Kill timer found in Shamoon malware suggests possible connection to Saudi Aramco attack
Shamoon's disk-wiping functionality was set to activate at the exact time when hackers claim to have attacked Saudi Aramco
IDG News Service - A timer found in the Shamoon cyber-sabotage malware discovered last week matches the exact time and date when a hacktivist group claims to have disabled thousands of computers from the network of Saudi Aramco, the national oil company of Saudi Arabia.
"We penetrated a system of Aramco company by using the hacked systems in several countries and then sent a malicious virus to destroy thirty thousand computers networked in this company," a group called the "Cutting Sword of Justice" said in a Pastebin post on Aug. 15. "The destruction operations began on Wednesday, Aug 15, 2012 at 11:08 AM (Local time in Saudi Arabia) and will be completed within a few hours."
That same day, Saudi Aramco confirmed that some sectors of its computer network were affected by a computer virus that infected workstations used by its employees. However, the incident did not affect the oil production operations in any way, Aramco said at the time.
The news was followed by announcements from several antivirus vendors, including Symantec, McAfee and Kaspersky Lab, about the discovery of a new destructive piece of malware called Shamoon or Disttrack.
Shamoon contains a so-called wiper module designed to overwrite files from certain directories and the hard disk drive's Master Boot Record (MBR) -- a special region of the disk that contains information about its partitions.
Given the similarities between Shamoon's functionality and the hacktivist group's description of the Aramco attack, there is speculation that the malware might be responsible for the Saudi Arabian company's recent computer problems.
Some other bits of information also pointed in this direction, like Symantec's statement that the malware was used in a targeted attack against an unnamed organization from the energy sector or that a path string found inside the malware included a directory called "ArabianGulf."
However, the most convincing piece of evidence found so far consists of a timer that activates the malware's file and MBR wiping functionality.
"The dropper determines whether a specified date has come or not," Kaspersky Lab researcher Dmitry Tarakanov said Tuesday in a blog post. "The hardcoded date is 15th August 2012 08:08 UTC."
This coincides with the exact time and date when the "Cutting Sword of Justice" hackers claimed the so-called destruction of Aramco computers began -- Wednesday, Aug 15, 2012, at 11:08 a.m. local time in Saudi Arabia (UTC+3:00).
"This is only one indication that the events could possibly be related, and that's only if the Pastebin posting is legitimate," Kaspersky Lab chief security expert Alexander Gostev said Thursday via email. "At this time there is not enough concrete evidence to connect the two events."
- New docs show DHS was more worried about critical infrastructure flaw in '07 than it let on
- Needed: Breach detection correction
- Evan Schuman: Resurrection of Full Disclosure mailing list is great news, if you're not a cyberthief
- Cyberattacks could paralyze U.S., former defense chief warns
- Syrian Electronic Army shanghais Microsoft's Twitter account, blog
- Is French outrage against U.S. spying misplaced?
- Lawmakers seek answers on Obamacare Data Hub security
- China-based hacking group behind hundreds of attacks on U.S. companies
- How to Prepare for a Potential Syrian Counterattack on the U.S. Power Grid
- New York Times site outage caused by attack on domain registrar, company says
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- Improving IT Efficiencies: Four Advantages of Multi-Tenant Data Centers Increasing demands on IT are forcing organizations to rethink their data center options. For many organizations, that means turning to the flexibility afforded...
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Malware and Vulnerabilities White Papers | Webcasts