Called Stuxnet, the worm was discovered in July when researchers at VirusBlokAda found it on computers in Iran. It is one of the most sophisticated and unusual pieces of malicious software ever created — the worm leveraged a previously unknown Windows vulnerability (now patched) that allowed it to spread from computer to computer, typically via USB sticks.
The worm, designed to attack Siemens industrial control systems, has not spread widely. However, it has affected a number of Siemens plants, according to company spokesman Simon Wieland. “We detected the virus in the SCADA [supervisory control and data acquisition] systems of 14 plants in operation but without any malfunction of process and production and without any damage,” he said in an e-mail message.
This is worrisome news because according to a new paper on the worm, set to be delivered at this month’s Virus Bulletin conference in Vancouver, Stuxnet could be used to cause a significant amount of damage if it is not properly removed.
Once installed on a PC, Stuxnet uses Siemens’ default passwords to seek out and try to gain access to systems that run the WinCC and PCS 7 programs — so-called PLC (programmable logic controller) programs that are used to manage large-scale industrial systems on factory floors and in military installations and chemical and power plants.
The software operates in two stages following infection, according to Symantec Security Response Supervisor Liam O’Murchu. First it uploads configuration information about the Siemens system to a command-and-control server. Then the attackers are able to pick a target and actually reprogram the way it works. “They decide how they want the PLCs to work for them, and then they send code to the infected machines that will change how the PLCs work,” O’Murchu said.
- Stuxnet computer worm takes its toll on Iran, where nuclear plant may be target (venturebeat.com)
- Iran media report new cyberattack by Stuxnet worm, by @AP @nytimes (nextlevelofnews.com)
- Stuxnet virus may have actually helped the Iranian nuclear program (dailydot.com)
- Report suggests malware hits Iran atomic organization, blasts AC/DC at night (venturebeat.com)
- It’s not just about China and America – smaller countries want to wage cyberwar too (qz.com)
- Yet Another Stuxnet Article (cybermatters.info)
- Symantec uncovers an older version of Stuxnet, proving it is directly related to Flame (venturebeat.com)