Stuxnet Security Theatre blows up balloon

Filed Under: Malware

VB 2010

I've just come from a presentation about the Stuxnet virus presented at the Virus Bulletin 2010 conference. I'm not in the best of moods. The presentation was little more than Security Theatre by a vendor who really ought to know better.

Let me admit that the analysts in the security team of the vendor concerned have done a sterling job in making sense of the arcane PLC code inside Stuxnet. PLC stands for Programmable Logic Controller, a specialised sort of industrial control computer widely used in environments such as industrial plants and factories to regulate and operate machinery.

The PLCs targeted by Stuxnet are programmed using Windows-based development software called Step 7. You write your PLC code in the Step 7 application, compile it, and download it to the PLC device. You can later suck code and data back from the PLC, using the same connector cable and software.

Stuxnet reconfigures your Step 7 setup so that downloads to, and uploads from, the PLC pass through a malicious DLL, installed by the virus. This DLL acts as a sort of rootkit: it quietly injects malicious PLC code into downloaded data blocks, and removes that same malicious code from data blocks which are read back in.

The VB2010 Stuxnet Security Theatre presentation used this rootkittery in a proof-of-concept "demo" of PLC malware. Clever demo: the downloaded code inflated a balloon for three seconds. Then the rootkit was activated and the same PLC code re-downloaded. But the rootkit silently tweaked the PLC code so that the 3-second limit was not imposed. This time...

...the balloon inflated for five or six seconds. And then (can you tell what happens next?) the BALLOON ACTUALLY BURST!

We were then invited to imagine this same sort of misbehaviour translated to an oil pipeline. Nice segue.

Then, to conclude, we were shown a graph of known active infections. The vast majority were from Iranian IP numbers. And we were told that the string 19790509 appears in the malware, and that this represents a date. Finally, we were told that on this date, according to a well-known search engine, Jewish businessman Habib Elghanian was executed in Iran.

Go figure.

But this same security vendor has also published information telling a very different story, with India and Indonesia accounting for 72% of systems on which Stuxnet was blocked. (Iran came in third here, at 20%)

Stux infections

Perhaps, then, Stuxnet targets countries with names beginning with "I". Residents of the Isle of Man, watch out!

Perhaps, even more reasonably, these figures tell us nothing more than that Iranians aren't very proactive with anti-virus precautions.

Given that this presentation was conducted in front of the cameras of the BBC, I would greatly have preferred the presenter to remind us of this potential conclusion, which teaches us that what we do (or don't do) in respect of security on our own computers ends up affecting all of us.

A cybercriminal injury to one is an injury to all!

, ,

You might like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Paul Ducklin is a passionate security proselytiser. (That's like an evangelist, but more so!) He lives and breathes computer security, and would be happy for you to do so, too. Paul won the inaugural AusCERT Director's Award for Individual Excellence in Computer Security in 2009. Follow him on Twitter: @duckblog