Stuxnet: The best of the worst

The Stuxnet worm is a recently found worm that has been labeled as "groundbreaking" by many antivirus professionals. This malware targets Windows machines that contain "supervisory control and data acquisition software" (SCADA). SCADA software is used to manage large, industrial systems of varyings sorts. Traced back as far as June of 2009, Stuxnet was a very sophisticated, precise, and impressive malware program. When the worm was first recognized, a patch was developed for the "zero-day" vulnerability that was found. A "zero-day" threats are simply malware code that exploits unpatched holes in software that software companies are not aware of. In the past month and a half the Stuxnet has been rediscovered and antivisus companies have found THREE more zero-day threats. This is unprecedented and is a first in the history of malware.

Using a USB to deliver the worm, Stuxnet contained a print spooler bug, two elevation of privilege (EoP) bugs, and a bug that exposed the same vulnerability as the familiar Conflicker worm (attacking the computer's usernames and passwords). In conjunction with all of these bugs, "the attack code seemed legitimate because the people behind Stuxnet had stolen at least two signed digital certificates." It is also believed that the code was so specific that the programmers would have needed the same hardware as the SCADA machines that they were targeting, and they also must have had knowledge about the specifics of the operations of the factory floor. The hackers also took efforts to minimize the risk of their discovery by creating counters so that the different infected USBs could not spread to more than three machines. This also ensured that the bug only spread to the necessary target machines.

The resources and financial backing that must have been necessary to support this attack indicate that this was too large scale to be a private attack. Similarly, there was no intention of stealing information, which also implies that this was not a private attack from some sort of competitor. The attack was targeted at Iran with the intention of controlling the machinery against the real operator's control. It appears to be above simple "industrial espionage."

The cause was a security breach via USB that compromised the authority to control the SCADA program on the targeted machines. In order to recovery and respond from this attack, I would recommended getting the patch updates that the antivirus companies produced for all four of the zer0-day attacks. Furthermore, if it is feasible, I would consider some stricter security software with more authentication processes. This particular case could have been avoided also if there was also a stricter policy regarding the use of the USB drive. In the future, it is important for these companies, and all companies, to be very aware of the potential for malware attacks. Although this high-tech and very intelligent attack is difficult to detect, it is always good to consistently update antivirus software and regularly test your major computer software.

http://www.computerworld.com/s/article/9185919/Is_Stuxnet_the_best_malware_ever_?taxonomyId=17&pageNumber=1