Slashdot Mirror
Stuxnet Worm Infected Industrial Control Systems
Sooner Boomer writes "ComputerWorld has an article about the Stuxnet worm, which was apparently designed to steal industrial secrets and disrupt operations at industrial plants, according to Siemens. 'Stuxnet has infected systems in the UK, North America and Korea, however the largest number of infections, by far, have been in Iran. Once installed on a PC, Stuxnet uses Siemens' default passwords to seek out and try to gain access to systems that run the WinCC and PCS 7 programs — so-called PLC (programmable logic controller) programs that are used to manage large-scale industrial systems on factory floors and in military installations and chemical and power plants.' If the worm were to be used to disrupt systems at any of those locations, the results could be devastating."
So the largest number of infections have been in Iran. It is designed to disrupt industrial processes, which are also used by the military.
Obviously it was created by the CIA in an effort to spoil the Iranian nuclear program!
Proud member of the Ferengi Socialist Party.
If they still use default password, they deserve to be hacked and face total havoc.
Industry`s security is still so crappy.
So people not only leave the default password on their industrial controllers, they put them on the same network as Windows PCs... Wow.
Israel, not American.
Israel has always been an industrial spy on the US and Western Europe, but their big focus is Iran right now, so they test it on the US, UK and Korea but the main focus is Iran.
Wouldn't be surprised to find it in Saudi systems too
Iran the most affected country with 60% of infections, a highly sophisticated worm that resembles warfare espionage. NSA or CIA don't even need a backdoor in windows, just some obscure vulnerability, if it goes public ms maybe forced to patch.
I'm pretty sure it's only a matter of time before someone points to the finger at China.
"Sorrow is better than laughter, for by sadness of face the heart is made glad." [Ecclesiastes 7:3]
Who is programming their PLC's? And why aren't they put into 'lock' mode(AKA ROM) when they're put into production machinery so the EEPROM can't be affected? I used to write programs for PLC's(generally Mitsubishi and Siemens), and you always locked the device or update when you were finished, so things like this can't happen.
Om, nomnomnom...
Don't alot of the systems have isa slots and old software on them? But why default passwords?? even a easy 1234 password is better or just have the password on a post it note if it needed each day by many different people and you don't want to change it all the time.
But the ones in Iran did the us or some plant the worm there just to shut Iran down?
Why can't there be a fun Worm that gave free cable channel running on a cable system? why does it have to be ones that can do big damage? or not just stuff like free HBO and or PPV?
Why aren't these types of devices just set up to require setting a password prior to usage? Sure, you might forget the password, but it sure as heck beats out having some random stranger take control over such an important device from God-knows-where. At the same time, if the device must play an important role, why not just have a physical key that overrides passwords if you need to get to the system. What am I leaving out here? This seems like a pretty sure way to fix this problem.
Whatever, you paranoid delusional douche.
The positive spin on this story seems to me that although there were exploited vulnerabilities (but there always will be, that's why security is an ongoing process) it was effectively dealt with before any significant damages occurred. As long as lessons are learned, and remedies implemented this seems to be a good thing as far as I can tell.
Skynet just inched us one-step closer to the apocalypse by establishing its ability to assemble T1000 robots via CnC machines controlled by this botnet.
Seth
$5 / month hosted VPS on linux = awesome!
seems to be app passwords and not windows ones.
So if the app needs a password just to run or do stuff that needs to be done each day vs stuff that does not need to be done all the time there you go.
I've seen too much of this in recent years. Control systems should be separated from the Internet by an air gap unless they absolutely need to be connected to it.
http://pinopsida.com
It is one thing for an isolated programmer to make security errors in a program.
It is entirely another thing when a Siemens or similar puts out code all over the world and they OBVIOUSLY have no serious security review of their code.
If a giant plant or process is taken down by this type of worm or similar, is Siemans going to plead that their EULA protects and indemnifies them from any responsibility for loss by the user of the software?
This gives me the willys.
is here: http://www.us-cert.gov/control_systems/pdf/ICSA-10-238-01B%20-%20Stuxnet%20Mitigation.pdf Probably a little more accurate than crappy media reporting.
What *really* concerns me is the recent invasion of the NukenBomb virus that installs itself on the target PC and then starts issuing launch codes to the missile silo controller cards. I heard of a sophisticated defense against this attack that entailed separating something or inhibiting direct connectiwhatsises but I can't recall the details and I think it was too difficult to implement anyway.
Launch code "hunter2" accepted. Please enter target.
And, since USB is how code and software updates are usually delivered to these devices (not to mention the mouse and keyboard for the PC hook up), you can't just turn USB off either.
You may not be able to shut it off completely, but why can't you restrict what type of classes of USB device are attached when they're connected?
http://en.wikipedia.org/wiki/Universal_Serial_Bus#Device_classes
Also, if you need to have storage devices, what's the equivalent of "mount -o noexec,nodev,nosuid /dev/usb0 /mnt" on a Windows machine? Perhaps throw in an "ro" as well while you're at it if you don't want information leaking out, which would also prevent one system from spreading stuff around.
Obvious American intelligence tool. Why is it in North American plants?
Because Major Carter found the worm, and last night she reformated all American PCs.
She's quite good, you know. I've seen it.
Because they spend actual money to prevent that. Sure, blacking out the east coast is a problem, but people getting free HBO would be an unmitigated DISASTER.
Developers; Listen up! NEVER, EVER, EVER, EVER, EVER have a default password in apps you build. The setup should ask for a password if one is needed and the app should not install without one! What is so hard about this? It boggles my mind that things as important as routers, database servers and industrial equipment control software would install with default passwords! Why does that not raise red flags in developers' minds the second it pops into them?
do any industrial controller / software have online drm systems?
This has nothing to do with "default passwords". It's worse than that. The Windows-level part of the attack was signed code signed with a Microsoft-issued key. The signing keys involved has been revoked. US-CERT isn't saying who had them.
At the controller level, Siemens has issued a bulletin: Previously analyzed properties and the behavior of the virus in the software environment of the test system suggest that we are not dealing with the random development of one hacker, but with the product of a team of experts who must have IT expertise as well as specific know-how about industrial controls, their deployment in industrial production processes and corresponding engineering knowledge. ... The behavioral pattern of Stuxnet suggests that the virus is apparently only activated in plants with a specific configuration. It deliberately searches for a certain technical constellation with certain modules and certain program patterns which apply to a specific production process. This pattern can, for example, be localized by one specific data block and two code blocks.
This means that Stuxnet is obviously targeting a specific process or a plant and not a particular brand or process technology and not the majority of industrial applications.
So this is an attack on a specific industrial plant. But whose? Neither Seimens nor US-CERT is saying.
This is cyber-warfare. Someone is trying to sabotage a specific plant somewhere.
traffic lights need the internet for the red light cameras to send the pic's / video out!
Well, they're just thinking of the children. Imagine if children suddenly had access to violent movies on channels their parents didn't think they needed to block!
:P
Ok, I'm just going to stop baiting the trolls now
what about routers and other systems that need that pass word just to get the setup / config screen / page?
Just a note to the FBI, before you ignore that next spambot virus running around unencumbered, keep in mind it might just be spamming so it will be ignored by law enforcement. The primary objective might be cyberattack.
Red light cameras are a separate enforcement system where I live. They most likely get a contact closure from the signal controller for coordination.
http://michaelsmith.id.au
"however the largest number of infections, by far, have been in Iran"
Can we even take that statement at face value? Who in Iran is reporting these? Has a "Command and Control" hub for the botnet been captured?
Is the traffic analysis - up in the layer-4 part of the packet - so good that this has been observed in transit?
Disinformation has wheels within wheels, my friends.
"Flyin' in just a sweet place,
Never been known to fail..."
Looks like it worked. Boom goes the gas line in California.
Turned up the pressure on a valve somewhere? Old pipes.
Just a matter of time with a big gas leak before it finds a flame.
I just about shat my pants.
We got complacent in the last few years. Since there was too much money in viruses, nobody caused mayhem for fun - it was all spam botnets and the like, something the writer could monetize.
This isn't a kid reminiscing about the shits-and-giggles days. I daresay the writers of this virus are hoping to profit in a big way.
This is the stuff of the 'movie virus', where some well-spoken sinister-looking guy goes and shuts down a city for ransom money.
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
Realtek, according to everyone else on the internet. Which might point the finger at China, who would be well placed to acquire keys from Realtek and who have a well-publicised history of industrial espionage and using malware to attack foreign governments.
There are indications that the target may have been the Bushehr nuclear power plant in Iran, with the Russian contractor's USB drives being the attack vector into the plant's control systems. (Which are not on the Internet, despite the smug assumptions of so many posters earlier in this comments section.) There's enough information out in the wild now that anyone with access to the target's PLC code could verify the target. Obviously this means the attack targets will be able to prove that the trojan was targeting them, but I doubt they'll be announcing the fact to the world - unless they can trace the attackers and gain political advantage through an announcement.
It seems the evidence currently leans towards a probably Israeli or possibly US cyberwarfare attack on Iran.
Inside job - they engineer the problem - already having the solution ready - so much for the free internet... RIP
I've seen that on point of sales machines and the server for those POS machines - change the default password and they stop working. To make things worse the password was written on the things, the manufacturers name! Anyone with physical access could have embezzled huge amounts by changing totals and the only thing anyone else would notice is that sales are lower on one day than another. Physical access to the servers is often available to just about any employee or visitor, and because they were sold to a lot of places the "inside job" factor applies to anyone that has used those machines anywhere.
There are a lot of systems where security is nothing but an afterthought to tick a box, in that case the box was "password protected" but it's just like the missile systems that had 0000 as a password.
Sounds like someone's trying to hack the Gibson
How about Banking & Finance: The core system is even reachable from Windows networks.
I've been working within the banking industry and having the entire windows network knocked down due to viruses. The only reason there's no major disruption to the core services is that they're usually DB2 and kinda archaic.
http://www.debunkingskeptics.com/
Why would you assume most such incidents would be reported?
Insiders will not break their loyalty, and any breach of loyalty are disencouraged, thus the insecure practices lives on until something even more major breaks.
http://www.debunkingskeptics.com/
Comment removed based on user account deletion
"German IACS security researcher Ralph Langner has successfully analyzed the Stuxnet malware that appeared to be a miracle. Stuxnet is a directed attack against a specific control system installation. Langner will disclose details, including forensic evidence, next week at Joe Weiss' conference in Rockville. " http://www.langner.com/en/index.htm
Simple.
What GP posted also goes for firmware developers.
And the solution is to make the router not work until its password has been set. No networking, no configuration, no anything except a "Set password" screen, itself only accessible from a computer connected directly to one of the downstream ports.
The problem is that it's better marketing to make stuff, even security sensitive things like routers, work out of the box. Convenience is a bigger boost to the bottom line for the router factory. And of course, once it's been sold, it's the IT department's problem.
Or hacking email accounts belonging to political dissidents.
Check out that README file from SIMATIC PCS 7 CEMAT libraries found at
http://bit.ly/brTlB7
Page 2 "Projekt Schlüssel" (=project key) 024
I bet a "gefillte fish" that project key 024 is stuxnet's target site...
Make it simpler.
Worms are often more widely spreaded were them are created, so it's definitely Iran,
and the worm got out of control.
"Called Stuxnet, the worm was discovered in July when researchers at VirusBlokAda found it on computers in Iran. It is one of the most sophisticated and unusual pieces of malicious software ever created -- the worm leveraged a previously unknown Windows vulnerability (now patched) that allowed it to spread from computer to computer, typically via USB sticks" link
The real problem is NOT the OS, since it is pretty obvious this attack has been specifically designed to hit a very small niche target, which means no matter what OS you were running the malware writers would have simply written to that target.
Correct me if I'm wrong, but my understanding is that this worm wasn't hand-carried into the target. That would have been difficult and very risky to the perpetrators. Rather, the worm got to it's target by first spreading through a huge number of vulnerable non-target machines in the hope that one of them would be adjacent to a real target.
One of the other posters on this thread confirms that this nearly happened at the plant he works for, but they were able to contain it before it jumped to the production machines.
So while it's true that the payload itself might have been targeted at any OS, the vector itself was highly dependent on the existence of a monoculture of vulnerable-OS machine that make this delivery strategy so damned effective. It's really just icing that the target machines were also Windows, meaning that the perpetrators could re-use the same vulnerabilities to get all the way in.
I have a problem with the summary: "apparently designed to steal industrial secrets and disrupt operations". That seems just unutterably stupid. Any sane malefactor would do one or the other, not both. If I were in the business of stealing secrets, I wouldn't go around waving a big flag saying "LOOK AT ME, I'M A FUCKING SPY". Duh.
Except for the fact that sixpack Joe resets his Linksys router to defaults all the time to fix internet connection issues...but never connects to the web interface or does any router configuration.
The default password is only usable from the local network interface anyway by default. If someone's already cracked into the local network he's pretty much screwed already. What would stop a worm on the local network from just sniffing the password, or brute forcing the web or telnet interface?
The clash of honour calls, to stand when others fall.
Probably antivirus programs that report their findings back to home base so the parent company can assess threats and display them to the public.
The previous author's conjecture is wrong. The actual origin of the worm was Siemans itself, and it was developed by organisations wanting to bring other countries such as the USA to it's knees, or even to cause self destruction of electrical grids, manufacturing systems etc. Siemans was reporting it's own product. My conjecture is to show that if he author does not have proof of his recommendation, he is immature and should just not express unsubstantiated opinions. By the way, my conjecture is as false as his.
Leslie Satenstein Montreal Quebec Canada
Why are mission control systems, with critical tasks, given access to the internet...how is it even possible that say the powergrid be hooked up to the internet? Seriously, I know BSG is only a movie, but they made it clear what the real security solution was, keep everything under networked, only hooking up what you need to be hooked up, and all else singular systems.
Also, this brings about a good point...instead of always watching and waiting for the next botnet to appear and then let it go so that you can "study" it, sometimes it is always good to just kill it if you can, and I am sure now the agencies in place even the security companies are letting most botnets grow , so that 6 months later they can come in, and take it down and be an even bigger hero...
because of the sheer size of the botnet taken down.
I see it this way, like a hockey game, you can have a goalie that stops all the goals and never lets one in....but maybe still lose if both teams are at 1 - 1 and the last goal happens to get by...although he stopped 60 goals from going in, or a goalie that stops none of the goals, but one the last one with both teams tied, stops the puck.... which goalie is better, the one that let the game build up and saved the last puck from going in, but with a bad record, or the goalie that stopped every single on except maybe that last one...