History of the Stuxnet Worm - Research Paper Example

? 2 October Research Paper: The Stuxnet Worm History of the Stuxnet Worm A security company named VirusBlokAda first identified the Stuxnet worm around the mid of June in 2010. The first report about the Stuxnet worm that was widely spread and read was the blog posting by the Journalist Brian Krebs that he made on 15 July 2010. The worm derives its name from the keywords found in the software. The virus was discovered when a programming error made during the update spread the worm accidentally beyond the Natanz plant which was its original target. As a result of this accident, the worm spread to the computer of an engineer which got hooked up to the centrifuges. As the engineer hooked the computer to the Internet, the worm spread far and wide. How the Stuxnet Worm Spread The Stuxnet worm started to spread in March 2010, but it took its first variant about three months from then to appear. As people learnt about the existence of the worm on 15 July 2010, the servers for two mailing lists were attacked with the distributed denial-of-service on the industrial-systems security. Although at that time, the source of attack could not be worked out, yet it was suspected to be the Stuxnet worm. As a result of the attack, one of the two mailing lists got disabled, thus interrupting a very important informative source for the factories and the power plants. Two more variants of the Stuxnet worm surfaced; the first in March 2010 and the second in April 2010. In the authors’ opinion, the second and substantially improved variant showed up because of slow progression of the Stuxnet worm. The third variant that surfaced in April 2010 had only minor improvements. There is a build time-stamp in thee worm that starts from 3 February 2010. According to the report delivered by the Sky News on 25 November 2010 in the United Kingdom, an anonymous source whose IT security organization was also unidentified sent the news to Sky News that the black market had received a variation of the Stuxnet worm, but there was lack of consensus among the security experts over this matter. How the Stuxnet Worm Works Stuxnet makes use of vulnerability just like Windows uses the shortcut files to expand to new systems. The Stuxnet worm’s design was bottom-up so that it could effectively attack the systems implemented for the management of industrial networks like chemical manufacturing facilities and power plants as well as the systems of Supervisory Control and Data Acquisition (SCADA). In the start, the Stuxnet worm was thought to progress through such removable drives as USB sticks. However, about two weeks after the Stuxnet worm was first identified, researchers of the Kaspersky Lab working in Moscow found that an unknown security flaw in the sharing of printer resources by the Windows could also help the Stuxnet worm spread. Microsoft found a way to fix this vulnerability with MS10-061 which varies in risk from one type of windows to another. “At least one aspect of what Stuxnet does is to take control of the process and to be able to do…whatever the author or programmer wants it to do. This has potentially devastating consequences, and there needs to be a lot more attention focused on it” (Weiss cited in “‘Stuxnet’ Worm Far”). The Target of the Stuxnet Worm The main target of the Stuxnet worm is the Siemens software. One trait that distinguishes the Stuxnet worm from most viruses that have been identified to date is that it remains silent till the time the worm locates Siemens software in the Windows system. Once the Siemens software is found, the Stuxnet worm exploits up to four 0-day attacks. The Stuxnet worm infected the SCADA systems in 14 functional plants of Siemens, though the infections could not hold the infected plants’ productions. According to the IDG News reports, the Stuxnet worm has infected systems at the Siemens plants in North America, Korea, and the UK, while the maximum infections have so far been made in the plants operating in Iran (Lucarelli). The Stuxnet worm attacks specific systems only and has safeguards that ensure that the worm does not spread to more than three computers from the infected computer. The worm has been configured in such a way that it removes itself on 24 June 2012. An analyst at the Kaspersky Lab reported that the writer of the Stuxnet worm knows the way to configure the SCADA systems. In addition to targeting the SCADA systems of Siemens, the Stuxnet worm also produced the legitimate digital signatures of the industrial giants JMicron and Realtek Semiconductor Corp. on two critical files. The Windows vulnerability patched by Microsoft in the year 2008 was leveraged by the Stuxnet worm. According to a senior anti-virus researcher working at the Kaspersky Lab, Roel Schouwenberg, the purpose behind including the antiquated vulnerability by the designers of the Stuxnet worm was not clear. He said, “If you look at the way they must have organized the entire attack, it’s very impressive. These guys are absolutely top of the line in terms of sophistication” (Schouwenberg cited in “‘Stuxnet’ Worm Far”). The Impact of the Stuxnet Worm The managing partner Joe Weiss serving at the Cupertino, which is California based Applied Control Systems shared that a lot of people have been fixated on the impact of the Stuxnet worm upon the systems of Microsoft Windows, and are unaware of the use of the Stuxnet worm by its authors as a way to end. Controlling the Stuxnet worm is very intricate because not much is known about the credibility of the controllers themselves. The Department of Homeland Security faced numerous challenges in its attempt to achieve control over the Stuxnet worm and the responsible organization causing it. Weiss expressed this concern in these words: “The Department of Homeland Security put out an advisory on Stuxnet on September 2nd, and the only two things it didn’t say anything about is how to find it or get rid of it at the PLC level. People are focusing on what they know and understand, which are the standard Microsoft vulnerabilities. But that’s not the scary part. The really scary thing is that right now we don’t even know which controllers are trusted and which ones aren’t trusted” (Weiss cited in Gobbetti). The Origin of the Stuxnet Worm There are different views about the origin of the Stuxnet worm, and no objective evidence against a particular organization, country, or individual has been obtained so far. According to the journalist David Sanger, governments of Israel and the USA both share the responsibility of developing and deploying the Stuxnet worm (Anderson). “Stuxnet may have averted a nuclear conflagration by diminishing Israel’s perception of a need for an imminent attack on Iran” (Rosenbaum). The International Ramifications of the Stuxnet Worm The Stuxnet worm seems to be released by a nation targeting the infrastructure or research in other nations, particularly Iran and Indonesia. It can be seen from Fig. 1, that the Stuxnet worm attempts made in Iran and Indonesia far outweigh those made in other countries across the globe. Since both Iran and Indonesia are Muslim countries, it essentially seems like a way to hinder the research and development in the Muslim countries. Fig. 1: “Geographic saturation of Stuxnet infection attempts” (Saade). The political implications of the release of the Stuxnet Worm by an organization or an individual belonging to a particular country would be immense. It would be identified as a terrorist attack and there would have been immense pressure on the country to locate the responsible organization or individual and make them pay for the loss they have caused and have attempted to cause. Works Cited: Anderson, Nate. “Confirmed: US and Israel created Stuxnet, lost control of it.” 1 June 2012. Web. 3 Oct. 2012. . Gobbetti, Daniele. “‘Stuxnet’ Worm Far More Sophisticated Than Previously Thought – Krebs on Security.” 15 Sep. 2010. Web. 2 Oct. 2012. . Lucarelli, Fosco. “Stuxnet: Anatomy of the first weapon made entirely out of code.” 17 July 2012. Web. 2 Oct. 2012. . Rosenbaum, Ron. “Richard Clarke on Who Was Behind the Stuxnet Attack.” Smithsonian Magazine. April 2012. Web. 3 Oct. 2012. . Saade, Tareq. “The Stuxnet Sting.” 16 July 2010. Web. 3 Oct. 2012. . “’Stuxnet’ Worm Far More Sophisticated Than Previously Thought.” Krebs on Security. 2012. Web. 2 Oct. 2012. . Read More