Archive

Posts Tagged ‘CIIP’

SCADA Security Evaporates in Texas

November 22, 2011 Leave a comment

A hacker, going with the name “pr0f” has been all over the news for showing that he was able to access a SCADA system used in Texas. only to vent his anger on how the DHS underplayed a recent attack that destroyed a pump at a water facility in Illinois.

Comment: Looking into the images, in addition to South Huston Texas,they also feature screen shots labelled as (City of South Huston Nevada and Virginia)

In one of his interviews, “pr0f” said that he was able to access the systems via “two” different methods. First through a VNC connection that was accessible from the internet !!!, which helped him take the screen shots below, in addition to the ability to access the web administration portal which is still accessible till this morning !!.

Screen shots:

Texas SCADA Hack

Texas SCADA Hack

When asked to comment on the Illinois incident, he said

“I dislike, immensely, how the DHS tend to downplay how absolutely (expletive) the state of national infrastructure is. I’ve also seen various people doubt the possibility an attack like this could be done,”

apparently Using a Romanian email (pr0f_srs@ue.co.ro) to post the screenshots on pastebin , the hacker told Threatpost that he discovered the vulnerable system using a scanner that looks for the online fingerprints of SCADA systems. He said South Houston had an instance of the Siemens Simatic human machine interface (HMI) software that was accessible from the Internet and that was protected with an easy-to-hack, three character password.!!!” No Comment”.

Actually there are a couple of comments:

– He might have used a publicly discussed vulnerability in Siemens allowing attackers to intercept and figure-out passwords, or change the configuration of the PLCs. So my guess is that using a harder password would not have helped much.
— the Siemens Advisory that went out last July (http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&lang=en&objid=51401544&caller=view) tells you to limit physical and logical access to the vulnerable system while they work on a patch ( which is yet still to come).

– WHY….is the system accessible from the internet? is the real question.
— I just can’t get why would someone put his critical business asset even if its an ice cream machine online and accessible from the internet…apparently not hardened ” system fingerprint was searchable” and with lots of Siemens vulnerabilities/goodies up for grabs.

“pr0f” is probably going to face some serious legal troubles for admitting his act, but his adventure makes me wonder…if this is the status of security and awareness in “some” of the critical infrastructures in the united states of america and I’m sure in other “developed” countries.

What would be the status of SCADA security in the “Developing” world ? I am making a study on the CIIP status in the developing world and found that in just one domain/sector which is oil production as of November 2010, the OPEC members “ 12 countries all considered developing countries” collectively hold 79% of the world’s crude oil reserves and 44% of the world’s crude oil production with 100% reliance on SCADA/DCS systems many of which has reported vulnerabilities or even exploits, none of those countries has a national CIIP strategy or follow/adopt an acknowledged SCADA security guideline or best practice or even consider Critical Information Infrastructure Protection a topic worthy of discussion.

Advertisements

DHS: “Anonymous” Sniffing around SCADA systems

October 18, 2011 1 comment

A recently leaked DHS document (Download Here) warns that Hacktivist group “Anonymous” are considering attacking SCADA systems and Critical Infrastructures in some countries.

The document labelled as “for official use only” quotes several “twitter” posts believed to belong to Anonymous members discussing and exchanging information about SCADA projects.

” On 19 July 2011, a known Anonymous member posted to Twitter the results of browsing the directory tree for Siemens SIMATIC software. This is an indication in a shift toward interest in control systems by the hacktivist group.”

another tweet

“An anonymous individual provided an open source posting on twitter of xml and html code that queries the SIMATIC software. The individual alleged access to multiple control systems and referred to “Owning” them.2 The Twitter posting does not identify any systems where privileged levels of access to control systems have been obtained.”

My Comments:

The report insinuates that experienced Anonymous hackers can quickly gain the knowledge required to hack ICS “Industrial Control Systems” which is correct. But the report didn’t mention the fact that currently there is a gold rush amongst researchers to come up with SCADA vulnerabilities, just in the past couple of weeks anyone following the right and publicly available sources can count more than a dozen zero-day vulnerabilities out there (I mean with no patch available).couple that with high motivation and you have a dangerous formula.

Just by looking around, I am afraid to say that ICS are going to be the next target after the current wave of attacks on financial institutions “Occupy wall-street”.

Looking at the flow of events, Anonymous, LulzSec and Co. have already targeted Governments, Big corporates, Defense contractors,Banks and Stock exchanges….the next logical step down the food chain is Energy.

More on the topic:

Washington times
The register

Wikileaks Released a list of Critical Infrastructures world wide – as seen by the DHS

December 6, 2010 Leave a comment

Wikileaks helped me answer a very important question on how countries see the critical infrastructure interdependencies across the globe, Would an attack on a Saudi oil refinery that is contracted to supply the UK for 25 years be accounted as a UK targeted cyber attack and this foreign-based asset should be accounted for as part of the UK critical infrastructures list ?

How an attack on Qatar’s Raslaffan industrial area will be considered “which if destroyed, disrupted or exploited might have an immediate and deleterious effect on the United States.” as per another cablehttp://www.wikileaks.ch/cable/2009/03/09DOHA214.html”

Looking at those international interdependencies from the CIIP point of view is certainly very interesting,

Another Cable Quote ” In addition to a list of critical domestic CI/KR, the NIPP requires compilation and annual update of a comprehensive inventory of CI/KR that are located outside U.S. borders and whose loss could critically impact the public health, economic security, and/or national and homeland security of the United States. DHS in collaboration with State developed the Critical Foreign Dependencies Initiative (CFDI)to identify these critical U.S. foreign dependencies — foreign CI/KR that may affect systems within the U.S. directly or indirectly. State is coordinating with DHS to develop the 2009 inventory, and the action request in Para. 13 represents the initial step in this process. ”

The full list of international Critical infrastructures [Below] include : ( Oil refineries, sea ports , Internet landing points, gas pipelines…etc) , Original Cable (Here)

———————————————————————————————————————

AFRICA Congo (Kinshasa): Cobalt (Mine and Plant) Gabon: Manganese – Battery grade, natural; battery grade, synthetic; chemical grade; ferro; metallurgical grade Guinea: Bauxite (Mine) South Africa: BAE Land System OMC, Benoni, South Africa Brown David Gear Industries LTD, Benoni, South Africa Bushveld Complex (chromite mine) Ferrochromium Manganese – Battery grade, natural; battery grade, synthetic; chemical grade; ferro; metallurgical grade Palladium Mine and Plant Platinum Mines Rhodium EAST ASIA AND THE PACIFIC Australia: Southern Cross undersea cable landing, Brookvale, Australia Southern Cross undersea cable landing, Sydney, Australia Manganese – Battery grade, natural; battery grade, synthetic; chemical grade; ferro; metallurgical grade Nickel Mines Maybe Faulding Mulgrave Victoria, Australia: Manufacturing facility for Midazolam injection. Mayne Pharma (fill/finish), Melbourne, Australia: Sole suppliers of Crotalid Polyvalent Antivenin (CroFab). China: C2C Cable Network undersea cable landing, Chom Hom Kok, Hong Kong C2C Cable Network undersea cable landing Shanghai, China China-US undersea cable landing, Chongming, China China-US undersea cable landing Shantou, China EAC undersea cable landing Tseung Kwan O, Hong Kong FLAG/REACH North Asia Loop undersea cable landing Tong Fuk, Hong Kong Hydroelectric Dam Turbines and Generators Fluorspar (Mine) Germanium Mine Graphite Mine Rare Earth Minerals/Elements Tin Mine and Plant Tungsten – Mine and Plant Polypropylene Filter Material for N-95 Masks Shanghai Port Guangzhou Port Hong Kong Port Ningbo Port Tianjin Port Fiji: Southern Cross undersea cable landing, Suva, Fiji Indonesia: Tin Mine and Plant Straits of Malacca Japan: C2C Cable Network undersea cable landing, Chikura, Japan C2C Cable Network undersea cable landing, Shima, Japan China-US undersea cable, Okinawa, Japan EAC undersea cable landing Ajigaura, Japan EAC undersea cable landing Shima, Japan FLAG/REACH North Asia Loop undersea cable landing Wada, Japan FLAG/REACH North Asia Loop undersea cable landing Wada, Japan Japan-US undersea cable landing, Maruyama, Japan Japan-US undersea cable landing Kitaibaraki, Japan KJCN undersea cable landing Fukuoka, Japan KJCN undersea cable landing Kita-Kyushu, Japan Pacific Crossing-1 (PC-1) undersea cable landing Ajigaura, Japan Pacific Crossing-1 (PC-1) undersea cable landing Shima, Japan Tyco Transpacific undersea cable landing, Toyohashi, Japan Tyco Transpacific undersea cable landing Emi, Japan Hitachi, Hydroelectric Dam Turbines and Generators Port of Chiba Port of Kobe Port of Nagoya Port of Yokohama Iodine Mine Metal Fabrication Machines Titanium Metal (Processed) Biken, Kanonji City, Japan Hitachi Electrical Power Generators and Components Large AC Generators above 40 MVA Malaysia: Straits of Malacca New Zealand: Southern Cross undersea cable landing, Whenuapai, New Zealand Southern Cross undersea cable landing, Takapuna, New Zealand Philippines: C2C Cable Network undersea cable landing, Batangas, Philippines EAC undersea cable landing Cavite, Philippines Republic of Korea: C2C Cable Network undersea cable landing, Pusan, Republic of Korea. EAC undersea cable landing Shindu-Ri, Republic of Korea FLAG/REACH North Asia Loop undersea cable landing Pusan, Republic of Korea KJCN undersea cable landing Pusan, Republic of Korea Hitachi Large Electric Power Transformers 230 – 500 kV Busan Port Singapore: C2C Cable Network undersea cable landing, Changi, Singapore EAC undersea cable landing Changi North, Singapore Port of Singapore Straits of Malacca Taiwan: C2C Cable Network undersea cable landing, Fangshan, Taiwan C2C Cable Network undersea cable landing, Tanshui, Taiwan China-US undersea cable landing Fangshan, Taiwan EAC undersea cable landing Pa Li, Taiwan FLAG/REACH North Asia Loop undersea cable landing Toucheng, Taiwan Kaohsiung Port EUROPE AND EURASIA Europe (Unspecified): Metal Fabrication Machines: Small number of Turkish companies (Durma, Baykal, Ermaksan) Austria: Baxter AG, Vienna, Austria: Immune Globulin Intravenous (IGIV) Octapharma Pharmazeutika, Vienna, Austria: Immune Globulin Intravenous (IGIV) Azerbaijan: Sangachal Terminal Baku-Tbilisi-Ceyhan Pipeline Belarus: Druzhba Oil Pipeline Belgium: Germanium Mine Baxter SA, Lessines, Belgium: Immune Globulin Intravenous (IGIV) Glaxo Smith Kline, Rixensart, Belgium: Acellular Pertussis Vaccine Component GlaxoSmithKline Biologicals SA, Wavre, Belgium: Acellular Pertussis Vaccine Component Port of Antwerp Denmark: TAT-14 undersea cable landing, Blaabjerg, Denmark Bavarian Nordic (BN), Hejreskovvej, Kvistgard, Denmark: SMALLPOX Vaccine Novo Nordisk Pharmaceuticals, Inc. Bagsvaerd, Denmark: Numerous formulations of insulin Novo Nordisk Insulin Manufacturer: Global insulin supplies Statens Serum Institut, Copenhagen, Denmark: DTaP (including D and T components) pediatric version France: APOLLO undersea cable, Lannion, France FA-1 undersea cable, Plerin, France TAT-14 undersea cable landing St. Valery, France Sanofi-Aventis Insulin Manufacturer: Global insulin supplies Foot and Mouth Disease Vaccine finishing Alstrom, Hydroelectric Dam Turbines and Generators Alstrom Electrical Power Generators and Components EMD Pharms Semoy, France: Cyanokit Injection GlaxoSmithKline, Inc. Evreux, France: Influenza neurominidase inhibitor RELENZA (Zanamivir) Diagast, Cedex, France: Olympus (impacts blood typing ability) Genzyme Polyclonals SAS (bulk), Lyon, France: Thymoglobulin Sanofi Pasteur SA, Lyon, France: Rabies virus vaccine Georgia: Baku-Tbilisi-Ceyhan Pipeline Germany: TAT-14 undersea cable landing, Nodren, Germany. Atlantic Crossing-1 (AC-1) undersea cable landing Sylt, Germany BASF Ludwigshafen: World’s largest integrated chemical complex Siemens Erlangen: Essentially irreplaceable production of key chemicals Siemens, GE, Hydroelectric Dam Turbines and Generators Draeger Safety AG & Co., Luebeck, Germany: Critical to gas detection capability Junghans Fienwerktechnik Schramberg, Germany: Critical to the production of mortars TDW-Gasellschaft Wirksysteme, Schroebenhausen, Germany: Critical to the production of the Patriot Advanced Capability Lethality Enhancement Assembly Siemens, Large Electric Power Transformers 230 – 500 kV Siemens, GE Electrical Power Generators and Components Druzhba Oil Pipeline Sanofi Aventis Frankfurt am Main, Germany: Lantus Injection (insulin) Heyl Chemish-pharmazeutische Fabrik GmbH: Radiogardase (Prussian blue) Hameln Pharmaceuticals, Hameln, Germany: Pentetate Calcium Trisodium (Ca DTPA) and Pentetate Zinc Trisodium (Zn DTPA) for contamination with plutonium, americium, and curium IDT Biologika GmbH, Dessau Rossiau, Germany: BN Small Pox Vaccine. Biotest AG, Dreiech, Germany: Supplier for TANGO (impacts automated blood typing ability) CSL Behring GmbH, Marburg, Germany: Antihemophilic factor/von Willebrand factor Novartis Vaccines and Diagnostics GmbH, Marburg, Germany: Rabies virus vaccine Vetter Pharma Fertigung GmbH & Co KG, Ravensburg, Germany (filling): Rho(D) IGIV Port of Hamburg Ireland: Hibernia Atlantic undersea cable landing, Dublin Ireland Genzyme Ireland Ltd. (filling), Waterford, Ireland: Thymoglobulin Italy: Glaxo Smith Kline SpA (fill/finish), Parma, Italy: Digibind (used to treat snake bites) Trans-Med gas pipeline Netherlands: Atlantic Crossing-1 (AC-1) undersea cable landing Beverwijk, Netherlands TAT-14 undersea cable landing, Katwijk, Netherlands Rotterdam Port Norway: Cobalt Nickel Mine Poland: Druzhba Oil Pipeline Russia: Novorossiysk Export Terminal Primorsk Export Terminal. Nadym Gas Pipeline Junction: The most critical gas facility in the world Uranium Nickel Mine: Used in certain types of stainless steel and superalloys Palladium Mine and Plant Rhodium Spain: Strait of Gibraltar Instituto Grifols, SA, Barcelona, Spain: Immune Globulin Intravenous (IGIV) Maghreb-Europe (GME) gas pipeline, Algeria Sweden: Recip AB Sweden: Thyrosafe (potassium iodine) Switzerland: Hoffman-LaRoche, Inc. Basel, Switzerland: Tamiflu (oseltamivir) Berna Biotech, Berne, Switzerland: Typhoid vaccine CSL Behring AG, Berne, Switzerland: Immune Globulin Intravenous (IGIV) Turkey: Metal Fabrication Machines: Small number of Turkish companies (Durma, Baykal, Ermaksan) Bosporus Strait Baku-Tbilisi-Ceyhan Pipeline Ukraine: Manganese – Battery grade, natural; battery grade, synthetic; chemical grade; ferro; metallurgical grade United Kingdom: Goonhilly Teleport, Goonhilly Downs, United Kingdom Madley Teleport, Stone Street, Madley, United Kingdom Martelsham Teleport, Ipswich, United Kingdom APOLLO undersea cable landing Bude, Cornwall Station, United Kingdom Atlantic Crossing-1 (AC-1) undersea cable landing Whitesands Bay FA-1 undersea cable landing Skewjack, Cornwall Station Hibernia Atlantic undersea cable landing, Southport, United Kingdom TAT-14 undersea cable landing Bude, Cornwall Station, United Kingdom Tyco Transatlantic undersea cable landing, Highbridge, United Kingdom Tyco Transatlantic undersea cable landing, Pottington, United Kingdom. Yellow/Atlantic Crossing-2 (AC-2) undersea cable landing Bude, United Kingdom Foot and Mouth Disease Vaccine finishing BAE Systems (Operations) Ltd., Presont, Lancashire, United Kingdom: Critical to the F-35 Joint Strike Fighter BAE Systems Operations Ltd., Southway, Plymouth Devon, United Kingdom: Critical to extended range guided munitions BAE Systems RO Defense, Chorley, United Kingdom: Critical to the Joint Standoff Weapon (JSOW) AGM-154C (Unitary Variant) MacTaggart Scott, Loanhead, Edinburgh, Lothian, Scotland, United Kingdom: Critical to the Ship Submersible Nuclear (SSN) NEAR/MIDDLE EAST Djibouti: Bab al-Mendeb: Shipping lane is a critical supply chain node Egypt: ‘Ayn Sukhnah-SuMEd Receiving Import Terminal ‘Sidi Kurayr-SuMed Offloading Export Terminal Suez Canal Iran: Strait of Hormuz Khark (Kharg) Island Sea Island Export Terminal Khark Island T-Jetty Iraq: Al-Basrah Oil Terminal Israel: Rafael Ordnance Systems Division, Haifa, Israel: Critical to Sensor Fused Weapons (SFW), Wind Corrected Munitions Dispensers (WCMD), Tail Kits, and batteries Kuwait: Mina’ al Ahmadi Export Terminal Morocco: Strait of Gibraltar Maghreb-Europe (GME) gas pipeline, Morocco Oman: Strait of Hormuz Qatar: Ras Laffan Industrial Center: By 2012 Qatar will be the largest source of imported LNG to U.S. Saudi Arabia: Abqaiq Processing Center: Largest crude oil processing and stabilization plant in the world Al Ju’aymah Export Terminal: Part of the Ras Tanura complex As Saffaniyah Processing Center Qatif Pipeline Junction Ras at Tanaqib Processing Center Ras Tanura Export Terminal Shaybah Central Gas-oil Separation Plant Tunisia: Trans-Med Gas Pipeline United Arab Emirates (UAE): Das Island Export Terminal Jabal Zannah Export Terminal Strait of Hormuz Yemen: Bab al-Mendeb: Shipping lane is a critical supply chain node SOUTH AND CENTRAL ASIA Kazakhstan: Ferrochromium Khromtau Complex, Kempersai, (Chromite Mine) India: Orissa (chromite mines) and Karnataka (chromite mines) Generamedix Gujurat, India: Chemotherapy agents, including florouracil and methotrexate WESTERN HEMISPHERE Argentina: Foot and Mouth Disease Vaccine finishing Bermuda: GlobeNet (formerly Bermuda US-1 (BUS-1) undersea cable landing Devonshire, Bermuda Brazil: Americas-II undersea cable landing Fortaleza, Brazil GlobeNet undersea cable landing Fortaleza, Brazil GlobeNet undersea cable landing Rio de Janeiro, Brazil Iron Ore from Rio Tinto Mine Manganese – Battery grade, natural; battery grade, synthetic; chemical grade; ferro; metallurgical grade Niobium (Columbium), Araxa, Minas Gerais State (mine) Ouvidor and Catalao I, Goias State: Niobium Chile: Iodine Mine Canada: Hibernia Atlantic undersea cable landing Halifax , Nova Scotia, Canada James Bay Power Project, Quebec: monumental hydroelectric power development Mica Dam, British Columbia: Failure would impact the Columbia River Basin. Hydro Quebec, Quebec: Critical irreplaceable source of power to portions of Northeast U. S. Robert Moses/Robert H. Saunders Power, Ontario: Part of the St. Lawrence Power Project, between Barnhart Island, New York, and Cornwall, Ontario Seven Mile Dam, British Columbia: Concrete gravity dam between two other hydropower dams along the Pend d’Oreille River Pickering Nuclear Power Plant, Ontario, Canada Chalk River Nuclear Facility, Ontario: Largest supplier of medical radioisotopes in the world Hydrofluoric Acid Production Facility, Allied Signal, Amherstburg, Ontario Enbridge Pipeline Alliance Pipeline: Natural gas transmission from Canada Maritime and Northeast Pipeline: Natural gas transmission from Canada Transcanada Gas: Natural gas transmission from Canada Alexandria Bay POE, Ontario: Northern border crossing Ambassador Bridge POE, Ontario: Northern border crossing Blaine POE, British Columbia: Northern border crossing Blaine Washington Rail Crossing, British Columbia Blue Water Bridge POE, Ontario: Northern border crossing Champlain POE, Quebec: Northern border crossing CPR Tunnel Rail Crossing, Ontario (Michigan Central Rail Crossing) International Bridge Rail Crossing, Ontario International Railway Bridge Rail Crossing Lewiston-Queenstown POE, Ontario: Northern border crossing Peace Bridge POE, Ontario: Northern border crossing Pembina POE, Manitoba: Northern border crossing North Portal Rail Crossing, Saskatchewan St. Claire Tunnel Rail Crossing, Ontario Waneta Dam, British Columbia: Earthfill/concrete hydropower dam Darlington Nuclear Power Plant, Ontario, Canada. E-ONE Moli Energy, Maple Ridge, Canada: Critical to production of various military application electronics General Dynamics Land Systems – Canada, London Ontario, Canada: Critical to the production of the Stryker/USMC LAV Vehicle Integration Raytheon Systems Canada Ltd. ELCAN Optical Technologies Division, Midland, Ontario, Canada: Critical to the production of the AGM-130 Missile Thales Optronique Canada, Inc., Montreal, Quebec: Critical optical systems for ground combat vehicles Germanium Mine Graphite Mine Iron Ore Mine Nickel Mine Niobec Mine, Quebec, Canada: Niobium Cangene, Winnipeg, Manitoba: Plasma Sanofi Pasteur Ltd., Toronto, Canada: Polio virus vaccine GlaxoSmithKile Biologicals, North America, Quebec, Canada: Pre-pandemic influenza vaccines French Guiana: Americas-II undersea cable landing Cayenne, French Guiana Martinique: Americas-II undersea cable landing Le Lamentin, Martinique Mexico: FLAG/REACH North Asia Loop undersea cable landing Tijuana, Mexico Pan-American Crossing (PAC) undersea cable landing Mazatlan, Mexico Amistad International Dam: On the Rio Grande near Del Rio, Texas and Ciudad Acuna, Coahuila, Mexico Anzalduas Dam: Diversion dam south of Mission, Texas, operated jointly by the U.S. and Mexico for flood control Falcon International Dam: Upstream of Roma, Texas and Miguel Aleman, Tamaulipas, Mexico Retamal Dam: Diversion dam south of Weslaco, Texas, operated jointly by the U.S. and Mexico for flood control GE Hydroelectric Dam Turbines and Generators: Main source for a large portion of larger components Bridge of the Americas: Southern border crossing Brownsville POE: Southern border crossing Calexico East POE: Southern border crossing Columbia Solidarity Bridge: Southern border crossing Kansas City Southern de Mexico (KCSM) Rail Line, (Mexico) Nogales POE: Southern border crossing Laredo Rail Crossing Eagle Pass Rail Crossing Otay Mesa Crossing: Southern border crossing Pharr International Bridge: Southern border crossing World Trade Bridge: Southern border crossing Ysleta Zaragosa Bridge: Southern border crossing Hydrofluoric Acid Production Facility Graphite Mine GE Electrical Power Generators and Components General Electric, Large Electric Power Transformers 230 – 500 kV Netherlands Antilles: Americas-II undersea cable landing Willemstad, Netherlands Antilles. Panama: FLAG/REACH North Asia Loop undersea cable landing Fort Amador, Panama Panama Canal Peru: Tin Mine and Plant Trinidad and Tobago: Americas-II undersea cable landing Port of Spain Atlantic LNG: Provides 70% of U.S. natural gas import needs Venezuela: Americas-II undersea cable landing Camuri, Venezuela GlobeNet undersea cable landing, Punta Gorda, Venezuela GlobeNet undersea cable landing Catia La Mar, Venezuela GlobeNet undersea cable landing Manonga, Venezuela [END TEXT OF LIST]

Symantec Releases a Comprehensive Report about Stuxnet

October 5, 2010 Leave a comment

Symantec released one of the most comprehensive “publicly available” reports about Stuxnet. The paper was first released in the recently concluded conference Virus Bulletin 2010.

Stuxnet Infection Stats - Symantec corporation 2010

Stuxnet Infection Stats - Symantec corporation 2010

Quoting Symantec’s blog ” We’re pleased to announce that we’ve compiled the results of many weeks of fast-paced analysis of Stuxnet into a white paper entitled the W32.Stuxnet Dossier. On top of finding elements we described in the ongoing Stuxnet summer blog series, you will find all technical details about the threat’s components and data structures, as well as high level information, including:

Attack scenario and timeline
Infection statistics
Malware architecture
Description of all the exported routines
Injection techniques and anti-AV
The RPC component
Propagation methods
Command and control feature
The PLC infector

The full report can be downloaded HERE

My Comments:

According to the report from Symantec, the infected hosts have reached nearly 100,000. which is about right.
It’s very alarming that such a high number of infections can/did take place on “supposedly” some of the world’s most mature and security oriented organizations, due to their critical nature of business. Apparently this “false security” is not limited to Iran only but to 155 countries !!!.

If we can get away from Stuxnet with just one lesson it’s the fact that direct and specially crafted attacks against critical infrastructures are real.

The damage that those few lines of code can incur in the real world is like nothing we have seen in the history of computers. A typical worm can steal your credit card information or your personal email password. But worms like Stuxnet can put critical infrastructures like a nuclear facility for instance under a threat that can deprive wide areas of land from any form of life for hundreds of years.

This worm should challenge and question our misconception that malicious programs can at best cause serious financial loss or personal information leakage, but never a human life.

The US Cybersecurity Legislative Agenda

May 30, 2010 1 comment

A very comprehensive set of slides showcasing nearly all the Cybersecurity legislations in the US, I think this can be very useful for researchers.

The slides come from the Harvard Kennedy school (Belfer Center), Prepared by Melissa E. Hathaway (former acting senior director for cyberspace at the National Security Council).

US Cybersecurity Legislative agenda

The slides can be downloaded (Here)