Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Cyber Weapon Friendly Fire: Chevron Stuxnet Fallout

Malware's jump from Iranian uranium enrichment facility to energy giant highlights the downside to custom-made espionage malware -- its capability to infect friends as well as foes.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
The pioneering Stuxnet computer virus, which was designed to attack a single Iranian uranium enrichment facility, went on to infect PCs around the world. Security experts have identified thousands of resulting Stuxnet infections. On Monday, multinational energy giant Chevron became the first U.S. company to admit that it, too, was infected by Stuxnet.

Chevron found that some of its systems had been infected by Stuxnet soon after security firms discovered the virus in July 2010. "I don't think the U.S. government even realized how far it had spread," Mark Koelmel, general manager of the earth sciences department at Chevron, told The Wall Street Journal. "I think the downside of what they did is going to be far worse than what they actually accomplished," he said.

But according to Chevron spokesman Morgan Crinklaw, Stuxnet caused no damage to Chevron's network. "We make every effort to protect our data systems from those types of threats," he told The Wall Street Journal.

[ Read Flame Malware Code Traced To Stuxnet. ]

Confirmation that Stuxnet was designed by the U.S. government -- reportedly working with Israel -- came in June 2012 via journalist David Sanger, who reported that Stuxnet was developed as part of a classified cyberweapons program codenamed "Olympic Games," which was begun under President Bush and accelerated by President Obama. The malware was designed to forestall Israeli airstrikes against Iran, instead using a virus that sabotaged the high-frequency convertor drives used in centrifuges inside the Iranian nuclear facility at Natanz.

Stuxnet reportedly did disable a number of centrifuges at Natanz, but it also spread. "The fundamental problem with the use of viruses as weapons is that once deployed, one loses control of it. It is as likely to damage one's friends as one's enemies," said William Hugh Murray, an executive consultant and trainer in information assurance who's an associate professor at the Naval Postgraduate School, in a recent SANS Institute newsletter.

People with knowledge of the Olympic Games program, speaking to Sanger, did say that the virus had unexpectedly gotten out of control. But many security experts have disputed the notion that Stuxnet somehow broke loose unexpectedly, given that it was a virus incorporating multiple infection techniques, including the ability to exploit four zero-day vulnerabilities.

"'Escaped' continues to be a puzzling term when applied to a virus that relied on numerous Microsoft zero-day vulnerabilities and propagation vectors," said Sean McBride, the director of analysis for Critical Intelligence, in a SANS newsletter. "On the other hand, if your system was not the single underground facility in Iran that Stuxnet was intended to disrupt, the infection was benign. Such collateral damage is part of the price industry gets to pay for -- what was then -- two more years of Iran [being] without a nuclear weapon."

What remains worrying about Stuxnet is the ease with which the custom malware was able to surreptitiously alter the behavior of programmable logic controllers (PLCs) used in industrial control systems. As the Chevron infection highlights, PLCs aren't just used in uranium refineries, but for a broad range of applications -- spanning oil and gas enrichment, manufacturing plant floors and even prisons. Furthermore, businesses might replace their industrial control systems only every 10 or 20 years.

In the interim, what could safeguard PLC environments against future attacks of the Stuxnet variety, especially if launched by foreign adversaries? "There are no automated defense systems that can protect power systems and other critical infrastructure resources against these advanced attacks," said Alan Paller, director of research at the SANS Institute, in a SANS newsletter. "The only defense -- admittedly imperfect -- is radically improved technical skills."

Recent breaches have tarnished digital certificates, the Web security technology. The new, all-digital Digital Certificates issue of Dark Reading gives five reasons to keep it going. (Free registration required.)

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
moarsauce123
50%
50%
moarsauce123,
User Rank: Ninja
11/18/2012 | 10:36:16 PM
re: Cyber Weapon Friendly Fire: Chevron Stuxnet Fallout
Stuxnet, Flame, and Duqu seem to be creations of the same entity based on their coding and methods of operation. For a quick rundown of how these worms and other malware work, have a look here:

http://dougvitale.wordpress.co...
kjhiggins
50%
50%
kjhiggins,
User Rank: Strategist
11/12/2012 | 9:54:55 PM
re: Cyber Weapon Friendly Fire: Chevron Stuxnet Fallout
Wonder why Chevron decided to go public about this.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.