Egypt flipped the Internet Kill Switch – Total Blackout reported

January 27, 2011 1 comment

In an attempt to stifle anti-government protests scheduled to take place nation wide tomorrow (January the 28th), reports and sources are confirming that the Egyptian government used the “Internet kill switch” for the first time in the world. as they ordered the ISPs and Mobile Carriers (Including multinationals like Vodafone) to pull the plug on…hmmm..the INTERNET.

Is this the world premiere of The  Internet kill switch ?

Is this the world premiere of The Internet kill switch ?


Arbor Networks statistics showing the cutoff starting at around 2:30 am

Arbor Networks statistics showing the cutoff starting at around 2:30 am

So right now, more than Eighty Million Egyptians are going through probably the first internet blackout in the 21st century. even RIM’s blackberry users reported that they cant access the BIS browser and the BBM service.

A couple years ago and during similar anti-governemtn protests in 2009 and in 2010, the government of Iran blocked and restricted access to social media websites like twitter and facebook.

But this time the Egyptian government decided to take it a bit further because blocking particular websites and services was proven inadequate and/or useless as the 20 Million Egyptians with permanent ADSL internet access quickly overcame this blockage with proxies and TOR networks.

This is simply an unprecedented stupid decision.

Advertisements

Wikileaks Released a list of Critical Infrastructures world wide – as seen by the DHS

December 6, 2010 Leave a comment

Wikileaks helped me answer a very important question on how countries see the critical infrastructure interdependencies across the globe, Would an attack on a Saudi oil refinery that is contracted to supply the UK for 25 years be accounted as a UK targeted cyber attack and this foreign-based asset should be accounted for as part of the UK critical infrastructures list ?

How an attack on Qatar’s Raslaffan industrial area will be considered “which if destroyed, disrupted or exploited might have an immediate and deleterious effect on the United States.” as per another cablehttp://www.wikileaks.ch/cable/2009/03/09DOHA214.html”

Looking at those international interdependencies from the CIIP point of view is certainly very interesting,

Another Cable Quote ” In addition to a list of critical domestic CI/KR, the NIPP requires compilation and annual update of a comprehensive inventory of CI/KR that are located outside U.S. borders and whose loss could critically impact the public health, economic security, and/or national and homeland security of the United States. DHS in collaboration with State developed the Critical Foreign Dependencies Initiative (CFDI)to identify these critical U.S. foreign dependencies — foreign CI/KR that may affect systems within the U.S. directly or indirectly. State is coordinating with DHS to develop the 2009 inventory, and the action request in Para. 13 represents the initial step in this process. ”

The full list of international Critical infrastructures [Below] include : ( Oil refineries, sea ports , Internet landing points, gas pipelines…etc) , Original Cable (Here)

———————————————————————————————————————

AFRICA Congo (Kinshasa): Cobalt (Mine and Plant) Gabon: Manganese – Battery grade, natural; battery grade, synthetic; chemical grade; ferro; metallurgical grade Guinea: Bauxite (Mine) South Africa: BAE Land System OMC, Benoni, South Africa Brown David Gear Industries LTD, Benoni, South Africa Bushveld Complex (chromite mine) Ferrochromium Manganese – Battery grade, natural; battery grade, synthetic; chemical grade; ferro; metallurgical grade Palladium Mine and Plant Platinum Mines Rhodium EAST ASIA AND THE PACIFIC Australia: Southern Cross undersea cable landing, Brookvale, Australia Southern Cross undersea cable landing, Sydney, Australia Manganese – Battery grade, natural; battery grade, synthetic; chemical grade; ferro; metallurgical grade Nickel Mines Maybe Faulding Mulgrave Victoria, Australia: Manufacturing facility for Midazolam injection. Mayne Pharma (fill/finish), Melbourne, Australia: Sole suppliers of Crotalid Polyvalent Antivenin (CroFab). China: C2C Cable Network undersea cable landing, Chom Hom Kok, Hong Kong C2C Cable Network undersea cable landing Shanghai, China China-US undersea cable landing, Chongming, China China-US undersea cable landing Shantou, China EAC undersea cable landing Tseung Kwan O, Hong Kong FLAG/REACH North Asia Loop undersea cable landing Tong Fuk, Hong Kong Hydroelectric Dam Turbines and Generators Fluorspar (Mine) Germanium Mine Graphite Mine Rare Earth Minerals/Elements Tin Mine and Plant Tungsten – Mine and Plant Polypropylene Filter Material for N-95 Masks Shanghai Port Guangzhou Port Hong Kong Port Ningbo Port Tianjin Port Fiji: Southern Cross undersea cable landing, Suva, Fiji Indonesia: Tin Mine and Plant Straits of Malacca Japan: C2C Cable Network undersea cable landing, Chikura, Japan C2C Cable Network undersea cable landing, Shima, Japan China-US undersea cable, Okinawa, Japan EAC undersea cable landing Ajigaura, Japan EAC undersea cable landing Shima, Japan FLAG/REACH North Asia Loop undersea cable landing Wada, Japan FLAG/REACH North Asia Loop undersea cable landing Wada, Japan Japan-US undersea cable landing, Maruyama, Japan Japan-US undersea cable landing Kitaibaraki, Japan KJCN undersea cable landing Fukuoka, Japan KJCN undersea cable landing Kita-Kyushu, Japan Pacific Crossing-1 (PC-1) undersea cable landing Ajigaura, Japan Pacific Crossing-1 (PC-1) undersea cable landing Shima, Japan Tyco Transpacific undersea cable landing, Toyohashi, Japan Tyco Transpacific undersea cable landing Emi, Japan Hitachi, Hydroelectric Dam Turbines and Generators Port of Chiba Port of Kobe Port of Nagoya Port of Yokohama Iodine Mine Metal Fabrication Machines Titanium Metal (Processed) Biken, Kanonji City, Japan Hitachi Electrical Power Generators and Components Large AC Generators above 40 MVA Malaysia: Straits of Malacca New Zealand: Southern Cross undersea cable landing, Whenuapai, New Zealand Southern Cross undersea cable landing, Takapuna, New Zealand Philippines: C2C Cable Network undersea cable landing, Batangas, Philippines EAC undersea cable landing Cavite, Philippines Republic of Korea: C2C Cable Network undersea cable landing, Pusan, Republic of Korea. EAC undersea cable landing Shindu-Ri, Republic of Korea FLAG/REACH North Asia Loop undersea cable landing Pusan, Republic of Korea KJCN undersea cable landing Pusan, Republic of Korea Hitachi Large Electric Power Transformers 230 – 500 kV Busan Port Singapore: C2C Cable Network undersea cable landing, Changi, Singapore EAC undersea cable landing Changi North, Singapore Port of Singapore Straits of Malacca Taiwan: C2C Cable Network undersea cable landing, Fangshan, Taiwan C2C Cable Network undersea cable landing, Tanshui, Taiwan China-US undersea cable landing Fangshan, Taiwan EAC undersea cable landing Pa Li, Taiwan FLAG/REACH North Asia Loop undersea cable landing Toucheng, Taiwan Kaohsiung Port EUROPE AND EURASIA Europe (Unspecified): Metal Fabrication Machines: Small number of Turkish companies (Durma, Baykal, Ermaksan) Austria: Baxter AG, Vienna, Austria: Immune Globulin Intravenous (IGIV) Octapharma Pharmazeutika, Vienna, Austria: Immune Globulin Intravenous (IGIV) Azerbaijan: Sangachal Terminal Baku-Tbilisi-Ceyhan Pipeline Belarus: Druzhba Oil Pipeline Belgium: Germanium Mine Baxter SA, Lessines, Belgium: Immune Globulin Intravenous (IGIV) Glaxo Smith Kline, Rixensart, Belgium: Acellular Pertussis Vaccine Component GlaxoSmithKline Biologicals SA, Wavre, Belgium: Acellular Pertussis Vaccine Component Port of Antwerp Denmark: TAT-14 undersea cable landing, Blaabjerg, Denmark Bavarian Nordic (BN), Hejreskovvej, Kvistgard, Denmark: SMALLPOX Vaccine Novo Nordisk Pharmaceuticals, Inc. Bagsvaerd, Denmark: Numerous formulations of insulin Novo Nordisk Insulin Manufacturer: Global insulin supplies Statens Serum Institut, Copenhagen, Denmark: DTaP (including D and T components) pediatric version France: APOLLO undersea cable, Lannion, France FA-1 undersea cable, Plerin, France TAT-14 undersea cable landing St. Valery, France Sanofi-Aventis Insulin Manufacturer: Global insulin supplies Foot and Mouth Disease Vaccine finishing Alstrom, Hydroelectric Dam Turbines and Generators Alstrom Electrical Power Generators and Components EMD Pharms Semoy, France: Cyanokit Injection GlaxoSmithKline, Inc. Evreux, France: Influenza neurominidase inhibitor RELENZA (Zanamivir) Diagast, Cedex, France: Olympus (impacts blood typing ability) Genzyme Polyclonals SAS (bulk), Lyon, France: Thymoglobulin Sanofi Pasteur SA, Lyon, France: Rabies virus vaccine Georgia: Baku-Tbilisi-Ceyhan Pipeline Germany: TAT-14 undersea cable landing, Nodren, Germany. Atlantic Crossing-1 (AC-1) undersea cable landing Sylt, Germany BASF Ludwigshafen: World’s largest integrated chemical complex Siemens Erlangen: Essentially irreplaceable production of key chemicals Siemens, GE, Hydroelectric Dam Turbines and Generators Draeger Safety AG & Co., Luebeck, Germany: Critical to gas detection capability Junghans Fienwerktechnik Schramberg, Germany: Critical to the production of mortars TDW-Gasellschaft Wirksysteme, Schroebenhausen, Germany: Critical to the production of the Patriot Advanced Capability Lethality Enhancement Assembly Siemens, Large Electric Power Transformers 230 – 500 kV Siemens, GE Electrical Power Generators and Components Druzhba Oil Pipeline Sanofi Aventis Frankfurt am Main, Germany: Lantus Injection (insulin) Heyl Chemish-pharmazeutische Fabrik GmbH: Radiogardase (Prussian blue) Hameln Pharmaceuticals, Hameln, Germany: Pentetate Calcium Trisodium (Ca DTPA) and Pentetate Zinc Trisodium (Zn DTPA) for contamination with plutonium, americium, and curium IDT Biologika GmbH, Dessau Rossiau, Germany: BN Small Pox Vaccine. Biotest AG, Dreiech, Germany: Supplier for TANGO (impacts automated blood typing ability) CSL Behring GmbH, Marburg, Germany: Antihemophilic factor/von Willebrand factor Novartis Vaccines and Diagnostics GmbH, Marburg, Germany: Rabies virus vaccine Vetter Pharma Fertigung GmbH & Co KG, Ravensburg, Germany (filling): Rho(D) IGIV Port of Hamburg Ireland: Hibernia Atlantic undersea cable landing, Dublin Ireland Genzyme Ireland Ltd. (filling), Waterford, Ireland: Thymoglobulin Italy: Glaxo Smith Kline SpA (fill/finish), Parma, Italy: Digibind (used to treat snake bites) Trans-Med gas pipeline Netherlands: Atlantic Crossing-1 (AC-1) undersea cable landing Beverwijk, Netherlands TAT-14 undersea cable landing, Katwijk, Netherlands Rotterdam Port Norway: Cobalt Nickel Mine Poland: Druzhba Oil Pipeline Russia: Novorossiysk Export Terminal Primorsk Export Terminal. Nadym Gas Pipeline Junction: The most critical gas facility in the world Uranium Nickel Mine: Used in certain types of stainless steel and superalloys Palladium Mine and Plant Rhodium Spain: Strait of Gibraltar Instituto Grifols, SA, Barcelona, Spain: Immune Globulin Intravenous (IGIV) Maghreb-Europe (GME) gas pipeline, Algeria Sweden: Recip AB Sweden: Thyrosafe (potassium iodine) Switzerland: Hoffman-LaRoche, Inc. Basel, Switzerland: Tamiflu (oseltamivir) Berna Biotech, Berne, Switzerland: Typhoid vaccine CSL Behring AG, Berne, Switzerland: Immune Globulin Intravenous (IGIV) Turkey: Metal Fabrication Machines: Small number of Turkish companies (Durma, Baykal, Ermaksan) Bosporus Strait Baku-Tbilisi-Ceyhan Pipeline Ukraine: Manganese – Battery grade, natural; battery grade, synthetic; chemical grade; ferro; metallurgical grade United Kingdom: Goonhilly Teleport, Goonhilly Downs, United Kingdom Madley Teleport, Stone Street, Madley, United Kingdom Martelsham Teleport, Ipswich, United Kingdom APOLLO undersea cable landing Bude, Cornwall Station, United Kingdom Atlantic Crossing-1 (AC-1) undersea cable landing Whitesands Bay FA-1 undersea cable landing Skewjack, Cornwall Station Hibernia Atlantic undersea cable landing, Southport, United Kingdom TAT-14 undersea cable landing Bude, Cornwall Station, United Kingdom Tyco Transatlantic undersea cable landing, Highbridge, United Kingdom Tyco Transatlantic undersea cable landing, Pottington, United Kingdom. Yellow/Atlantic Crossing-2 (AC-2) undersea cable landing Bude, United Kingdom Foot and Mouth Disease Vaccine finishing BAE Systems (Operations) Ltd., Presont, Lancashire, United Kingdom: Critical to the F-35 Joint Strike Fighter BAE Systems Operations Ltd., Southway, Plymouth Devon, United Kingdom: Critical to extended range guided munitions BAE Systems RO Defense, Chorley, United Kingdom: Critical to the Joint Standoff Weapon (JSOW) AGM-154C (Unitary Variant) MacTaggart Scott, Loanhead, Edinburgh, Lothian, Scotland, United Kingdom: Critical to the Ship Submersible Nuclear (SSN) NEAR/MIDDLE EAST Djibouti: Bab al-Mendeb: Shipping lane is a critical supply chain node Egypt: ‘Ayn Sukhnah-SuMEd Receiving Import Terminal ‘Sidi Kurayr-SuMed Offloading Export Terminal Suez Canal Iran: Strait of Hormuz Khark (Kharg) Island Sea Island Export Terminal Khark Island T-Jetty Iraq: Al-Basrah Oil Terminal Israel: Rafael Ordnance Systems Division, Haifa, Israel: Critical to Sensor Fused Weapons (SFW), Wind Corrected Munitions Dispensers (WCMD), Tail Kits, and batteries Kuwait: Mina’ al Ahmadi Export Terminal Morocco: Strait of Gibraltar Maghreb-Europe (GME) gas pipeline, Morocco Oman: Strait of Hormuz Qatar: Ras Laffan Industrial Center: By 2012 Qatar will be the largest source of imported LNG to U.S. Saudi Arabia: Abqaiq Processing Center: Largest crude oil processing and stabilization plant in the world Al Ju’aymah Export Terminal: Part of the Ras Tanura complex As Saffaniyah Processing Center Qatif Pipeline Junction Ras at Tanaqib Processing Center Ras Tanura Export Terminal Shaybah Central Gas-oil Separation Plant Tunisia: Trans-Med Gas Pipeline United Arab Emirates (UAE): Das Island Export Terminal Jabal Zannah Export Terminal Strait of Hormuz Yemen: Bab al-Mendeb: Shipping lane is a critical supply chain node SOUTH AND CENTRAL ASIA Kazakhstan: Ferrochromium Khromtau Complex, Kempersai, (Chromite Mine) India: Orissa (chromite mines) and Karnataka (chromite mines) Generamedix Gujurat, India: Chemotherapy agents, including florouracil and methotrexate WESTERN HEMISPHERE Argentina: Foot and Mouth Disease Vaccine finishing Bermuda: GlobeNet (formerly Bermuda US-1 (BUS-1) undersea cable landing Devonshire, Bermuda Brazil: Americas-II undersea cable landing Fortaleza, Brazil GlobeNet undersea cable landing Fortaleza, Brazil GlobeNet undersea cable landing Rio de Janeiro, Brazil Iron Ore from Rio Tinto Mine Manganese – Battery grade, natural; battery grade, synthetic; chemical grade; ferro; metallurgical grade Niobium (Columbium), Araxa, Minas Gerais State (mine) Ouvidor and Catalao I, Goias State: Niobium Chile: Iodine Mine Canada: Hibernia Atlantic undersea cable landing Halifax , Nova Scotia, Canada James Bay Power Project, Quebec: monumental hydroelectric power development Mica Dam, British Columbia: Failure would impact the Columbia River Basin. Hydro Quebec, Quebec: Critical irreplaceable source of power to portions of Northeast U. S. Robert Moses/Robert H. Saunders Power, Ontario: Part of the St. Lawrence Power Project, between Barnhart Island, New York, and Cornwall, Ontario Seven Mile Dam, British Columbia: Concrete gravity dam between two other hydropower dams along the Pend d’Oreille River Pickering Nuclear Power Plant, Ontario, Canada Chalk River Nuclear Facility, Ontario: Largest supplier of medical radioisotopes in the world Hydrofluoric Acid Production Facility, Allied Signal, Amherstburg, Ontario Enbridge Pipeline Alliance Pipeline: Natural gas transmission from Canada Maritime and Northeast Pipeline: Natural gas transmission from Canada Transcanada Gas: Natural gas transmission from Canada Alexandria Bay POE, Ontario: Northern border crossing Ambassador Bridge POE, Ontario: Northern border crossing Blaine POE, British Columbia: Northern border crossing Blaine Washington Rail Crossing, British Columbia Blue Water Bridge POE, Ontario: Northern border crossing Champlain POE, Quebec: Northern border crossing CPR Tunnel Rail Crossing, Ontario (Michigan Central Rail Crossing) International Bridge Rail Crossing, Ontario International Railway Bridge Rail Crossing Lewiston-Queenstown POE, Ontario: Northern border crossing Peace Bridge POE, Ontario: Northern border crossing Pembina POE, Manitoba: Northern border crossing North Portal Rail Crossing, Saskatchewan St. Claire Tunnel Rail Crossing, Ontario Waneta Dam, British Columbia: Earthfill/concrete hydropower dam Darlington Nuclear Power Plant, Ontario, Canada. E-ONE Moli Energy, Maple Ridge, Canada: Critical to production of various military application electronics General Dynamics Land Systems – Canada, London Ontario, Canada: Critical to the production of the Stryker/USMC LAV Vehicle Integration Raytheon Systems Canada Ltd. ELCAN Optical Technologies Division, Midland, Ontario, Canada: Critical to the production of the AGM-130 Missile Thales Optronique Canada, Inc., Montreal, Quebec: Critical optical systems for ground combat vehicles Germanium Mine Graphite Mine Iron Ore Mine Nickel Mine Niobec Mine, Quebec, Canada: Niobium Cangene, Winnipeg, Manitoba: Plasma Sanofi Pasteur Ltd., Toronto, Canada: Polio virus vaccine GlaxoSmithKile Biologicals, North America, Quebec, Canada: Pre-pandemic influenza vaccines French Guiana: Americas-II undersea cable landing Cayenne, French Guiana Martinique: Americas-II undersea cable landing Le Lamentin, Martinique Mexico: FLAG/REACH North Asia Loop undersea cable landing Tijuana, Mexico Pan-American Crossing (PAC) undersea cable landing Mazatlan, Mexico Amistad International Dam: On the Rio Grande near Del Rio, Texas and Ciudad Acuna, Coahuila, Mexico Anzalduas Dam: Diversion dam south of Mission, Texas, operated jointly by the U.S. and Mexico for flood control Falcon International Dam: Upstream of Roma, Texas and Miguel Aleman, Tamaulipas, Mexico Retamal Dam: Diversion dam south of Weslaco, Texas, operated jointly by the U.S. and Mexico for flood control GE Hydroelectric Dam Turbines and Generators: Main source for a large portion of larger components Bridge of the Americas: Southern border crossing Brownsville POE: Southern border crossing Calexico East POE: Southern border crossing Columbia Solidarity Bridge: Southern border crossing Kansas City Southern de Mexico (KCSM) Rail Line, (Mexico) Nogales POE: Southern border crossing Laredo Rail Crossing Eagle Pass Rail Crossing Otay Mesa Crossing: Southern border crossing Pharr International Bridge: Southern border crossing World Trade Bridge: Southern border crossing Ysleta Zaragosa Bridge: Southern border crossing Hydrofluoric Acid Production Facility Graphite Mine GE Electrical Power Generators and Components General Electric, Large Electric Power Transformers 230 – 500 kV Netherlands Antilles: Americas-II undersea cable landing Willemstad, Netherlands Antilles. Panama: FLAG/REACH North Asia Loop undersea cable landing Fort Amador, Panama Panama Canal Peru: Tin Mine and Plant Trinidad and Tobago: Americas-II undersea cable landing Port of Spain Atlantic LNG: Provides 70% of U.S. natural gas import needs Venezuela: Americas-II undersea cable landing Camuri, Venezuela GlobeNet undersea cable landing, Punta Gorda, Venezuela GlobeNet undersea cable landing Catia La Mar, Venezuela GlobeNet undersea cable landing Manonga, Venezuela [END TEXT OF LIST]

Stuxnet: and The Truth Shall Set You Free

November 13, 2010 Leave a comment

A recent post on Symantec’s security Blog revealed a very crucial piece of information about Stuxnet, The information should definitely stop who ever is denying the fact that Stuxnet is a state sponsored “sabotage-ware” targeting a very special someone.

Symantec with the help of a Dutch Profibus expert can now prove that Stuxnet is looking for two specific Frequency converter drives one made by (Fararo Paya) of Iran and the other is (Vacon) of Finland.

stuxnet_target

stuxnet_target

Quote from Symantec’s blog: “Since our discovery that Stuxnet actually modifies code on PLCs in a potential act of sabotage, we have been unable to determine what the exact purpose of Stuxnet is and what its target was.”

“However, we can now confirm that Stuxnet requires the industrial control system to have frequency converter drives from at least one of two specific vendors, one headquartered in Finland and the other in Tehran, Iran. This is in addition to the previous requirements we discussed of a S7-300 CPU and a CP-342-5 Profibus communications module.”

and then they add: “Stuxnet monitors the current operating frequency of these motors, which must be between 807 Hz and 1210 Hz, before Stuxnet modifies their behavior. Relative to the typical uses of frequency converter drives, these frequencies are considered very high-speed and now limit the potential speculated targets of Stuxnet. We are not experts in industrial control systems and do not know all the possible applications at these speeds, but for example, a conveyor belt in a retail packaging facility is unlikely to be the target. Also, efficient low-harmonic frequency converter drives that output over 600Hz are regulated for export in the United States by the Nuclear Regulatory Commission as they can be used for uranium enrichment. We would be interested in hearing what other applications use frequency converter drives at these frequencies.”

So FACTs so far are the following:

– We are now able to describe the purpose of all of Stuxnet’s code.

– Stuxnet requires particular frequency converter drives from specific vendors, some of which may not be procurable in certain countries. ( In other words countries under international sanctions ).

– Stuxnet requires the frequency converter drives to be operating at very high speeds, between 807 Hz and 1210 Hz. (According to the US nuclear Commission – more than 600 Hz can be used in Uranium enrichment)

-While frequency converter drives are used in many industrial control applications, these speeds are used only in a limited number of applications. (Nuclear Applications is one of them).

-Stuxnet changes the output frequencies and thus the speed of the motors for short intervals over periods of months. Interfering with the speed of the motors sabotages the normal operation of the industrial control process. (Sabotage is the purpose)

– Stuxnet’s requirement for particular frequency converter drives and operating characteristics focuses the number of possible speculated targets to a limited set of possibilities. (The Special Someone Speaks Iranian)

The original Symantec Blog post HERE

Siemens Official Communication Slides on Stuxnet – Pulled Offline

November 7, 2010 1 comment

CERT Finland took offline the original set of slides , But here is a copy

The_Stuxnet_Malware – Siemens Slides

© Siemens AG 2010. All Rights Reserved.

Siemens Official Slides on Stuxnet

November 4, 2010 1 comment

A couple of days ago Siemens Internal CERT released some slides about Stuxnet as a form of “Official Communication” within their constituents.

Siemens Stuxnet Slides

Siemens Stuxnet Slides

In the official slides (Here) , Siemens confirmed that its a targeted attack by using terms like “targeting a very specific configuration, certain PLC blocks and specific processes or (project)“. These bold statements simply means that Stuxnet makers had (one target) in mind, and this should eliminate any theory out there denying that its a state sponsored malware.

The slides confirmed that the malware is capable of transferring data outside of the infected system back to the command and control servers, yet nothing has been proven specially that the two C&C servers ( • www[.]mypremierfutbol[.]com • www[.]todaysfutbol[.]com ) were brought down by Symantec.

Then the slides claim that all known infections are now clean and zero plant damages reported. yet they didn’t specify their definition of “damage”, is it seeing the plant up in flames or few bytes of data going out ?

The slides go on listing the great deeds of siemens since the discovery of the malware : “white papers, cleaning tools, contacting customers, working with top AV vendors, even magazine interviews”. isn’t this what they are paid to do ?

What really got on my nerves was their genius conclusion that future infections are “Unlikely” , and that is because the malware pattern is now detected by up to date Anti Virus programs. Eureka !!

Yes, future “Stuxnet” infections might be unlikely, but this is certainly not the end of this type of attacks as long as top vendors like Siemens still use “Hard coded & publicly available” passwords on critical systems in the year 2010 and dont even admit that this is the REAL problem.

Another statement that also reflects severe undermining of the terms “due diligence, and responsibility ” is a question they highlighted in yellow : “Has the customer done all he can ? “.

Imagine a car manufacturing company that sold you a very expensive car, supposedly equipped with a seatbelt, then you run into an invisible wall that someone deliberately put in front of you and built it in a very special way, using specific materials that takes advantage of known and published weaknesses in your seatbelt buckle lock design. Imagine yourself sitting in the hospital wondering how on earth you gonna fix this messed-up face of yours, then the car makers dudes comes up and tell you that its partially your fault for not trying to do all you can, perhaps you could have tried holding the buckle with your teeth !

Interesting Post about Stuxnet

November 1, 2010 1 comment

An Interesting post, found on a Stuxnet discussion thread – Tweeted by mikkohypponen

Stuxnet Post

Stuxnet Post

Symantec Releases a Comprehensive Report about Stuxnet

October 5, 2010 Leave a comment

Symantec released one of the most comprehensive “publicly available” reports about Stuxnet. The paper was first released in the recently concluded conference Virus Bulletin 2010.

Stuxnet Infection Stats - Symantec corporation 2010

Stuxnet Infection Stats - Symantec corporation 2010

Quoting Symantec’s blog ” We’re pleased to announce that we’ve compiled the results of many weeks of fast-paced analysis of Stuxnet into a white paper entitled the W32.Stuxnet Dossier. On top of finding elements we described in the ongoing Stuxnet summer blog series, you will find all technical details about the threat’s components and data structures, as well as high level information, including:

Attack scenario and timeline
Infection statistics
Malware architecture
Description of all the exported routines
Injection techniques and anti-AV
The RPC component
Propagation methods
Command and control feature
The PLC infector

The full report can be downloaded HERE

My Comments:

According to the report from Symantec, the infected hosts have reached nearly 100,000. which is about right.
It’s very alarming that such a high number of infections can/did take place on “supposedly” some of the world’s most mature and security oriented organizations, due to their critical nature of business. Apparently this “false security” is not limited to Iran only but to 155 countries !!!.

If we can get away from Stuxnet with just one lesson it’s the fact that direct and specially crafted attacks against critical infrastructures are real.

The damage that those few lines of code can incur in the real world is like nothing we have seen in the history of computers. A typical worm can steal your credit card information or your personal email password. But worms like Stuxnet can put critical infrastructures like a nuclear facility for instance under a threat that can deprive wide areas of land from any form of life for hundreds of years.

This worm should challenge and question our misconception that malicious programs can at best cause serious financial loss or personal information leakage, but never a human life.