Infiltrator Posted September 27, 2010 Share Posted September 27, 2010 (edited) Computerworld - Officials in Iran have confirmed that the Stuxnet worm infected at least 30,000 Windows PCs in the country, multiple Iranian news services reported on Saturday. Experts from Iran's Atomic Energy Organization also reportedly met this week to discuss how to remove the malware. Stuxnet, considered by many security researchers to be the most sophisticated malware ever, was first spotted in mid-June by VirusBlokAda, a little-known security firm based in Belarus. A month later Microsoft acknowledged that the worm targeted Windows PCs that managed large-scale industrial-control systems in manufacturing and utility companies. Those control systems, called SCADA, for "supervisory control and data acquisition," operate everything from power plants and factory machinery to oil pipelines and military installations. According to researchers with U.S.-based antivirus vendor Symantec, Iran was hardest hit by Stuxnet. Nearly 60% of all infected PCs in the earliest-known infection were located in that country. Since then, experts have amassed evidence that Stuxnet has been attacking SCADA systems since at least January 2010. Meanwhile, others have speculated that Stuxnet was created by a state-sponsored team of programmers, and designed to cripple Iran's Bushehr nuclear reactor. The reactor, located in southwestern Iran near the Persian Gulf, has been the focus of tension between Iran and the West, including the U.S., which believes that spent fuel from the reactor could be reprocessed into high-grade plutonium and used to build one or more nuclear weapons. According to the Tehran-based Mehr News Agency, Mahmoud Alyaie, an IT official with Iran's industries and mines ministry, said that 30,000 IP addresses in the country had been infected with Stuxnet. Multiple computers can access the Internet via a single IP address, so the total number of infected Windows PCs may be considerably larger. A working group composed of experts from several Iranian government ministries has been established to deal with the Stuxnet infection, Alyaie said. Other sources quoted by Mehr claimed that Iran has the capability to craft the necessary antivirus tools to detect and destroy the worm. Also on Saturday, the Associated Press (AP) news service said that experts from Iran's nuclear energy agency met last Tuesday to plan how to remove Stuxnet from infected PCs. Citing the ISNA news agency, another Tehran-based organization, the AP said no victimized plants or facilities had been named. Speculation about Stuxnet's likely target has focused on the Bushehr reactor. Saturday, the Web site of Iran's Atomic Energy Organization included a link to a lengthy Mehr story on Stuxnet. That story noted that government officials said that "serious damage that caused damage and disablement" had been reported to officials. Although Bushehr is not yet operational, workers began loading nuclear fuel into the reactor last month. Stuxnet, called "groundbreaking" by one analyst who pulled apart its code, used multiple unpatched, or "zero-day" vulnerabilities in Windows, relied on stolen digital certificates to disguise the malware, hid its code by using a rootkit, and reprogrammed PLC (programmable logic control) software to give new instructions to the machinery that software managed. Microsoft has patched two of the four zero-day vulnerabilities exploited by Stuxnet, and has promised to fix the remaining two flaws at some point. Source: http://www.computerworld.com/s/article/918...ustrial_systems Edited September 27, 2010 by Infiltrator Quote Link to comment Share on other sites More sharing options...
okiwan Posted September 28, 2010 Share Posted September 28, 2010 Stuxnet, considered by many security researchers to be the most sophisticated malware ever wow. the author must have such a large ego right now. i wonder how long he was working on it before it was released. Quote Link to comment Share on other sites More sharing options...
Infiltrator Posted September 28, 2010 Author Share Posted September 28, 2010 (edited) wow. the author must have such a large ego right now. i wonder how long he was working on it before it was released. It would've taken him a sometime to desigh the worm. You got to know how the system itself works, before attempting to create a worm. I guess it must have had inside help and as well as other worm writers to help him pull this attack. Edited September 28, 2010 by Infiltrator Quote Link to comment Share on other sites More sharing options...
okiwan Posted September 28, 2010 Share Posted September 28, 2010 It would've taken him a sometime to desigh the worm. You got to know how the system itself works, before attempting to create a worm. I guess it must have had inside help and as well as other worm writers to help him pull this attack. ya i read some where that they think its most likely an inside job and not espionage. what sucks is that who ever wrote it, thats like probably his greatest achievement and he cant even brag about it. maybe it was written by a new breed of cyber eco-terrorist terrorist. lol. Quote Link to comment Share on other sites More sharing options...
Infiltrator Posted September 28, 2010 Author Share Posted September 28, 2010 (edited) "Stuxnet worm created by team of hackers working for country, experts say" A POWERFUL computer code attacking industrial facilities around the world, but mainly in Iran, was probably created by experts working for a country or a well-funded private group. Creating the malicious code required a team of as many as five to 10 highly educated and well-funded hackers. Source: http://www.news.com.au/technology/stuxnet-...0-1225929809035 Edited September 28, 2010 by Infiltrator Quote Link to comment Share on other sites More sharing options...
IOSys Posted September 29, 2010 Share Posted September 29, 2010 (edited) Once inside the system it uses the default passwords to command the software. Siemens however advises against changing the default passwords because it "could impact plant operations" !!! http://en.wikipedia.org/wiki/Stuxnet All your power-plants are belong to U.S. I guess they will just have to make another falseflag attack to justify bombing Iran .. Edited September 29, 2010 by IOSys Quote Link to comment Share on other sites More sharing options...
Matessim Posted September 29, 2010 Share Posted September 29, 2010 Stuxnet... Skynet 1.0? Quote Link to comment Share on other sites More sharing options...
Infiltrator Posted September 30, 2010 Author Share Posted September 30, 2010 Stuxnet... Skynet 1.0? I wonder if the worm is modular? If it is than, they may already be planing on another version of Stuxnet. Quote Link to comment Share on other sites More sharing options...
iisjman07 Posted October 12, 2010 Share Posted October 12, 2010 BitDefender released a tool today (or yesterday) that removes all known variants: http://technibble.com/forums/showthread.php?t=20949 Quote Link to comment Share on other sites More sharing options...
Infiltrator Posted October 13, 2010 Author Share Posted October 13, 2010 (edited) Just download and install Avast 5, it will keep you safe from almost anything. If you want 100% detection and protection, go with the retail version of Kaspersky. Edited October 13, 2010 by Infiltrator Quote Link to comment Share on other sites More sharing options...
charm_quark Posted October 13, 2010 Share Posted October 13, 2010 the virus removal tool of theirs is also not bad! Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.