Analyst's note: A searching with this site on the term "stuxnet" and "SCADA" will help to put this in perspective for you. If you operate a personal computer with a Microsoft operating system or operate supervisory control and data acquisition (SCADA) software used to run chemical plants and factories as well as electric power plants and transmission systems worldwide. or use anything resulting from or impacted by these systems just described, then this article is for you.
'The reality is that these SCADA systems were never designed for cybersecurity in mind and today they are being openly connected to the outside world even though many vendors are advising against this level of connectivity,'
This story is about a "military-grade, cyber missile" known to be created by at least 30 different people and aimed at destroying an industrial process. This malware first surfaced in June 2010, reported in July 2010 and has been investigated ever since. It goes by the name of Stuxnet and has infected at least 45,000 industrial control systems around the world. Although it includes computers in the United States, Germany and Canada, most computers are said to be in Iran, Pakistan, India, and Indonesia.
It is tough trying to describe something that was once thought to be impossible -- something that has at least 5,000 functions (only one is presently understood) and multiple investigating organizations have no idea what it is after. The ultimate suspected target is Iran's Bushehr nuclear power plant.
Yeeee Haaaaaa!!! This malware needs no human intervention other than to insert an infected USB drive. It apparently uses "fingerprinting" as a part of the assured targeting process which is intended to destroy rather than to manipulate data or steal it. If your system doesn't fit the fingerprint it is looking for, then Stuxnet leaves you alone. Otherwise some vital system is overridden or shut down and something physically really bad happens within the industrial process -- say a nuclear power plant -- to physically destroy it.
Once infected, it polls every five seconds and destroys only if specific parameters or "fingerprints" are met. Investigators have reason to believe that Stuxnet (with at least one known variant) was likely spread by a thumb drive used by a Russian contractor while building the Bushehr nuclear plant.
I especially liked the premise of a recent Washington Post article, On Red Alert and Perilously Uniformed by David Ignatius. This stunning new situation we are addressing here regarding Stuxnet should cause the U.S. to step up efforts to define cyberwarfare and its impact on the laws of war as well as to protect the supply chains of our critical industries. We might even find the nerve to face the hideous enemy that is the jihadist. They will eventually learn to use such a weapon as Stuxnet and we'd best be prepared sooner than later.
"The Stuxnet worm, the first worm that was able to exploit a Microsoft Windows vulnerability to break into power grid control systems, is one sophisticated beast. It looks like it had over 30 people build it, according to a talk given by a Symantec executive at a cybersecurity conference, which The Atlantic’s Alexis Madrigal attended and wrote this piece about.
This new information is particularly disturbing given that the frequency and sophistication of cyber attacks on the power grid are just beginning. As this was the first time the Microsoft vulnerability was exposed and used to attack SCADA systems, you can guess there will be many copycats that will follow suit.
[....] As the security researchers at McAfee pointed out, the worm was able to target Siemens because it had hardcoded passwords (put the passwords in the source code of the software) to connect the SCADA system to the corresponding database. Siemens said that made the system more reliable, but that’s a big no-no in the Internet security world.
