Vulnerabilities / Threats

9/27/2010
04:10 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Iran Denies Stuxnet Worm Hurt Nuclear Plant

The malware appears to have been designed to target a specific facility or control process.

An Iranian official on Sunday acknowledged that the stuxnet worm had affected personal computers at the Bushehr nuclear plant but asserted that the malware had not caused major damage.

Stuxnet is believed to have been created last year and was first detected by a security firm in Belarus in June, according to ICSA Labs. Once introduced to a computer system via a USB drive, among other attack vectors, it is designed to exploit as many as four different vulnerabilities in various versions of Microsoft Windows and to infect Supervisory Control and Data Acquisition control systems (SCADA) made by Siemens. These systems control critical infrastructure at facilities like power plants.

To date, Microsoft has patched two vulnerabilities exploited by stuxnet.

The malware has been characterized as being exceptionally sophisticated, prompting speculation that it could only be the product of an organization backed by a nation-state, such as an intelligence agency.

No proof of such claims has yet been made public.

The targeted nature of the malware, in the opinion of Siemens, means that it was created to attack a specific facility or industrial process.

"Stuxnet is obviously targeting a specific process or a plant and not a particular brand or process technology and not the majority of industrial applications," the company said in updated information it posted last week.

Symantec, which plans to present a paper on stuxnet at the Virus Bulletin Conference on September 29th, said in June that the majority of stuxnet infections it could detect (59%) were in Iran.

Attacks on critical infrastructure like the Bushehr nuclear plant are just the sort of cyber warfare that U.S. officials have long feared could occur in the U.S. and have sought to prevent through funding and legislation.

The Pentagon has refused to comment on whether or not it launched the stuxnet attack.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Cracking 2FA: How It's Done and How to Stay Safe
Kelly Sheridan, Staff Editor, Dark Reading,  5/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "The one you have not seen, won't be remembered".
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10428
PUBLISHED: 2018-05-23
ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of reflected cross-site-scripting.
CVE-2018-6495
PUBLISHED: 2018-05-23
Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to al...
CVE-2018-10653
PUBLISHED: 2018-05-23
There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVE-2018-10654
PUBLISHED: 2018-05-23
There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVE-2018-10648
PUBLISHED: 2018-05-23
There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.