Musik @ Centrifugen

Det var bara en tidsfråga innan vi skulle se ett virus som kan slå ut infrastruktur och industrianläggningar runtom i världen. Stuxnet tycks vara det första välriktade viruset för att slå ut industrianläggningar. Faktum är att det enligt experter är ett av de mest sofistikerade virus man någonsin skådat. Via Zero Hedge (som vanligt) kommer uppgifterna om att det troligen är ett virus riktad mot en specifik anläggning, nämligen Irans kärnanläggning. Som det verkar har viruset dessutom slagit ut anläggningen!

Yahoo skriver

The cyber worm, called Stuxnet, has been the object of intense study since its detection in June. As more has become known about it, alarm about its capabilities and purpose have grown. Some top cyber security experts now say Stuxnet’s arrival heralds something blindingly new: a cyber weapon created to cross from the digital realm to the physical world – to destroy something.

At least one expert who has extensively studied the malicious software, or malware, suggests Stuxnet may have already attacked its target – and that it may have been Iran’s Bushehr nuclear power plant, which much of the world condemns as a nuclear weapons threat.

The appearance of Stuxnet created a ripple of amazement among computer security experts. Too large, too encrypted, too complex to be immediately understood, it employed amazing new tricks, like taking control of a computer system without the user taking any action or clicking any button other than inserting an infected memory stick. Experts say it took a massive expenditure of time, money, and software engineering talent to identify and exploit such vulnerabilities in industrial control software systems.

Unlike most malware, Stuxnet is not intended to help someone make money or steal proprietary data. Industrial control systems experts now have concluded, after nearly four months spent reverse engineering Stuxnet, that the world faces a new breed of malware that could become a template for attackers wishing to launch digital strikes at physical targets worldwide. Internet link not required.

Man kan ana vem som ligger bakom detta virus. Det är garanterat inte en finnig 17-årig australiensare!

Yahoo forts.

Stuxnet surfaced in June and, by July, was identified as a hypersophisticated piece of malware probably created by a team working for a nation state, say cyber security experts. Its name is derived from some of the filenames in the malware. It is the first malware known to target and infiltrate industrial supervisory control and data acquisition (SCADA) software used to run chemical plants and factories as well as electric power plants and transmission systems worldwide. That much the experts discovered right away.

But what was the motive of the people who created it? Was Stuxnet intended to steal industrial secrets – pressure, temperature, valve, or other settings –and communicate that proprietary data over the Internet to cyber thieves?

By August, researchers had found something more disturbing: Stuxnet appeared to be able to take control of the automated factory control systems it had infected – and do whatever it was programmed to do with them. That was mischievous and dangerous.

But it gets worse. Since reverse engineering chunks of Stuxnet’s massive code, senior US cyber security experts confirm what Mr. Langner, the German researcher, told the Monitor: Stuxnet is essentially a precision, military-grade cyber missile deployed early last year to seek out and destroy one real-world target of high importance – a target still unknown.

”Stuxnet is a 100-percent-directed cyber attack aimed at destroying an industrial process in the physical world,” says Langner, who last week became the first to publicly detail Stuxnet’s destructive purpose and its authors’ malicious intent. ”This is not about espionage, as some have said. This is a 100 percent sabotage attack.”

Det som blir kusligt är hur stor spridning detta virus fått. Viruset verkar vara riktat mot anläggningar som använder sig av Siemens industrisystem.

Computerworld skriver:

The worm, designed to attack Siemens industrial control systems, has not spread widely. However, it has affected a number of Siemens plants, according to company spokesman Simon Wieland. ”We detected the virus in the SCADA [supervisory control and data acquisition] systems of 14 plants in operation but without any malfunction of process and production and without any damage,” he said in an e-mail message.

This is worrisome news because according to a new paper on the worm, set to be delivered at this month’s Virus Bulletin conference in Vancouver, Stuxnet could be used to cause a significant amount of damage if it is not properly removed.

Researchers at Symantec have cracked Stuxnet’s cryptographic system, and they say it is the first worm built not only to spy on industrial systems, but also to reprogram them.

Once installed on a PC, Stuxnet uses Siemens’ default passwords to seek out and try to gain access to systems that run the WinCC and PCS 7 programs — so-called PLC (programmable logic controller) programs that are used to manage large-scale industrial systems on factory floors and in military installations and chemical and power plants.

The software operates in two stages following infection, according to Symantec Security Response Supervisor Liam O’Murchu. First it uploads configuration information about the Siemens system to a command-and-control server. Then the attackers are able to pick a target and actually reprogram the way it works. ”They decide how they want the PLCs to work for them, and then they send code to the infected machines that will change how the PLCs work,” O’Murchu said.

Det är dags att vakna och inse att världen består av flera plan på vilka stater och fientliga grupper kan verka. Det intressanta i sammanhanget är hur många (eller snarare få) svenska medier som skrivit om denna ”incident”. IDG är en av få som har uppmärksammat det.

IDG skriver:

Enligt forskare är situationen allvarlig då Stuxnet är den första mask som har förmågan att spionera på industrisystem och samtidigt programmera om sig själv. Att avlägsna masken på ett felaktigt sätt kan därför orsaka stor skada.

Även om Siemens uppger att deras fabriker inte påverkats av viruset finns det enligt Liam O’Murchu på Symantec risk för att så inte är fallet. Eftersom masken kan programmera om sig själv kan upphovsmakarna ha utfört saker som Siemens inte vet om.

Stuxnet har smittat industrisystem i Storbritannien, Nordamerika och Korea. De flesta bekräftade fallen har emellertid upptäckts i Iran. Skulle masken komma åt fabriker som tillverkar kemikalier eller ett elkraftverk skulle efterföljderna kunna bli förödande.

Vad jag kan konstatera av allt detta är att det inte är något nytt som framkommer egentligen, bara en bekräftelse på att worst case scenario för cyberattacker nu blivit verklighet!

Källa:
http://blogs.forbes.com/andygreenberg/2010/09/22/theories-mount-that-stuxnet-worm-sabotaged-iranian-nuke-facilities/
http://www.zerohedge.com/article/deadf007-stuxnet-secret-weapon-attack-irans-nukes-virus-about-revolutionize-modern-warfare
http://news.yahoo.com/s/csm/327178
http://www.computerworld.com/s/article/9185419/Siemens_Stuxnet_worm_hit_industrial_systems
http://www.symantec.com/connect/blogs/stuxnet-introduces-first-known-rootkit-scada-devices
http://www.idg.se/2.1085/1.340031/siemens-industrimasken-har-smittat-flera-fabriker