EyeCurrent

A while ago, James had posted on his concerns about new malware poping up on some Windows 7 Siemens MMI SCADA systems.  Today we know a little more about this nasty bug.  It is more identified as the Stuxnet worm.  This worm may very well be an Israeli cyber attack targeted on the Iranian Nuclear program.  I explore the possibility in another post:

I suspect that a systems integrator might be involved here. Someone financed and developed this worm, and someone planted it.  We can be be sure our current administration didn’t approive of such an anti-Iranian attack, and Israel won’t be forthcoming about taking credit.  There are clues  though in an article posted last year, that fortold of this attack and predicted how such an attack would be implemented.

Such attacks could be immediate, he said. Or they might be latent, with the malware loitering unseen and awaiting an external trigger, or pre-set to strike automatically when the infected facility reaches a more critical level of activity.

As Iran’s nuclear assets would probably be isolated from outside computers, hackers would be unable to access them directly, Borg said. Israeli agents would have to conceal the malware in software used by the Iranians or discreetly plant it on portable hardware brought in, unknowingly, by technicians

“A contaminated USB stick would be enough,” Borg said.

Our real concern is  how we can protect ourselves, from getting burned from such nasty critters such as the Stuxnet Worm., The danger to our our Industries are not just economical but life and health.  This worm is effecting processes, and perhaps processes involving the production of nuclear weapons.

Iran officials have confirmed that there has been a ‘Cyber Terrorism’ attack in their country and that their vital computers have been infected by the Stuxnet worm. The authorities have said that many of their industrial computer systems have been attacked by cyber terrorism and they have been infected by the ‘Stuxnet’ worm virus.

How can we protect our selves?

• The biggest vulnerability of course is Window. As these incidents prove even the newest Windows 7 can be a thriving environment for these worms and virus. Given a choice Microsoft Windows should be avoided for critical applications.  There are more secure and more reliable operating systems outhere.
• Ensure that the latest security patches get installed.   Microsoft did issue a patch for this  in July. The patch won’t fox the Damaged data files or the controllers that were changed. but might prevent the spread of the worm.
• Know that your patches and data is clean? It is critical to know if your venders have an anti Virus program and that their flashdrives are included in a regular scan.   Do the DCS/SCADA systems involved have a current antiVirus program intalled?
• Fire Walls: Ideally, having a critical control system with any potential connection to the outside  world should be avoided. But connectivity demands of even to collect data and monitor status’ make such isolation almost impossible.  However careful installation and review of firewall policies can protect a system.  The Stuxnet Worm was getting commands and posting data to a remote server. A well configured firewall would have gone a long way to mitigate the damage.

We live in interesting times, if this proves to be a state sponsored cyberattack we users can only  expect such attacks to come more often.  and collateral damage to be common place.

Share on Facebook