Attacks/Breaches
4/19/2011
01:03 PM
Connect Directly
RSS
E-Mail
50%
50%

Iranian Official Claims Siemens Partially Responsible For Stuxnet

The Iranian military has accused German electronics and industrial engineering firm Siemens of taking part in the development of the Stuxnet worm.

We'll probably never know conclusively who wrote and released Stuxnet. Consensus points to the United States and Israel, in an alleged attempt to damage the Iranian nuclear program at the Bushehr nuclear power plant. Previously, Iranian officials asserted that the malware had not caused any damage to its nuclear program.

Now, if a recent Reuters story is accurate, an Iranian military commander accuses Siemens of helping in the creation of Stuxnet:

Gholamreza Jalali, head of Iran's civilian defense, said the Stuxnet virus aimed at Iran's atomic program was the work of its two biggest foes and that the German company must take some of the blame.

Siemens declined to comment.

"The investigations show the source of the Stuxnet virus originated in America and the Zionist regime," Jalali was quoted as saying.

Jalali said Iran should hold Siemens responsible for the fact that its control systems used to operate complicated factory machinery--known as Supervisory Control and Data Acquisition (SCADA)--had been hit by the worm.

I doubt Siemens had anything to do with the direct creation of the Stuxnet worm. And I certainly haven't read or seen any evidence that would point to this possibility being so. Most likely, whoever designed the worm--to the degree they needed or wanted assurance that it would work as designed--had the finances to purchase equipment that mirrored the equipment at Bushehr and designed the worm and payload accordingly.

If Siemens did play a role in the development of Stuxnet, it was probably a passive one: they provided the necessary software so that vulnerabilities could be uncovered. Or, perhaps they had their software evaluated at Idaho National Labs and--totally unknown to them--the U.S. took that opportunity to discover and pocket a number of zero days.

Additionally, not only is Iran talking about holding Siemens responsible, but a couple of months ago the Iranian Deputy chairman of the Joint Chiefs of Staff said the country would take "pre-emptive" strikes against the powers it believes launched the attack.

How well would the U.S. fair in an attack on the power grid? Probably not very well if a recent Ponemon Institute survey is to be believed. In its survey, it found that three-quarters of energy companies and utilities experienced one or more data breaches in the past 12 months. Additionally, 69% of those surveyed believe another data breach is very likely to occur within the next year.

Let's hope they're wrong.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant