Attacks/Breaches
4/19/2011
01:03 PM
50%
50%

Iranian Official Claims Siemens Partially Responsible For Stuxnet

The Iranian military has accused German electronics and industrial engineering firm Siemens of taking part in the development of the Stuxnet worm.

We'll probably never know conclusively who wrote and released Stuxnet. Consensus points to the United States and Israel, in an alleged attempt to damage the Iranian nuclear program at the Bushehr nuclear power plant. Previously, Iranian officials asserted that the malware had not caused any damage to its nuclear program.

Now, if a recent Reuters story is accurate, an Iranian military commander accuses Siemens of helping in the creation of Stuxnet:

Gholamreza Jalali, head of Iran's civilian defense, said the Stuxnet virus aimed at Iran's atomic program was the work of its two biggest foes and that the German company must take some of the blame.

Siemens declined to comment.

"The investigations show the source of the Stuxnet virus originated in America and the Zionist regime," Jalali was quoted as saying.

Jalali said Iran should hold Siemens responsible for the fact that its control systems used to operate complicated factory machinery--known as Supervisory Control and Data Acquisition (SCADA)--had been hit by the worm.

I doubt Siemens had anything to do with the direct creation of the Stuxnet worm. And I certainly haven't read or seen any evidence that would point to this possibility being so. Most likely, whoever designed the worm--to the degree they needed or wanted assurance that it would work as designed--had the finances to purchase equipment that mirrored the equipment at Bushehr and designed the worm and payload accordingly.

If Siemens did play a role in the development of Stuxnet, it was probably a passive one: they provided the necessary software so that vulnerabilities could be uncovered. Or, perhaps they had their software evaluated at Idaho National Labs and--totally unknown to them--the U.S. took that opportunity to discover and pocket a number of zero days.

Additionally, not only is Iran talking about holding Siemens responsible, but a couple of months ago the Iranian Deputy chairman of the Joint Chiefs of Staff said the country would take "pre-emptive" strikes against the powers it believes launched the attack.

How well would the U.S. fair in an attack on the power grid? Probably not very well if a recent Ponemon Institute survey is to be believed. In its survey, it found that three-quarters of energy companies and utilities experienced one or more data breaches in the past 12 months. Additionally, 69% of those surveyed believe another data breach is very likely to occur within the next year.

Let's hope they're wrong.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1414
Published: 2015-02-27
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.

CVE-2015-2072
Published: 2015-02-27
Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs or...

CVE-2015-2075
Published: 2015-02-27
SAP BussinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396.

CVE-2015-2076
Published: 2015-02-27
The Auditing service in SAP BussinessObjects Edge 4.0 allows remote attackers to obtains sensitive information by reading an audit event, aka SAP Note 2011395.

CVE-2015-2101
Published: 2015-02-27
Cross-site scripting (XSS) vulnerability in the Navigate bar in the Navigate module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.