Posted on 10/19/2011 2:08:07 PM PDT by blam
Major Security Firms Detect New Trojan Capable Of Disrupting Power Plants, Oil Refineries and Other Critical Infrastructure Networks
Mac Slavo
October 19th, 2011
In our October 7, 2011 report There Have Been Intrusions, we noted that DHS Undersecretary Greg Shaffer warned that hackers and foreign governments are “knocking on the backdoor” of the networked systems which connect everything from infrastructure grid control systems to financial networks.
It now appears that our interconnected smart grid is actively under attack, as evidenced by a new Stuxnet-style trojan that has been detected by major cyber security leaders Symantec and McAfee. Much like its predecessor, the trojan dubbed “Duqu” is designed to infilitrate the networks that control everything from power production facilities to oil refineries. It is not yet clear exactly how the trojan operates, what its intended purpose is, or who designed it (though it is believed that the code for Duqu and Stuxnet likely originated with U.S. intelligence agencies). Both Symantec and McAfee continue to investigate the threat:
Security researchers have detected a new Trojan, scarily similar to the infamous Stuxnet worm, which could disrupt computers controlling power plants, oil refineries and other critical infrastructure networks.
The Trojan, dubbed “Duqu” by the security firm Symantec, appears, based on its code, to have been written by the same authors as the Stuxnet worm, which last July was used to cripple an Iranian nuclear-fuel processing plant.
…
“Duqu shares a great deal of code with Stuxnet; however, the payload is completely different,” researchers for the security firm Symantec wrote on its Security Response blog.
Instead of directly targeting the SCADA system, Duqu gathers “intelligence data and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party. The attackers are looking for information such as design documents that could help them mount a future attack on an industrial control facility.”
“Duqu is essentially the precursor to a future Stuxnet-like attack,” the researchers added.
Source: Fox News
You may recall that Stuxnet was so advanced that it crashed the physical centrifuges used to enrich uranium in Iran’s nuclear facilities. Stuxnet did this by exploiting software and hardware vulnerabilities, essentially reporting to Iranian research facility engineers that everything was functioning properly by controlling the software interface, while in the background it sent centrifuges spinning out of control to the point of hardware failure.
Duqu, which is apparently a similar piece of advanced code with a slightly different modus operandi, is not yet completely understood, but like Stuxnet in Iran, it is now actively functioning inside of critical infrastructure systems gathering information. To what end? The answer to that question may remain elusive until it’s too late.
In reportedly unrelated news, the Department of Homeland Security, in an unclassified National Cybersecurity and Communications Integration Center Bulletin (pdf), has issued warnings about the hacking group Anonymous and the possibility that they are becoming increasingly capable of targeting advanced Industrial Control Systems (ICS):
(U//FOUO) The information available on Anonymous suggests they currently have a limited ability to conduct attacks targeting ICS. However, experienced and skilled members of Anonymous in hacking could be able to develop capabilities to gain access and trespass on control system networks very quickly. Free educational opportunities (conferences, classes), presentations at hacker conferences, and other high profile events/media coverage have raised awareness to ICS vulnerabilities, and likely shortened the time needed to develop sufficient tactics, techniques, and procedures (TTPs) to disrupt ICS. Control system exploits are released in common penetration testing software such as Metasploit release 4.0 that can be directly used with novice level skills in hacking and little to no background in control systems. Common packet inspection tools such as WireShark and Netmon have improved to the point where industrial protocols are supported minimizing the effectiveness of security-by-obscurity. In addition, there are control systems that are currently accessible directly from the Internet and easy to locate through internet search engine tools and applications. These systems could be easily located and accessed with minimal skills in order to trespass, carry out nefarious activities, or conduct reconnaissance activities to be used in future operations.
(U//FOUO) Anonymous has recently called on their members to target energy companies based on “Green Energy” initiative performance. This targeting could likely extend beyond Anonymous to the broader hacktivist community, resulting in larger-scope actions against energy companies. Asset owners and operators of critical infrastructure control systems are encouraged to engage in addressing the security needs of their control system assets.
Curiously, the Duqu trojan doesn’t seem to have originated from individual hackers or hacking groups, or foreign intelligence services. Rather, like Stuxnet, the virus was likely written under control and/or guidance of U.S. intelligence, possibly in collaboration with Israeli intelligence.
While DHS has issued warnings about Anonymous and other hacking groups potentially attacking the grid, someone – and it’s likely not a lone hacker or the Anonymous hacking group – is actively involved in probing for vulnerabilities in our infrastructure control systems. These are the systems that monitor and control our electricity, water supplies, gas pipelines, oil refineries, financial exchanges, and even certain military operations.
There seems to be no immediate danger at this time, as the Duqu trojan is reportedly gathering intelligence, as opposed to actively attempting to bring down the systems via a hardware style attack like Stuxnet.
But once it acquires all of the necessary information, such as personnel access codes, security certificates and a mapped layout of a particular grid infrastructure, it wouldn’t take much to take things to the next level.
Imagine for a moment the effect of an attack on major refining operations, cascading electrical outages, urban water purification systems that added excessive chemicals to water supplies, or the massive flooding that might result if a dam were compromised.
Or, consider that the U.S. drone fleet was recently attacked by an unknown trojan or malware, which was logging access commands and passwords for high security military systems. What would happen if an enemy of the people of the United States gained access to our entire drone fleet, weapons systems and all?
The possibilities for damage via compromised infrastructure systems would be nothing short of a digital apocalypse, with the potential to adversely affect the lives of tens of millions of unsuspecting Americans virtually overnight.
Adam Taylor
Oct. 19, 2011, 1:18 PM
Image: Flickr Swobodin
Several European firms that create software that controls industrial facilities, including nuclear reactors, have been hit by a virus that extracts information from their systems, The New York Times reports.
The virus, known as Duqu, appears to have been made by the same people who made the Stuxnet virus, an infamous cyber weapon that attacked the Iran nuclear program last summer.
Internet security organization Symantec describe Duqu on their website:
Duqu is essentially the precursor to a future Stuxnet-like attack. The threat was written by the same authors (or those that have access to the Stuxnet source code) and appears to have been created since the last Stuxnet file was recovered. Duqu's purpose is to gather intelligence data and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party. The attackers are looking for information such as design documents that could help them mount a future attack on an industrial control facility.
One key point outlined by Systemac is that whoever created the file has access to the source code of Stuxnet, and is likely the creator of the previous virus.
But who created Stuxnet? While initial reports suggested Israel, other reports suggested China or even the United States. Could any of them have an interest in European nuclear security?
Vikram Thakur of Symantec told the Times, “This is extremely sophisticated, this is cutting edge.”
So if Norton and Symantec have identified it, then it’s a non - issue, just have either company roll out a script online that anyone can download for free to remove it, problem solved.
Not much would cause SHTF here in America faster than a widespread and long term power outage, especially in highly urban areas.
I think such a scenario could cause some major civil disturbances because the ‘Yutes’ are already restless and when you add the fact that because of the economy people are already on edge it won’t take much to set things off.
Reminds me of one of my favorite quotes:
“Star Trek: Deep Space Nine: The Siege of AR-558 (#7.8)” (1998)
Quark: Let me tell you something about Hew-mons, Nephew. They’re a wonderful, friendly people, as long as their bellies are full and their holosuites are working. But take away their creature comforts, deprive them of food, sleep, sonic showers, put their lives in jeopardy over an extended period of time and those same friendly, intelligent, wonderful people... will become as nasty and as violent as the most bloodthirsty Klingon. You don’t believe me? Look at those faces. Look in their eyes.
Today we have ‘yutes’ who roam our streets who are with out morals, without respect for law or life itself. They will look are you with the same ‘doll eyes’ a shark does before he eats you and they will feel no more compassion than the shark does.
That will be the test of many. Most preppers I know are Christian people and they will hesitate to do what they might have to do to stop the ‘yutes’. On the other hand the ‘yutes’ won’t think twice nor lose a minute of sleep, in fact they will smile and laugh about it.
For those who are just starting or are old hands at prepping you may find my Preparedness Manual helpfull. You can download it at:
http://www.tomeaker.com/kart/preparedness1i.pdf
For those of you who haven’t started already it’s time to prepare almost past time maybe. You needed to be stocking up on food guns, ammo, basic household supplies like soap, papergoods, cleaning supplies, good sturdy clothes including extra socks, underwear and extra shoes and boots, a extra couple changes of oil and filters for your car, tools, things you buy everyday start buying two and put one up.
As the LDS say “When the emergency is upon us the time for preparedness has past.”
Or as the bible says: A prudent man sees danger and takes refuge, but the simple keep going and suffer for it.
NIV Proverbs 22:3
Lastly this for the doubters and the scoffers.
“There is no greater disaster than to underestimate danger.
Underestimation can be fatal.”
Preppers PING!!
Wow, that must be one big condom.
Wow, that must be one big condom.
= = = = = = = = = = = = = = = = = = = = = = = = = = = =
We appear to be on the same ‘page’ here. I couldn’t wait to scroll down here with some ‘cute quip’ about Super Prophylactics.
I wonder if Elaine would call it ‘sponge worthy’?
I wonder if our own experts are "knocking on the back door" of the systems of our enemies, like they do to us?
The IOSAT Potassium Iodide Tablet works by saturating the thyroid with stable iodine so it will not absorb radioactive iodine released in the event of a nuclear accident. This 14-day supply is designed to protect an adult from the serious effects of radioactive iodine, which has a half-life of eight days. The IOSAT Potassium Iodide Tablets includes 14 130-mg tablets.
LOL! Good one.
If Symantec said the sun rises in the morning I would have to look outside to verify it. They failed to provide a 2 year protection plan I paid in advance for and in fact refused to ever acknowledge a singe communication.
McAfee was caught developing viruses and shazzam creating a fix.
If Symantec said the sun rises in the morning I would have to look outside to verify it. They failed to provide a 2 year protection plan I paid in advance for and in fact refused to ever acknowledge a single communication.
McAfee was caught developing viruses and shazzam creating a fix.
Maybe. Maybe not.
I would presume this is some sort of root kit based trojan. They are notoriously hard to get rid of. I doubt if a simple utility of any sort would do the job.
And I continue to wonder why Microsoft cannot protect their operating system from this sort of thing. Windows has been around for nearly 20 years and we are still fighting off virus, worm, malware and trojan attacks.
I wouldn’t worry about nukes. There are only a couple in the US that have changed over to any kind of computer control.
It’s the nature of their OS. It was never made to be a security minded OS (multi-user with different privileges) in the first place. Security stuff was put in place later piecemeal but core OS designs prevented unix-level security being able to be implemented. Not saying unix systems are perfect, but they are far more robust and able to be secured better.
Maybe so, but if the top anti-malware companies can identify this threat, it is certainly within their grasp to remove. If it’s such a big threat as portrayed in this article then the best of the best damn well better be working around the clock for a solution.
I can't disagree with that but I've seem them fail to actually finish the job. McAfee sometimes detects the trojan, removes it and 10 minutes later does the same thing. Over and over.
What I go to when I have a serious trojan problem is majorgeeks.com. They have never failed to get rid any trojan that I've ever had. The service is free. It's run by very expert volunteers who are sticklers for procedure. Do exactly what they tell you to do and you will succeed. Don't and you won't.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.
