Countdown to zero day by Kim Zetter
Stuxnet and the launch of the world’s first
digital weapon
In January 2010, inspectors with the
International Atomic Energy Agency noticed that centrifuges at an Iranian
uranium enrichment plant were failing at an unprecedented rate. The cause was a
complete mystery—apparently as much to the technicians replacing the
centrifuges as to the inspectors observing them.
A small time anti-virus firm in Belarus
(VirusBlokAda) got a call from their resellers in Iran who reported a
persistent problem with a customer’s machine in that country. The
infected computer was caught in a reboot loop, crashing and rebooting
repeatedly while defying the efforts of technicians to control it.
The Belarus team identified a malware and that
spreads via USB flash drives. Even though the team had seen similar infection,
this was very peculiar. When it was infected a Windows 7 machine, the malicious
driver module (malware) installed without any warning. Windows 7 has a security
feature that was supposed to tell users if an unsigned driver or one signed
with an untrusted certificate was trying to install itself on their machines.
That was because, VirusBlokAda team found out that the malicious driver
was using a signed certificate of a company called RealTek Semiconductors
in Taiwan.
The VirusBlokAda team published their finding
and almost immediately an antivirus firm in Slovakia names ESET spotted another
malicious driver that appeared to be related to Stuxnet (named after the
malicious driver name) and this new malicious driver was signed from a company
called JMicron technologies, in Taiwan, a maker of electronic circuits.
The hacker who created the malware hacked these
two companies digital signing keys (private keys) and certificates.When deeply
examined, the attackers appeared to be searching for computers that had one of
two Siemens proprietary software program called SIMATIC WinCC. This program are
part of industrial control system (ICS) to work with Siemens programmable logic
controllers (PLC).
Each time Stuxnet infected a system, it ‘phoned
home’ to one of two internet domains masquerading as soccer fan sites -
mypremerfutbol.com and todaysfutbol.com. The domain names, registered by
someone who used fake names and fraudulent credit cards, pointed to servers to
Denmark and Malaysia that served as command-and control stations for the
attack.
But of all the information Stuxnet reported to
its masters, the Siemens data was the most important because, as the
researchers would soon learned, if Stuxnet found itself on a system that didn’t
have the Siemens software installed, it simply shut itself down.
Symantec team who got involved in this malware
tracking program, contacted the DNS service provider of these two domains and
asked them to redirect all the traffic to Symantec servers. When they analyzed
the traffic coming into their servers, out of the initial 38,000 machines they
tracked, more than 22,000 were based in Iran.
Once in the malware is in place, whenever an
engineer tried to send commands to PLC, Stuxnet made sure its own malicious
command code got sent and executed instead. The second aprt of the attack was
even ingenious. Before Stuxnet’s malicious commands went into action, the
malware sat patiently on the PLC for about two weeks, sometimes longer,
recording legitimate operations as the controller sent status reports back to
monitoring stations. Then when Stuxnet’s malicious commands leapt into action,
the malware replayed the recorded data back to operators to blind them to
anything amiss on the machines. While Stuxnet sabotaged the PLC, it also
disabled automated digital alarms to prevent safety systems from kicking in and
halting whatever process the PLC was controlling if it sensed the equipment was
entering a danger zone. Stuxnet modifying the data the safety system relied on,
the system was blind to dangerous conditions and never had a chance to act.
While reverse engineering the malware, the
Siemens engineers reached a startling conclusion. Stuxnet wasn’t just attacking
two specific models of Siemens PLC, it was attacking a specific facility where
the PLCs was used. The PLC has to be configured in a very precise way.
Right before Stuxnet unleashed its destructive payload on a 315 PLC, it
searched the PLC for three magic values and it had reached its target when it
found all three.
Three months into the discovery of Stuxnet, the
rest of the world now knew about the mysterious code that had evidently
targeted iran. yet speculation that it had specifically targeted the uranium
enrichment program at ntanz remained just that speculation.
While this news was available outside, Iranian
officials revealed for the first time that computers at Bushehr (nuclear plant
in Iran) had indeed been hit by Stuxnet.
Symantec had resolved the mystery of the devices
the digital weapon attacked, Albright had made the final connections between
Stuxnet and the centrifuges at Natanz and although the US government still
hadn’t made a formal admission of responsibility for the attack, the New York
Times had confirmed what everyone suspected - that the United States and Israel
were behind it.
Flame
The revelations began that April 2012, when a
virus began running wild on computers at the Iranian Oil Ministry and the
Iranian National Oil Company, wiping out the hard drive of every system it
touched. The damage was systematic and complete, destroying gigabytes of data
at a time. First, the malware eliminated documents and data files, then it went
after system files, zapping core parts of the hard drive to cause them to crash
and burn. The name given to the virus was Flame.
Stuxnet had tipped the scales at 500 kilobytes
when compressed, but Flame was at least 20 megabytes with all of its components
combined and consisted of more than 650,000 lines of code.
Flame appeared to be a multipurpose espionage
tool created to meet every need, depending on the mission. A 6MB starter kit
got loaded onto many infected machines first, which included a back door
through which the attackers could install new spy modules from their command
server at will.
The infrastructure is set up to support Flame
was also massive and like nothing the researchers had seen before. They found
at least eight domains operating as command servers in Germany, Netherlands,
Switzerland and elsewhere through which the attackers controlled infected
machines and collected siphons documents from them.
The Microsoft info-sec team was inspecting the
Flame virus in detail, they realized they were looking at something much worse
than a zero day - Flame was performing a sophisticated attack against part of a
Microsoft Windows Update system to spread itself between machines on a local
machine.
Like the Windows software, the update tool
itself gets periodically updated by Microsoft. Each time the tool launches on a
customer’s machine, it sends out a kind of beacon to Microsoft servers to see
it a new version of itself is available. Microsoft distributes the updates
through a series of so-called . CAB files signed with a Microsoft certificate
to verify their legitimacy.
The attackers subverted this process by first
infecting one machine on a victim’s network with Flame. Then when the update
client on any other machine on the victim’s network sent out a beacon to
Microsoft servers to check for updates to the Windows update tool, the infected
machine intercepted the beacon and sent a malicious Flame file, masquerading as
a legitimate Microsoft .CAB file, to the new machine instead, thus
infecting it with the spy tool. This wasn’t the most sophisticated part of the
attack. To pull off the hijack, the attackers had signed their malicious .CAB
file with a legitimate Microsoft certificate - except in this case the
certificate indicated that the company it belonged was ‘MS’ not Microsoft
Corporation as it should have said.
It turned out the attackers had pulled this off
using something called an MD5 hash collision. Exploited the weakness in MD5 and
thus faking it as these updates are original updates from Microsoft.
Operation Olympic Games were a covert and still
unacknowledged campaign of sabotage by means of cyber disruption, directed at
Iranian nuclear facilities by the United States and likely Israel. As reported,
it is one of the first known uses of offensive cyber weapons.Started under the
George W. Bush administration in 2006, Olympic Games was accelerated under
President Obama, who heeded Bush’s advice to continue cyber attacks on Iranian
nuclear facility at Natanz. Bush believed that the strategy was the only way to
prevent an Israeli conventional strike on Iranian nuclear facilities.[Wikipedia]
