Stuxnet - Revision history

DHomberg at 19:32, 18 December 2024

2024-12-18T19:32:17Z

← Older revision		Revision as of 19:32, 18 December 2024
Line 65:		Line 65:
	By the time Stuxnet was discovered, the scientists had to replace over 1.000 centrifuges and the cascades were only working at 45-65 percent. By September 2010, the researchers found out that about 100.000 computers worldwide had been infected. From these machines, over 60 percent were located in Iran, which gave researchers a good idea about the original target.		By the time Stuxnet was discovered, the scientists had to replace over 1.000 centrifuges and the cascades were only working at 45-65 percent. By September 2010, the researchers found out that about 100.000 computers worldwide had been infected. From these machines, over 60 percent were located in Iran, which gave researchers a good idea about the original target.

	=== Infection ~~Statistics~~ ===		=== Infection statistics ===

	After the discovery of Stuxnet, Symantec set up a System on July 20, 2010 to monitor traffic to the command and control servers. The hereby collected data allowed to observe rates of infections and the location of infected computers. Only traffic from computers which are able to connect to the C&C servers can be collected. While the data has shown approximately 100.000 infected hosts, 40.000 unique external IP addresses from over 155 countries could be observed. Approximately 60% of infected hosts were located in Iran:		After the discovery of Stuxnet, Symantec set up a System on July 20, 2010 to monitor traffic to the command and control servers. The hereby collected data allowed to observe rates of infections and the location of infected computers. Only traffic from computers which are able to connect to the C&C servers can be collected. While the data has shown approximately 100.000 infected hosts, 40.000 unique external IP addresses from over 155 countries could be observed. Approximately 60% of infected hosts were located in Iran:

DHomberg: /* Story of Stuxnet */

2024-12-18T19:29:26Z

Story of Stuxnet

← Older revision		Revision as of 19:29, 18 December 2024
Line 64:		Line 64:

	By the time Stuxnet was discovered, the scientists had to replace over 1.000 centrifuges and the cascades were only working at 45-65 percent. By September 2010, the researchers found out that about 100.000 computers worldwide had been infected. From these machines, over 60 percent were located in Iran, which gave researchers a good idea about the original target.		By the time Stuxnet was discovered, the scientists had to replace over 1.000 centrifuges and the cascades were only working at 45-65 percent. By September 2010, the researchers found out that about 100.000 computers worldwide had been infected. From these machines, over 60 percent were located in Iran, which gave researchers a good idea about the original target.

			=== Infection Statistics ===

			After the discovery of Stuxnet, Symantec set up a System on July 20, 2010 to monitor traffic to the command and control servers. The hereby collected data allowed to observe rates of infections and the location of infected computers. Only traffic from computers which are able to connect to the C&C servers can be collected. While the data has shown approximately 100.000 infected hosts, 40.000 unique external IP addresses from over 155 countries could be observed. Approximately 60% of infected hosts were located in Iran:

			{\| class="wikitable"
			\|-
			! Country
			! Share of infected computers
			\|-
			\| Iran
			\| 58.31%
			\|-
			\| Indonesia
			\| 17.83%
			\|-
			\| India
			\| 9.96%
			\|-
			\| Azerbaijan
			\| 3.40%
			\|-
			\| Pakistan
			\| 1.40%
			\|-
			\| Malaysia
			\| 1.16%
			\|-
			\| USA
			\| 0.89%
			\|-
			\| Uzbekistan
			\| 0.71%
			\|-
			\| Russia
			\| 0.61%
			\|-
			\| Great Britain
			\| 0.57%
			\|-
			\| Others
			\| 5.15%
			\|}

			The accumulation of infections indicate that Iran was the initial target of the attack as well as the country where infections were originally seeded. The data further supports the classification of Stuxnet as a targeted attack.

	=== Origins ===		=== Origins ===

MKeller: /* Summary */

2024-03-04T21:16:34Z

Summary

← Older revision		Revision as of 21:16, 4 March 2024
Line 1:		Line 1:
	== Summary ==		== Summary ==

	Stuxnet was the first known cyber weapon to be developed and utilized in an act of strategic sabotage (attacking SCADA systems). This led to a paradigm shift from the CIA triad (Confidentiality, Integrity, Authenticity/Availability), which focuses on data security, to physical system safety. Stuxnet's origin remains unclear, although there are numerous theories about who might have been responsible for the attack. It contains complex code, targeting a specific setup. A total of seven vulnerabilities were found (four of them zero day attacks) for propagating, hiding, taking over and executing. Further, it used two (stolen) signed certificates to make Windows believe its .dll files were legit. Unlike other worms or trojans it is quite huge and implements several programming languages. Interestingly it also has an “expiry date” where it would stop working. If not for coincidence it might have never been discovered.		Stuxnet was the first known cyber weapon to be developed and utilized in an act of strategic sabotage (attacking SCADA systems). This led to a paradigm shift from the CIA triad (Confidentiality, Integrity, Authenticity/Availability), which focuses on data security, to physical system safety. Stuxnet's origin remains unclear, although there are numerous theories about who might have been responsible for the attack. It contains complex code, targeting a specific setup. A total of seven vulnerabilities were found (four of them zero-day attacks) for propagating, hiding, taking over and executing. Further, it used two (stolen) signed certificates to make Windows believe its .dll files were legit. Unlike other worms or trojans it is quite huge and implements several programming languages. Interestingly, it also has an “expiry date” where it would stop working. If not for coincidence, it might have never been discovered.

	== Description ==		== Description ==

MKeller: /* Four Zero-Day Attacks */

2024-03-04T21:15:43Z

Four Zero-Day Attacks

← Older revision		Revision as of 21:15, 4 March 2024
Line 21:		Line 21:
	* Development of Stuxnet (according to various sources) required a team of five to ten programmers working full-time for at least six months		* Development of Stuxnet (according to various sources) required a team of five to ten programmers working full-time for at least six months

	=== Four ~~Zero~~-~~Day Attacks~~ ===		=== Four zero-day attacks ===

	Zero ~~Day Attacks~~ target vulnerabilities that have not yet been found and therefore also not been patched giving attackers huge advantages. Finding these vulnerabilities and developing working exploits costs a lot of time, money and human resources.		Zero-day attacks target vulnerabilities that have not yet been found and therefore also not been patched, giving attackers huge advantages. Finding these vulnerabilities and developing working exploits costs a lot of time, money and human resources.

	==== Replication ====		==== Replication ====

MKeller: /* Historical background */

2024-03-04T21:14:36Z

Historical background

← Older revision		Revision as of 21:14, 4 March 2024
Line 41:		Line 41:
	=== Historical background ===		=== Historical background ===

	In April 2006 Iran announced they have successfully enriched uranium refusing to give in to international demands to close its nuclear program.		In April 2006 Iran announced they have successfully enriched uranium, refusing to give in to international demands to close its nuclear program.
	From February to November 2007 about 3000 new centrifuges were installed in Natanz, a uranium enrichment plant. In the same year the US Congress released $400 million for covert operations called "Olympic Games" against Iran´s nuclear program as Israel felt threatened by it due to their proximity to Iran. After Israel threatened physical violence, the US knew they had to find a solution.		From February to November 2007 about 3000 new centrifuges were installed in Natanz, a uranium enrichment plant. In the same year the US Congress released $400 million for covert operations called "Olympic Games" against Iran´s nuclear program as Israel felt threatened by it due to their proximity to Iran. After Israel threatened physical violence, the US knew they had to find a solution.

	In 2008, Israel requested assistance from the US for an airstrike on Natanz. However, US leaders were concerned that this action could escalate into a larger conflict. Given the political climate at the time, the US did not want to engage in another war. This is why they thought about sabotaging Iran with them knowing it.		In 2008, Israel requested assistance from the US for an airstrike on Natanz. However, US leaders were concerned that this action could escalate into a larger conflict. Given the political climate at the time, the US did not want to engage in another war. This is why they thought about sabotaging Iran with them knowing it.

	Throughout 2009 the number of centrifuges at Natanz was increased to 8700. On at least one occasion President Ahmadinejad proudly led a tour through the facility, providing videos and images of control rooms and centrifuges to the world.		Throughout 2009 the number of centrifuges at Natanz was increased to 8700. On at least one occasion, President Ahmadinejad proudly led a tour through the facility, providing videos and images of control rooms and centrifuges to the world.

	Early 2010 the IAEA (International Atomic Energy Agency) inspectors that periodically visited Natanz, noticed a huge number of centrifuges being replaced.		Early 2010 the IAEA (International Atomic Energy Agency) inspectors that periodically visited Natanz, noticed a huge number of centrifuges being replaced.
	Later that year Stuxnet was discovered and with it the cause for the failing centrifuges.		Later that year, Stuxnet was discovered and with it the cause for the failing centrifuges.

	Centrifuges were important for the development of nuclear weapons because they can spin at a rapid speed to separate different isotopes of uranium.		Centrifuges were important for the development of nuclear weapons because they can spin at a rapid speed to separate different isotopes of uranium.

MKeller: /* Discovery */

2024-03-04T21:13:29Z

Discovery

← Older revision		Revision as of 21:13, 4 March 2024
Line 57:		Line 57:
	The first person to encounter what was later known as Stuxnet was Sergey Ulason at VirusBlokAda, Belarus in June 2010. One of their customers in Iran contacted them because their computer kept crashing.		The first person to encounter what was later known as Stuxnet was Sergey Ulason at VirusBlokAda, Belarus in June 2010. One of their customers in Iran contacted them because their computer kept crashing.

	Ulason and his colleagues discovered several interesting factors about the malware they were presented with including the replication methods, the ability to hide in other processes and the usage of stolen certificates to legitimize to antivirus programs and Windows security.		Ulason and his colleagues discovered several interesting factors about the malware they were presented with, including the replication methods, the ability to hide in other processes and the usage of stolen certificates to legitimize to antivirus programs and Windows security.

	They contacted Microsoft and RealTek to inform them about their discovery. As neither of the companies reacted, they finally posted their findings online but it took a blog article by Brian Krebs on KrebsOnSecurity.com to gain attention.		They contacted Microsoft and RealTek to inform them about their discovery. As neither of the companies reacted, they finally posted their findings online, but it took a blog article by Brian Krebs on KrebsOnSecurity.com to gain attention.

	Symantec started their own research on Stuxnet as it was be then named. Also Ralph Langner, a German cybersecurity specialist and expert on industrial control systems, turned his attention on Stuxnet. He found clues that it targeted a specific environment and only two Siemens PLC models.		Symantec started their own research on Stuxnet as it was to be then named. Also, Ralph Langner, a German cybersecurity specialist and expert on industrial control systems, turned his attention on Stuxnet. He found clues that it targeted a specific environment and only two Siemens PLC models.

	By the time Stuxnet was discovered, the scientists had to replace over 1.000 centrifuges and the cascades were only working at 45-65 percent. By September 2010, the researchers found out that about 100.000 computers worldwide had been infected. From these machines, over 60 percent were located in Iran which gave researchers a good idea about the original target.		By the time Stuxnet was discovered, the scientists had to replace over 1.000 centrifuges and the cascades were only working at 45-65 percent. By September 2010, the researchers found out that about 100.000 computers worldwide had been infected. From these machines, over 60 percent were located in Iran, which gave researchers a good idea about the original target.

	=== Origins ===		=== Origins ===

MKeller: /* Propagation */

2024-03-04T21:10:49Z

Propagation

← Older revision		Revision as of 21:10, 4 March 2024
Line 72:		Line 72:
	== Propagation ==		== Propagation ==

	Stuxnet can spread in a variety of ways, as shown in the Figure "Stuxnet Propagation". Stuxnet spreads by infecting removable drives and copying itself over the network using a variety of means, including two Zero-Day exploits. Stuxnet also spreads by copying itself into Step 7 projects using a technique that causes Stuxnet to run automatically when the project is opened. This section introduces the distribution routines via the network, removable drive and the Step-7 projects.		Stuxnet can spread in a variety of ways, as shown in the Figure "Stuxnet Propagation". Stuxnet spreads by infecting removable drives and copying itself over the network using a variety of means, including two Zero-Day exploits. Stuxnet also spreads by copying itself into Step 7 projects, using a technique that causes Stuxnet to run automatically when the project is opened. This section introduces the distribution routines via the network, removable drive and the Step-7 projects.

	[[File: Stuxnet_propagation.png\|400px\|thumb\|right\|Stuxnet Propagation]]		[[File: Stuxnet_propagation.png\|400px\|thumb\|right\|Stuxnet Propagation]]

MKeller: /* Origins */

2024-03-04T21:10:22Z

Origins

← Older revision		Revision as of 21:10, 4 March 2024
Line 68:		Line 68:

	Both evidence and motive indicate that the US and Israel were involved in the attack, as they have the financial means and human resources. Additionally, both countries maintain research facilities that could have been used to test the malware on the same setup as found in Natanz.		Both evidence and motive indicate that the US and Israel were involved in the attack, as they have the financial means and human resources. Additionally, both countries maintain research facilities that could have been used to test the malware on the same setup as found in Natanz.
	Other sources even mention China and Russia. However, neither of these states admitted any involvement. Even Iran denies that the closure of Natanz happened as a consequence of a ~~cyber attack~~.		Other sources even mention China and Russia. However, neither of these states admitted any involvement. Even Iran denies that the closure of Natanz happened as a consequence of a cyberattack.

	== Propagation ==		== Propagation ==

MKeller: /* Zero-Day-Exploit in print-spooler MS10-061 */

2024-03-04T21:08:38Z

Zero-Day-Exploit in print-spooler MS10-061

← Older revision		Revision as of 21:08, 4 March 2024
Line 96:		Line 96:
	==== Zero-Day-Exploit in print-spooler MS10-061<ref name="MS_PrintSpooler"/> ====		==== Zero-Day-Exploit in print-spooler MS10-061<ref name="MS_PrintSpooler"/> ====

	This zero-day exploit was unique in that it had been discovered prior to its use by the creators of Stuxnet. Information along with source code had been published in a Polish security magazine in April 2009. However, the information about this vulnerability never reached Microsoft which made it possible for Stuxnet creators to use it to spread the virus within a network. It has later been patched by Microsoft. It was also the only zero-day found in the first version of Stuxnet.		This zero-day exploit was unique in that it had been discovered prior to its use by the creators of Stuxnet. Information along with source code had been published in a Polish security magazine in April 2009. However, the information about this vulnerability never reached Microsoft, which made it possible for Stuxnet creators to use it to spread the virus within a network. It has later been patched by Microsoft. It was also the only zero-day found in the first version of Stuxnet.

	This zero-day made any system which had shared print rights in a network vulnerable. It allowed a remote user to copy files into the Windows %SYSTEM% directory, to which users have no access. There were two phases to this exploit. It first went through the injection phase, where a dropper and the files “winsta.exe” and “sysnullevent.mof” are copied into the directory. It did that by improperly impersonating a client who sent the two files to be printed to files in the directory.		This zero-day made any system which had shared print rights in a network vulnerable. It allowed a remote user to copy files into the Windows %SYSTEM% directory, to which users have no access. There were two phases to this exploit. It first went through the injection phase, where a dropper and the files “winsta.exe” and “sysnullevent.mof” are copied into the directory. It did that by improperly impersonating a client who sent the two files to be printed to files in the directory.

MKeller: /* Zero-Day-Exploit in print-spooler MS10-061 */

2024-03-04T21:07:29Z

Zero-Day-Exploit in print-spooler MS10-061

← Older revision		Revision as of 21:07, 4 March 2024
Line 96:		Line 96:
	==== Zero-Day-Exploit in print-spooler MS10-061<ref name="MS_PrintSpooler"/> ====		==== Zero-Day-Exploit in print-spooler MS10-061<ref name="MS_PrintSpooler"/> ====

	This ~~exploit was special kind of~~ zero-day in that it had been ~~found before~~ the creators of Stuxnet ~~used it~~. Information along with source code had been published in a Polish security magazine in April 2009. However, the information about this vulnerability never reached Microsoft which made it possible for Stuxnet creators to use it to spread the virus within a network. It has later been patched by Microsoft. It was also the only zero-day found in the first version of Stuxnet.		This zero-day exploit was unique in that it had been discovered prior to its use by the creators of Stuxnet. Information along with source code had been published in a Polish security magazine in April 2009. However, the information about this vulnerability never reached Microsoft which made it possible for Stuxnet creators to use it to spread the virus within a network. It has later been patched by Microsoft. It was also the only zero-day found in the first version of Stuxnet.

	This zero-day made any system which had shared print rights in a network vulnerable. It allowed a remote user to copy files into the Windows %SYSTEM% directory to which users have no access. There were two phases to this exploit. It first went through the injection phase where a dropper and the files “winsta.exe” and “sysnullevent.mof” are copied into the directory. It did that by improperly impersonating a client who sent the two files to be printed to files in the directory.		This zero-day made any system which had shared print rights in a network vulnerable. It allowed a remote user to copy files into the Windows %SYSTEM% directory, to which users have no access. There were two phases to this exploit. It first went through the injection phase, where a dropper and the files “winsta.exe” and “sysnullevent.mof” are copied into the directory. It did that by improperly impersonating a client who sent the two files to be printed to files in the directory.

	The execution phase then triggered these two files. A dropper is a malicious program that is designed to spread malware other computers. In the execution phase, the sysnullevent.mof file was used. This was a Managed Object Format or MOF for short and it is used to create or register providers or events. This file also ran the winst.exe file which would result in the infection of the system.		The execution phase then triggered these two files. A dropper is a malicious program that is designed to spread malware to other computers. In the execution phase, the sysnullevent.mof file was used. This was a Managed Object Format or MOF for short, and it is used to create or register providers or events. This file also ran the winst.exe file, which would result in the infection of the system.

	==== SMB vulnerability MS08-067 <ref name=MS_SMB/> ====		==== SMB vulnerability MS08-067 <ref name=MS_SMB/> ====