UA-9726592-1

Saturday, October 2, 2010

Time of India: Origen of Stuxnet worm/Tmphider rootkit

BEIJING: The much-feared new cyber-weapon, the 'Superbug', which has attacked over six million personal and almost 1,000 corporate computers in has been traced to the US, official media reported.

The Stuxnet cyberworm can break into computers and steal private information, especially from industrial firms, sending it back to a server in the , state-run quoted Wang Zhantao, an engineer at the Beijing-based , an anti virus service producer in China, as saying.

The super virus made use of a bug in Siemens auto-control systems used in industrial manufacturing to skip the security check, Wang who has been vastly quoted in the local media for the past few days, said.

The virus can copy itself and spread via USB drives in the network of a company and government. Any USB  drive plugged into an infected PC will pick up the Stuxnet malware. 

"Hackers may take control of a company's machinery run under computers infected by Stuxnet, and give dangerous orders causing serious damage," he said.
The company has developed softwares to kill the virus, which can be downloaded for free from the company's official website, he said.

Official media has been carrying reports about the superbug virus for the past few days said it contained sophisticated malicious software, or malware, believed to be a "new cyber-weapon," which infiltrates mainly factory computers in China threatening the country's national security.

The Stuxnet worm was first discovered in mid-June and was specially written to attack Siemens supervisory control and data (SCADA) systems commonly used to control and monitor industrial facilities - from traffic lights and oil rigs to power and nuclear plants, state run Global Times daily reported few days ago.

"This malware is specially designed to sabotage plants and damage industrial systems, instead of stealing personal data. It will seriously threaten pillar industries in China, which has 420 million internet users," Wang said.

"Once Stuxnet successfully penetrates factory computers in China, those industries may collapse, which would damage national security," he said adding that it posed no harm to personal computers or Internet surfers.

The Christian Science Monotor thinks the virus may be Israeli in origen, The New York Times reported Thursday that Stuxnet contains a file named "Myrtus," which may reveal the virus's origin in a Da Vinci Code-esque fashion. The "Robert Langdon" on the case is a German computer security expert named Ralph Langner.

Although myrtus has several possible meanings – including being Latin for the plant myrtle – Mr. Langner noted that it may be an allusion to the Hebrew word for Esther. He pointed out that the Book of Esther features a plot by Persia against the Jews, who preemptively attacked in response.

Another clue toward the maker could be in the number "19790509," which appears in Stuxnet's code. It could be a reference to the 1979 execution of a prominent Jewish Iranian businessman, according to a research paper presented by researchers Thursday at the Virus Bulletin conference, Computerworld reported.

A column in today's Jerusalem Post praises Stuxnet as "a great achievement" if it is indeed an Israeli weapon.The suspicion over Israel also occurred during the Virus Bulletin Conference in Vancouver Canada.

During the conference China has shown more interest over the virus attack. China has stated it has suffered several such attacks recently.

It has been reported that Israel has been financially funding Unit 8200 heavily. Unit 8200 is a military facility where there has been recent research and development efforts in fighting cyber wars.

If the USA produced the worm, the National Security Agency (NSA) would have done the dirty deed. Now that the code is out in the open, Rightaradia would expect some copycat malware to appear.

We are also surprised that a big engineering form like Siemens would use the windows operating system. Linux is far more resistant to malware. 

See See this link for a technical discussion of how this malware works

Subscribe to the Rightardia feed: feeds.feedburner.com/blogspot/IGiu

Netcraft rank: 8363

http://toolbar.netcraft.com/site_report?u rl=http://rightardia.blogspot.com

No comments: