Free Newsletter
Register for our Free Newsletters
Newsletter
Zones
Access Control
LeftNav
Alarms
LeftNav
Biometrics
LeftNav
Detection
LeftNav
Deutsche Zone (German Zone)
LeftNav
Education, Training and Professional Services
LeftNav
Government Programmes
LeftNav
Guarding, Equipment and Enforcement
LeftNav
Industrial Computing Security
LeftNav
IT Security
LeftNav
Physical Security
LeftNav
Surveillance
LeftNav
View All
Other Carouselweb publications
Carousel Web
Defense File
New Materials
Pro Health Zone
Pro Manufacturing Zone
Pro Security Zone
Web Lec
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
 
News

Windows Shell Worm Targets Infrastructure Systems in US and Iran

ESET : 21 July, 2010  (Technical Article)
ESET has provided details of the Win32/Stuxnet worm which is targeting SCADA systems with particular emphasis on American and Iranian targets
ESET has issued a warning against a worm dubbed Win32/Stuxnet, which threatens users around the globe. Exploiting a vulnerability in Windows Shell, this dangerous threat is detected by ESET as LNK/Autostart.A. It is used in targeted attacks to penetrate SCADA systems, especially in the United States and Iran. SCADA are supervisory and monitoring systems used in many industries, for instance in power engineering.

According to ESET Virus Lab, the worm has been active for several days, lately in the US and Iran with almost 58 percent of all infections being reported in the United States, 30 percent in Iran and slightly over four percent in Russia. The cyber attacks in the U.S. and heightened activity of the worm in Iran come in the wake of persisting tensions between the two nations over nuclear ambitions of this Middle Eastern country.

"This worm is an exemplary case of a targeted attack exploiting a zero-day vulnerability, or, in other words, a vulnerability which is unknown to the public. This particular attack targets the industrial supervisory software SCADA. In short - this is an example of malware-aided industrial espionage. The question is why the chart of affected nations looks as it does," said Juraj Malcho, head of the Virus Lab at ESET's global headquarters in Bratislava, Slovakia.

Most of the damage caused by the worm is limited to industrial targets, with home users being much less affected. "So far, the number of infected PCs are in the tens of thousands, but likely to rise," elaborates Malcho. According to ESET analysis, the Stuxnet worm in and of itself poses no greater threat for home users than the average computer threat. The danger lies in the Windows OS vulnerability connected with processing of LNK files. Experts expect even more malware families to begin to exploit this security gap in the near future.

An interesting angle to this story is how the worm spreads. "For a truly targeted attack it would have been coded to make specific checks to see that it only ran where it was supposed to and did not spread. Spreading increases the odds of detection. If the attack was aimed at only US systems, then the attacker would not want the code appearing all over the world. This fact might indicate a number of potential attackers," said Randy Abrams, director of technical education at ESET in the U.S. "The ability to attack power grids throughout the world would be very appealing to terrorist groups," concludes Abrams.

ESET security solutions effectively detect and clean this threat. A patch from Microsoft is expected to be issued soon as well.
Bookmark and Share
 
Home I Editor's Blog I News by Zone I News by Date I News by Category I Special Reports I Directory I Events I Advertise I Submit Your News I About Us I Guides
 
   © 2012 ProSecurityZone.com
Netgains Logo