Sophos Cloud Optix
Aramco, Saudi Arabia’s national oil company, said on Sunday that the company was back in operation ten days after a massive malware outbreak hobbled 30,000 workstations at the company.
In a statement on the company’s Facebook page (content alert: Facebook page contains images of extremely phallic architecture), Aramco said that it had “restored all its main internal network services” that were affected by a malware outbreak on August 15.
The attack was attributed to “external sources.” It is just the latest against a national oil company, following reports of malware attacks on Iran’s oil infrastructure linked to the “Flame” malware in May.
Aramco said employees returned to work on August 25 and resumed “normal business,” though the company is blocking remote access to company resources as a precaution.
The exact source of the disruption at the Dhahran, Saudi Arabia oil producer isn’t known, though circumstantial evidence points to a piece of malware dubbed Shamoon, which was first detected at around the same time the attack on Aramco began, on August 15.
Analysis of Shamoon by SophosLabs found that it is a targeted attack designed to steal data and disrupt operations on a specific network, though not the stealthiest or sophisticated targeted malware.
The malicious Trojan horse, which Sophos named Troj/MDrop-ELD, attempts to overwrite the master boot record on infected systems, which would make it impossible to boot the machine. It also replaces files on the hard drive on infected systems, replacing certain image and system file types with a broken JPG (JFIF) file — an obnoxious, but mostly harmless prank.
Word of problems at Aramco surfaced shortly after the firm was hit, when the company acknowledged “a disruption” on its network caused by a malware infection and severed its connections to the internet. Aramco has claimed that the outbreak affected only user workstations and not the parts of its network that manage its “core business” – aka: extracting oil from the ground and refining it.
That statement coincided with a claim of responsibility for the attack from a previously unknown group calling itself the “Cutting Sword of Justice.”
The group posted details of the hack on Pastebin, and said that Aramco was attacked in retaliation against the Al-Saud regime for the “crimes and atrocities taking place in various countries around the world, especially in the neighboring countries such as Syria, Bahrain, Yemen, Lebanon (and) Egypt.”
The “anti-oppression hacker group” said it hacked Aramco using compromised systems in “several countries,” then sent a malicious program to destroy 30,000 systems within Aramco’s network.
Attribution in malware attacks is always tricky, though experts note that both the number of systems the group claims to have infected and the timing of the attack match up with subsequent statements from Aramco and forensic analysis of the malware. That lends some credence to the group’s claims.
Attacks against private and public energy-producing firms are nothing new. In addition to the “Flame” malware attacks against Iran’s oil refineries, the US Department of Homeland Security warned in May about ongoing cyber attacks aimed at firms operating natural gas pipelines within the United States.
Energy firms have also been the target of sophisticated attacks designed to steal valuable information on oil deposits.
However, the Shamoon attack raises the specter of something new: politically motivated hacktivism targeted against politically powerful energy firms and state energy monopolies like Aramco.
In its Pastebin manifesto, Cutting Sword of Justice said its attack on Aramco was “a warning to the tyrants of this country and other countries that support such criminal disasters with injustice and oppression.” The group invited other “anti-tyranny hacker groups” to join the movement.
No word yet on whether Cutting Sword has any takers, but we’ll keep our eyes opened for similar attacks in the days and months ahead.
Interestingly enough, now RasGas in Qatar, a known moderate nation in the Persian Gulf has been attacked by the same malware.
Qatar is noteworthy for permitting Christian churches to be built in the nation, a liquor and pork distribution system for westerners and western attire being the normal dress in the country. It's also an R&R location for US forces in the region.
Do you think this malware attack has something to do with a sabotage plan? since you had mentioned that a Persian Gulf is also attacked with a same malware.
This is the reason gas prices are so freakin high!
Only if breaking and entering is acceptable.
massive protesting hacking such as this could have unintended consequences such as compromising computers designed for people with special needs.
Funniest thing about the article is need for a disclaimer: (content alert: Facebook page contains images of extremely phallic architecture),
F*ck NO
Strange that some dictators like Khadaffi must be overthrown while other dictators are still free to oppress their people. If there was democracy in Saudi, then this thing wouldn’t have happened. That doesn’t mean that I agree with the hacking, but I rather choose that instead of setting of bombs to get rid of the tyrants. They have no problem instead with killing civilians.
So what next hacking groups? Will it be acceptable to kill innocents by say hacking medical computers? Destruction of private property whether it be in a regime that is evil or any other is still destruction, Sword of justice? All I see there is cowards that hide. Anonymous hides behind a veiled voice and mask, Sword of justice, you want to look intelligent? LEARN TO SPELL! My god! If english isn’t your native language then simply don’t bother. In my eyes you are just as cowardly as the governemtn you purport to opress. You put innocent people out of work with your efforts, Whoopy! Good going!
No but that won’t stop them. It’s not about hacktivism though or they wouldn’t claim credit
Absolutely, but in the same sense that eventually there is a right time for violent protest. Even Mandela believed violent protest has a valid use when peaceful means have gone unheeded or become ineffective. Sometimes the only only way to respond to violence is with violence. This said, the decision to use active forms of protest must be taken seriously, as the consequences can be severe.
Aaron Hysell: “This is the reason gas prices are so freakin high!”
No sir it is not, the reason it’s so high is because of greed .
No. Never. The only way we can ever live in any sort of peaceful co existence in this crowded world of ours is rules and laws. Without respecting the same, everything would eventually dissolve into chaos and the walls of Rome would fall. Thus, those who chose to do so, will be punished by the society for the prevention of anarchy.