4 ms·

How is it that the virus is like a "military-grade guided cyber missile" yet it is transferred by "memory stick"?

by aik 16y ago

aik 16y ago
Here's a much-less-sensationalist description (from symantec.com): Stuxnet infects Windows systems in its search for industrial control systems, often generically (but incorrectly) known as SCADA systems. Industrial control systems consist of Programmable Logic Controllers (PLCs), which can be thought of as mini-computers that can be programmed from a Windows system. These PLCs contain special code that controls the automation of industrial processes—for instance, to control machinery in a plant or a factory. Programmers use software (e.g., on a Windows PC) to create code and then upload their code to the PLCs. Previously, we reported that Stuxnet can steal code and design projects and also hide itself using a classic Windows rootkit, but unfortunately it can also do much more. Stuxnet has the ability to take advantage of the programming software to also upload its own code to the PLC in an industrial control system that is typically monitored by SCADA systems. In addition, Stuxnet then hides these code blocks, so when a programmer using an infected machine tries to view all of the code blocks on a PLC, they will not see the code injected by Stuxnet. Thus, Stuxnet isn’t just a rootkit that hides itself on Windows, but is the first publicly known rootkit that is able to hide injected code located on a PLC. In particular, Stuxnet hooks the programming software, which means that when someone uses the software to view code blocks on the PLC, the injected blocks are nowhere to be found. This is done by hooking enumeration, read, and write functions so that you can’t accidentally overwrite the hidden blocks as well. ... Fascinating: http://www.symantec.com/connect/blogs/stuxnet-introduces-first-known-rootkit-scada-devices http://www.symantec.com/connect/blogs/stuxnet-introduces-fir...
- spyder 16y ago
  Are they really running very critical systems on Windows? Yes, the are :( : http://www.neowin.net/news/nuclear-reactor-isnt-using-a-licensed-copy-of-windows http://www.neowin.net/news/nuclear-reactor-isnt-using-a-lice... And another related story from 2003: http://www.securityfocus.com/news/6767 http://www.securityfocus.com/news/6767
  - dfox 16y ago
    They are not. In almost any serious industrial automation application there are Windows computers, but they are only user interface to some backend system (that usually runs on some obscure virtual machine running in some even more obscure RTOS on very specialized hardware)

How is it that the virus is like a "military-grade guided cyber missile" yet it is transferred by "memory stick"?

by aik 16y ago

How is it that the virus is like a "military-grade guided cyber missile" yet it is transferred by "memory stick"?

aik 16y ago

Here's a much-less-sensationalist description (from symantec.com): Stuxnet infects Windows systems in its search for industrial control systems, often generically (but incorrectly) known as SCADA systems. Industrial control systems consist of Programmable Logic Controllers (PLCs), which can be thought of as mini-computers that can be programmed from a Windows system. These PLCs contain special code that controls the automation of industrial processes—for instance, to control machinery in a plant or a factory. Programmers use software (e.g., on a Windows PC) to create code and then upload their code to the PLCs. Previously, we reported that Stuxnet can steal code and design projects and also hide itself using a classic Windows rootkit, but unfortunately it can also do much more. Stuxnet has the ability to take advantage of the programming software to also upload its own code to the PLC in an industrial control system that is typically monitored by SCADA systems. In addition, Stuxnet then hides these code blocks, so when a programmer using an infected machine tries to view all of the code blocks on a PLC, they will not see the code injected by Stuxnet. Thus, Stuxnet isn’t just a rootkit that hides itself on Windows, but is the first publicly known rootkit that is able to hide injected code located on a PLC. In particular, Stuxnet hooks the programming software, which means that when someone uses the software to view code blocks on the PLC, the injected blocks are nowhere to be found. This is done by hooking enumeration, read, and write functions so that you can’t accidentally overwrite the hidden blocks as well. ... Fascinating: http://www.symantec.com/connect/blogs/stuxnet-introduces-first-known-rootkit-scada-devices http://www.symantec.com/connect/blogs/stuxnet-introduces-fir...

spyder 16y ago
Are they really running very critical systems on Windows? Yes, the are :( : http://www.neowin.net/news/nuclear-reactor-isnt-using-a-licensed-copy-of-windows http://www.neowin.net/news/nuclear-reactor-isnt-using-a-lice... And another related story from 2003: http://www.securityfocus.com/news/6767 http://www.securityfocus.com/news/6767
- dfox 16y ago
  They are not. In almost any serious industrial automation application there are Windows computers, but they are only user interface to some backend system (that usually runs on some obscure virtual machine running in some even more obscure RTOS on very specialized hardware)