Why did Stuxnet worm spread?
Propagation hints that first attack failed, say researchers
Computerworld - Stuxnet's inability to stay stealthy may be fall-out from a failure to hit its intended targets last year, security researchers said today.
The worm, which was designed to infiltrate heavy-duty industrial control programs that monitor and manage factories, oil pipelines, power plants and other critical installations, only popped onto researchers' radars this summer, nearly a year after it was likely first launched.
"Obviously, it spread beyond its intended target or targets," said Roel Schouwenberg, a senior antivirus researcher at Kaspersky Lab, one of the two security companies that has spent the most time analyzing Stuxnet.
Most researchers have agreed that Stuxnet's sophistication -- they've called it "groundbreaking" -- means that it was almost certainly built by a well-financed, high-powered team backed by a government. The worm's probable target was Iran, possibly the systems in its budding nuclear power program.
Earlier this week, Iranian officials acknowledged that tens of thousands of Windows PCs had been infected with Stuxnet, including some in place at a nuclear power plant in southwestern Iran. They have denied that the attack had damaged any facilities, however, or that Stuxnet contributed to well-known delays in the reactor's construction.
But if Stuxnet was aimed at a specific target list, why has it spread to thousands of PCs outside Iran, in countries as far flung as China and Germany, Kazakhstan and Indonesia?
"That's something we find puzzling," said Liam O Murchu, operations manager with Symantec's security response, and a co-author of a paper that analyzed the worm's code.
Even though the Stuxnet makers obviously included measures to limit its spread, something went amiss, O Murchu said.
The original infection method, which relied on infected USB drives, included a counter that limited the spread to just three PCs, said O Murchu. "It's clear that the attackers did not want Stuxnet to spread very far," he said. "They wanted it to remain close to the original infection point."
O Murchu's research also found a 21-day propagation window; in other words, the worm would migrate to other machines in a network only for three weeks before calling it quits.
Those anti-propagation measures notwithstanding, Stuxnet has spread widely. Why?
Kaspersky's Schouwenberg believes it's because the initial attack, which relied on infected USB drives, failed to do what Stuxnet's makers wanted.
"My guess is that the first variant didn't achieve its target," said Schouwenberg, referring to the worm's 2009 version that lacked the more aggressive propagation mechanisms, including multiple Windows zero-day vulnerabilities. "So they went on to create a more sophisticated version to reach their target."
That more complex edition, which O Murchu said was developed in March of this year, was the one that "got all the attention," according to Schouwenberg. But the earlier edition had already been at work for months by then -- and even longer before a little-known antivirus vendor from Belarus first found it in June. "The first version didn't spread enough, and so Stuxnet's creators took a gamble, and abandoned the idea of making it stealthy," said Schouwenberg.
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!