesting aspect of all of this is the fact that the attackers behind Stuxnet clearly knew about the vulnerability in the Siemens WinCC system before the malware was written. That implies the malware authors had some advance intelligence about the configuration of the Siemens software and knew exactly where there was a weakness."
The article that the summary links to in support of the idea that the attackers had inside information is actually about a hardcoded password that existed for *two years* before the vulnerability was found. The article argues pretty strongly that security through obscurity is no security at all and makes no mention of anyone having inside information - how can you get it so wrong?
There's no point in fixing anything just because you know it's wrong. You just wait until it infects your customers and becomes a liability. Even then, you have the bean counters figure out if it's worth paying off. Corporations are only liable for the current quarter, so no point in paying attention to the next quarter.
Given that we have absolutely *no* idea how many similar attacks have been conducted in the past against really "niche" applications like this without being detected, I think it's a little naíve to assume that this is the start of a new trend.
We find out about most malware because it's so widely targeted and so many people are affected by it, but when you're targeting your malware at a handful of companies and probably directly delivering it via email or physically ("dropped" USB stick in the parking lot) with the aim of keeping it undetectable for as long as possible, it makes it much more difficult for the targets and security researchers to even know it exists.
Umm, you do realize this was something posted on Slashdot, right?
Did you know 80 to 90% of the moderators on slashdot wouldn't recognize a troll even if one dragged them under a bridge.
with the products from Siemens (internal point of view) let me say:
- They know jack shit about software and the process around it
- They care (a bit) about the customer, especially if there's a loud complaint
- Politics hampers the sw development process (as in, let's spend 500% in sw here because 'blah' can't be bothered to change the original software)
Or they share a brain
Seriously? The attackers knew about the vulnerability before they wrote something to exploit it? I never would have guessed
My career is in industrial automation - and I am an IT guy who 'gets' both sides of things. There are not a lot of people like me and I constantly face an uphill battle when I try to explain computer security to people or try to explain why certain things are much more complicated than they believe. For example, you have an industrial network that is completely unnattached from the corporate network that is used for automating an exothermic chemical process on a large scale where you cannot just 'hit e-stops' and safely shut down the process. If you lose 'visibility' on the process at any time, there is potential for an explosion or chemical release. They think they're immune to viruses and they do not run virus-scanning software (imo, usually a good thing in an industrial network) so they do not even bother to completely lock down the computers. We're talking Windows boxes where everyone knows the admin password. After a virus or two, they usually pay me to lock everything down and put the operators on limited profiles. Then, the white-collar management wants to be able to connect into everything to see what is going on. Suffice it to say.. it's a damn headache. IT doesn't get it and the plant managers don't get it.. And usually one wins out over the others. If IT wins, expect a plant to randomly shut down because they push an incompatible Windows patch. If the plant wins, expect a laughably insecure network where an operator charging his cell phone can take the whole network offline.
Basically, if you ask an IT guy 'What is security?' it will be a lot different than an industrial plant manager's response. An industrial plant manager will say a SCADA system is most secure if the people on site always have control over the plant. If a man has his hand caught in a machine, should another person at the plant have to login to a terminal to turn the machine off?
I'm frustrated by this virus, though, because from what I've seen, there has been NO utilities released to detect if you have it. I have seen abnormal activity on multiple HMI computers and the people in charge of maintaining them plug their thumb drives in randomly thinking as long as their laptop doesn't detect a virus on it, they're safe. At least conficker was obvious to detect on a thumb drive or running computer.
If there is a utility, can someone link to it for me?
--- We need more Ron Paul!
I hope they manage to keep the obscurity as far as how much of our infrastructure depends on these systems. Firesale anyone?
Why can't we go back to using jumpers to configure slot adapter cards? Why? I say!
"The most interesting aspect of all of this is the fact that the attackers behind Stuxnet clearly knew about the vulnerability in the Siemens WinCC system before the malware was written. That implies the malware authors had some advance intelligence about the configuration of the Siemens software and knew exactly where there was a weakness."
So what you're saying is that all other malware doesn't make use of advance intelligence to exploit weaknesses in software or its common configuration?
Here's a neat trick for newer windows os (or XP, as I've never seen vista/7 used in industrial application):
Run a windows guest on the secured box. Bridge its connection to the host's adapter and disable all the host's net adapter items in its properties (so it only provides connectivity to the guest). This way, the guest may interact normally with the rest of the company's network. To exchange files, use the local folder sharing feature in the virtualization app. Only activate it when necessary, or limit it to read-only if you only need to export information from the host.
Unless there's a traversal vulnerability in the virtualization app, this method is relatively secure.
VirtualBox can do that for 'free' or evaluation purpose.
Cue in the fallacies from the paid M$ astroturfing fanbois, singing in chore "monocrop argument, monocrop argument".
Right click My Computers > Properties > Hardware > Device Manager:
That's Windows you're working with. And if you are using Windows in an industrial environment, you've already screwed up. Forget about the usual /. nonsens of Windows Bad, Linux Good. Actually, you'll need a special RT version of Linux. According to Microsoft licensing terms Windows is NOT suitable for use where life or property loss may result from failure. Game over.
Have gnu, will travel.
I guess you don't understand the basics of economics. If you increase the cost of doing business for a company, they just pass it along to consumers as higher prices to offset the increased bottom line cost.
CUSTOMERS are who pay the bills for a company, not the tooth fairy or some magic box.
Same concept goes for 'ya, stick it to them evil companies with higher taxes', but that is a different topic for a different day.
---- Booth was a patriot ----