Stuxnet worm slithers into China, heralds alien invasion

Conspiracy? Cock-up? Or Conspiracy?

Analysis The infamous Stuxnet worm has reportedly begun spreading in China.

The worm, which targets supervisory control and data acquisition (SCADA) systems, has infected "millions of computers" across the country, AFP reports.

Local anti-virus outfit Rising International told the official Xinhua news agency that six million individuals and nearly 1,000 corporate accounts across China had been infected with the worm. However Yu Xiaoqiu, an analyst with the China Information Technology Security Evaluation Centre, said it hadn't witnessed any damage as a result of apparent infestation, an observation that raises doubts about Rising International's estimates.

Seven steps to sabotage

The sophisticated malware is designed to sabotage industrial plant control systems, specifically those running Siemens Simatic WinCC SCADA system software. Stuxnet exploits four Windows zero-day vulnerabilities, stolen signed certificates and a variety of other trickery with the ultimate aim of reprogramming the programmable logic controllers (PLCs) of control systems. The PLCs targeted by Stuxnet are programmed using Windows-based development environment called Step 7. The malware reconfigures a Step 7 setup which hides its presence on compromised components, making it a kind of rootkit for industrial control systems.

A diagram illustrating how Stuxnet works, based on an analysis by Symantec, can be found here.

Cyber-semtex

Stuxnet was first detected by Belarussian anti-virus firm VirusBlokAda in late June, and confirmed by other security firms shortly afterwards in July. Other SCADA-system strains of malware have been detected before but the sophistication of Stuxnet together with its first detection in systems in Iran have sparked the theory that it was designed by Mossad and targeted at disrupting operations at Iran's new nuclear reactor in Bushehr. Iran has reportedly responded to the outbreak by blocking command and control channels associated with Stuxnet across its entire internet infrastructure.

Some security analysts have described Stuxnet as the first cyber super-weapon.

The bible code and UFOs...

The Stuxnet code contains reference to 9 May 1979, the date a prominent Jewish businessman, Habib Elghanian, was executed in Iran. Also the malware contains a string called Myrtus which corresponds to Myrtle, a figure from the Book of Esther who informs the informs the king of a plot against the Jews, prompting a royal authorisation for reprisals. Esther was born as Hadassah which means Myrtle.

Details like this, of course, make fantastic material for weaving elaborate conspiracy theories but do little to establish one way or another whether the worm was targeted at Iran, much less its nuclear facilities. Some argue that the Mossad worm targeting Iran idea is too neat and might be some sort of misdirection.

In fact stats from Russian anti-virus firm Kaspersky Lab suggest far more systems in India (86,000) and Indonesia (34,000) have been infected than the 14,000 systems hit in Iran. One report links Stuxnet infection with the blow-out of an Indian TV satellite system back in July, the link being the use of SCADA systems from Siemens. Other reports suggest Russian sub-contractors from Siemens on the Bushehr plant job might have spread the infection when they went to work in other countries.

In the absence of hard facts about the worm all sorts of wild speculation and conspiracy theories have flourished, including a surprising volume of discussions linking Stuxnet to UFOs and even suggesting it might be a prelude to alien invasion*. Yup. It all ties back to harvested UFO tech from Roswell and, just as plausibly, the replacement of Paul McCartney by a stand-in all these years.

Back to reality

Back on planet Earth anti-virus firm F-Secure has compiled the best FAQ on Stuxnet that we've seen to date.

The Stuxnet worm was high on the agenda of presentations at the Virus Bulletin conference in Vancouver this week. Symantec ran a proof of concept demo of what code that had similar capabilities to Stuxnet could do to mess with the operation of a Siemens PLC SCADA test rig. The demo featured an air-pump connected to a controller, balloons, confetti and and explosion. Delegates were invited to imagine what might happen with a similarly compromised controller that was connected to an oil pipeline or (though this was not said) a centrifuge in a uranium processing plant. ®

Bootnote

*We're grateful to Vmyths's Rob Rosenberger for this observation.