Attacks/Breaches
4/19/2011
01:03 PM
Connect Directly
RSS
E-Mail
50%
50%

Iranian Official Claims Siemens Partially Responsible For Stuxnet

The Iranian military has accused German electronics and industrial engineering firm Siemens of taking part in the development of the Stuxnet worm.

We'll probably never know conclusively who wrote and released Stuxnet. Consensus points to the United States and Israel, in an alleged attempt to damage the Iranian nuclear program at the Bushehr nuclear power plant. Previously, Iranian officials asserted that the malware had not caused any damage to its nuclear program.

Now, if a recent Reuters story is accurate, an Iranian military commander accuses Siemens of helping in the creation of Stuxnet:

Gholamreza Jalali, head of Iran's civilian defense, said the Stuxnet virus aimed at Iran's atomic program was the work of its two biggest foes and that the German company must take some of the blame.

Siemens declined to comment.

"The investigations show the source of the Stuxnet virus originated in America and the Zionist regime," Jalali was quoted as saying.

Jalali said Iran should hold Siemens responsible for the fact that its control systems used to operate complicated factory machinery--known as Supervisory Control and Data Acquisition (SCADA)--had been hit by the worm.

I doubt Siemens had anything to do with the direct creation of the Stuxnet worm. And I certainly haven't read or seen any evidence that would point to this possibility being so. Most likely, whoever designed the worm--to the degree they needed or wanted assurance that it would work as designed--had the finances to purchase equipment that mirrored the equipment at Bushehr and designed the worm and payload accordingly.

If Siemens did play a role in the development of Stuxnet, it was probably a passive one: they provided the necessary software so that vulnerabilities could be uncovered. Or, perhaps they had their software evaluated at Idaho National Labs and--totally unknown to them--the U.S. took that opportunity to discover and pocket a number of zero days.

Additionally, not only is Iran talking about holding Siemens responsible, but a couple of months ago the Iranian Deputy chairman of the Joint Chiefs of Staff said the country would take "pre-emptive" strikes against the powers it believes launched the attack.

How well would the U.S. fair in an attack on the power grid? Probably not very well if a recent Ponemon Institute survey is to be believed. In its survey, it found that three-quarters of energy companies and utilities experienced one or more data breaches in the past 12 months. Additionally, 69% of those surveyed believe another data breach is very likely to occur within the next year.

Let's hope they're wrong.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1544
Published: 2014-07-23
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger cer...

CVE-2014-1547
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1548
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1549
Published: 2014-07-23
The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and applica...

CVE-2014-1550
Published: 2014-07-23
Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.