Stuxnet Infected (But Didn't Affect) Chevron Network In 2010
Penurious Penguin writes "The Wall Street Journal, in correspondence with Chevron representatives, reveals that back in 2010, Stuxnet reached Chevron, where it managed to infect — but not significantly affect — the oil giant's network. According to a Chevron representative speaking to CNET, the issue was 'immediately addressed ... without incident.' The Stuxnet worm is believed to be the work of the U.S. and Israel, and this report is confirmation that it struck well wide of its intended targets. Chevron's general manager of the earth sciences department, Mark Koelmel, said to CIO Journal, 'I don't think the U.S. government even realized how far it had spread ... I think the downside of what they did is going to be far worse than what they actually accomplished.'"
The transport used was fairly generic in nature, but since the payload was aimed at a specific controller used on centrifuges its not surprising that it had little effect elsewhere.
Even if that Siemens motor controller was common, its use case in Iran was rather specific, and chances are the payload was pretty specific to exact firmware levels. From Wiki:
While the worm is promiscuous, it makes itself inert if Siemens software is not found on infected computers, and contains safeguards to prevent each infected computer from spreading the worm to more than three others, and to erase itself on 24 June 2012.
Had it been given a shorter life span than two years, chances are it would never have been discovered.
The real risk here is that others have climbed on board this train and are using essentially the same engine for other purposes.
Sig Battery depleted. Reverting to safe mode.
Unless Chevron is running centrifuges in Iran, Stuxnet probably wouldnâ(TM)t have been much of an issue as the Stuxnet code was pretty specific. But of course the real issue for Chevron it *how* they allowed Stuxnet to infect at all? What was the vector, and why was it either Interwebs connected or techs were using infected thumb drives?
If you want news from today, you have to come back tomorrow.
new meaning
Gently reply
Put Microsoft on the list of terrorist groups.
You have a choice between real people dying or computers catching a virus. Personally, I prefer the latter. The more effective we are in slowing down Iran's nuclear program, the more time we have before we need to resort to military action. I think everyone can agree harsh sanctions and computer viruses are preferable to all-out war. That is, so long as they work. Those who criticizes legitimate sanctions and the passive actions like computer viruses doesn't understand that their actions are just leading to all-out war.
"I think the downside of what they did is going to be far worse than what they actually accomplished.'"
Someone didn't read up.
Idiot. That is all...
I think the downside of what they did is going to be far worse than what they actually accomplished.
So you think nuclear proliferation is acceptable and that Iran will manage being a Nuke Bomb owner in a sensible way? Really?
A "bomb" in the hands or the Iranians is truly a terrifying thing.
If you want news from today, you have to come back tomorrow.
You have a choice between real people dying or computers catching a virus... The more effective we are in slowing down Iran's nuclear program, the more time we have before we need to resort to military action...
Lemme start by saying that I agree.
But isn't sabotage an act of war?
The US seems to think so: http://www.geek.com/articles/news/pentagon-rules-cyber-attacks-and-sabotage-constitute-an-act-of-war-20110531/
And that it justifies military response.
https://www.us-cert.gov/control_systems/pdf/ICS-CERT_Incident_Response_Summary_Report_09_11.pdf
page 13
See subject-line: This remind ANYONE of "Frankenstein's Monster", or what?
* What a lesson to learn, man... creating a soulless machination that has NO mercy, NO conscience, NO pity, and certainly NOT VERY GOOD JUDGEMENT either!
APK
P.S.=> Thus "the monster returns to "wreak havoc" on its creator(s)" it seems (assuming Chevron's a U.S. Industrial Concern, that is - I would say it is offhand, but someone correct me IF I am incorrect there, thanks-in-advance)...
... apk
Americans are crazy and have no problem invading one foreign country after another. Even a foreign country that has done nothing wrong to them but has been bombed and its own citizens put into oppression the American government and their allies.
At least Iran does not invade other countries nor threatens them unless of course the other countries interfere with them first.
A reminder it was the US government who installed the Shah in the first place that started that countries hatred to the US. If any country that should give up its nuclear weapons it should be the US.
How a hop-based virus managed to "spread" to chevron's network is proably an excercise left to the reader.
Anonymous Coward
Central Intelligence Agency (CIA)
Air Force Intelligence, Surveillance and Reconnaissance Agency (AFISRA)
Army Intelligence and Security Command (INSCOM)
Defense Intelligence Agency (DIA)
Marine Corps Intelligence Activity (MCIA)
National Geospatial-Intelligence Agency (NGA)
National Reconnaissance Office (NRO)
National Security Agency (NSA)
Office of Naval Intelligence (ONI)
Office of Intelligence and Counterintelligence (OICI)
Office of Intelligence and Analysis (I&A)
Coast Guard Intelligence (CGI)
Federal Bureau of Investigation (FBI)
Drug Enforcement Administration, Office of National Security Intelligence (DEA/ONSI)
Bureau of Intelligence and Research (INR)
Office of Terrorism and Financial Intelligence (TFI)
These are just the ones we are aware of. Remember the NSA was classified when it was created.
At least Iran does not invade other countries nor threatens them unless of course the other countries interfere with them first.
A reminder it was the US government who installed the Shah in the first place that started that countries hatred to the US.
Oh look, another anti-US A.C. whose history book apparently only goes back about 100 years. Let's turn the pages back a little further, and see what we can find...
"In 1729 Nader Shah successfully drove out the Pashtuns from Isfahan. By 1735 Nader Shah had regained territory lost to the Ottomon and Russian Empires, and in 1738 staged a very profitable incursion into the Mughal Empire. His military successes on all fronts earned him the nickname "Napoleon of Persia" or "the second Alexander".
Oops, I seem to have spilled reality all over your carefully constructed shit-pile.
If your using the same controllers as the target for that virus, but your not running applications requiring precise speed control you would not even notice anything has changed. As I understand it, centrifuges rely on a well controlled rotation speed to hit a certain amount of G force. Most industrial applications don't require speed control to be that exact and generally are not going to be running fast enough to cause destruction from the stress. It sure is sad that the trolls have nothing better to do than take this subject so far off course this leads to 95% of the thread being useless garbage. I guess many of them are now unemployed and looking for something to do, since they seem to have at least another 4 years to find a job.
How does one detect Suxnet or Duqu? I keep seeing these sensationalist and politicized regurgitated "stories", but never any information about how to detect or remove them. Does anyone know how?
I've seen some systems with inexplicable behavior and I can't help but wonder if Stux/Duqu may be lurking.