Kill timer found in Shamoon malware suggests possible connection to Saudi Aramco attack

IDG News Service - A timer found in the Shamoon cyber-sabotage malware discovered last week matches the exact time and date when a hacktivist group claims to have disabled thousands of computers from the network of Saudi Aramco, the national oil company of Saudi Arabia.

"We penetrated a system of Aramco company by using the hacked systems in several countries and then sent a malicious virus to destroy thirty thousand computers networked in this company," a group called the "Cutting Sword of Justice" said in a Pastebin post on Aug. 15. "The destruction operations began on Wednesday, Aug 15, 2012 at 11:08 AM (Local time in Saudi Arabia) and will be completed within a few hours."

That same day, Saudi Aramco confirmed that some sectors of its computer network were affected by a computer virus that infected workstations used by its employees. However, the incident did not affect the oil production operations in any way, Aramco said at the time.

The news was followed by announcements from several antivirus vendors, including Symantec, McAfee and Kaspersky Lab, about the discovery of a new destructive piece of malware called Shamoon or Disttrack.

Shamoon contains a so-called wiper module designed to overwrite files from certain directories and the hard disk drive's Master Boot Record (MBR) -- a special region of the disk that contains information about its partitions.

Given the similarities between Shamoon's functionality and the hacktivist group's description of the Aramco attack, there is speculation that the malware might be responsible for the Saudi Arabian company's recent computer problems.

Some other bits of information also pointed in this direction, like Symantec's statement that the malware was used in a targeted attack against an unnamed organization from the energy sector or that a path string found inside the malware included a directory called "ArabianGulf."

However, the most convincing piece of evidence found so far consists of a timer that activates the malware's file and MBR wiping functionality.

"The dropper determines whether a specified date has come or not," Kaspersky Lab researcher Dmitry Tarakanov said Tuesday in a blog post. "The hardcoded date is 15th August 2012 08:08 UTC."

This coincides with the exact time and date when the "Cutting Sword of Justice" hackers claimed the so-called destruction of Aramco computers began -- Wednesday, Aug 15, 2012, at 11:08 a.m. local time in Saudi Arabia (UTC+3:00).

"This is only one indication that the events could possibly be related, and that's only if the Pastebin posting is legitimate," Kaspersky Lab chief security expert Alexander Gostev said Thursday via email. "At this time there is not enough concrete evidence to connect the two events."