CMIT 320 Network Security Paper Elizabeth Flaim

This attack was specifically intended to slow down the productions of their Nuclear Power Facility. Cripple Iran enough to buy the United States more “peace”. Unfornatetly STUXNET is more powerful then intended and many areas outside of Natanz were hit. Subsequently following the attack on Iran, it was stated that “1,000 IR-1 centrifuges”

Stuxnet, is considered the world’s first cyber weapon. Stuxnet may have not run its full course as initially planned as there are 3 main parts and a couple of encrypted files within the code that have not yet been cracked and may never be cracked, but it succeeded in becoming the first cyber weapon. What was the desired end result for Stuxnet? It is hard to imagine that Stuxnet was written only to destroy some centrifuges and slow the pace of Iran’s ability to build a nuclear weapons.

Another occurrence of cyberwarfare and its power lies within the Stuxnet worm, unleashed primarily to attack Iranian industrial programmable logic controllers (PLCs) in the nation’s Nuclear facilities. The Stuxnet worm is typically introduced to its target environment via an infected USB flash drive, and upon being loaded onto a computer running the Microsoft Windows operating system the worm would then seek out Siemens Step7 software. This software will then allow for Stuxnet to control Iranian PLCs, collecting information on industrial systems and causing the fast-spinning centrifuges to tear themselves apart. Stuxnet’s complexity is evident in its three prong approach to infection: It unloads a worm that executes all routines related to the main attack, it executes a link file that automatically activates other copies of the worm on the same network, and it activates its rootkit, which allows it to hide its processes and activity on the local computer as well as the entire computer network. Kaspersky Lab, an international software security group operating in almost 200 countries and territories worldwide, concluded that the attack “is a one-of-a-kind, sophisticated malware attack backed by a well-funded, highly skilled attack team” and that the “attack could only be conducted with nation-state support and backing”. In May 2011, the PBS program Need To Know cited a statement by Gary Samore, White House Coordinator for Arms Control and Weapons of Mass Destruction, in which

The first article I found gave me a better foundation for what the (Polymorphic) Worm is, where it targets and how it spreads. This particular worm spread using the internet and targeting Internet Security Systems (ISS) buffer overflows. This ISS attack using overflow is the same type of breach we practiced in one of our previous assignments this semester. The article titled "The spread of the Witty worm" discusses what it looks for and how it accesses the Internet Security Systems. Using the ISS path the Worm takes advantage of a security flaw in the firewall applications. Once breached the worm then uploads its "payload contained in a phrase, (^,^) insert witty message here (^, ^)." (Moore, 2004) This article addressed several of my concerns how what, and where? With the what? The article talks about once infected could it be removed. The report also covers where the worm goes for a suggesting a random destination within the hard drive taken over and eventually rendering the entire machine

The rapid proliferation of malware and sophisticated computer viruses capable of electronically interrupting and dismantling nuclear sites, key elements of infrastructure to the Programmable Logic Controller device level while "learning" or accumulating knowledge at the same time is becoming more pervasive. The well-known Stuxnet worm, which experts theorize was originally funded and supported technologically by one or more nations to attack Iran's Bushehr reactor (Greengard, 2010) is one of the most strategically lethal cyberweapons in existence today. What makes the Stuxnet worm so lethal is its ability to traverse and navigate Supervisory Control and Data Acquisition (SCADA) networks, targeting specific devices and programmable controllers down to the manufacturer and operational block level (Network Security, 2010). The Stuxnet worm is widely believed to be designed to quickly navigate the Microsoft-based platform of the Iranian Bushehr reactor and disable it from operating, as this nation is widely believed to be using the reactor to produce uranium for their weapons program (Network Security, 2010). The stealth-like nature and speed of the Stuxnet worm has also been problematic to catch even in controlled SCADA-based infrastructure systems. The level of sophistication of this threat is at a level not seen before by many organizations and national security agencies (Greengard, 2010). The intent of

The Stuxnet is a computer worm, “it is a digital ghost with countless lines of code… it was able to worm its way into Iran’s nuclear fuel enrichment facility in Natanz, Iran” (Clarke, 2012). A worm is a program that spreads copies of itself through a network and a worm can also spread copies of itself as a stand-alone program (Pfleeger & Pfleeger, 2007).

Discovered in June of 2010, a computer worm called Stuxnet was designed to attack programmable-logic controllers or PLCs that are used to control switches and values in industries that operate a specific type of on Siemens PLC device using Step7 software running on a Windows operating system. The worm was successful because it was able to exploit a of four zero-day flaw of Windows operating system. Stuxnet

In May of 2017, any computer that was running a Microsoft Windows operating system was under attack worldwide by a ransomware cryptoworm known as WannaCry. When it hit the targeted computers, it would encrypt the data and demand a ransom payment in Bitcoin. Bitcoin is a worldwide cryptocurrency and digital payment system. Within a day of the first attack it was estimated to have infected more than 230,000 computers in over 150 countries. The attack was worldwide and ranged from health services to Fed Ex. Marcus Hutchins is a British computer security researcher who is known for finding a way to halt WannaCry. He found that the malware was connected to a specific domain and the “kill switch” was hard coded into the malware.

Such concerns have generally involved the infiltration of a computer system for purposes of degrading its capabilities, manipulating data, or using the device to launch cyber attacks on other systems. The Stuxnet worm, 3 which was first reported in June 2010 by a security firm in Belarus, appears to be the first malicious software (malware) designed specifically to attack a particular type of ICS: one that controls nuclear plants, whether for power or uranium enrichment. The malware attacks and disrupts a Microsoft Windows-based application that is employed by a particular ICS produced by the German company Siemens. 4 The worm can be spread through an air-gapped network by a removable device, such as a thumb drive, and possibly through computers connected to the Internet, and it is often capable of remaining hidden from detection. It is difficult to determine the geographic origin of the malware, as cyber attackers often employ

The sophisticated techniques of hackers that are used to infiltrate computers through e mail, are now being adapted to help hackers send virus files or Trojan Horse programs to IM users or capture a user’s list of IM buddies. These files are called Application Programming Interfaces (APIs) which can be purchased from major suppliers and used to create an IM worm.

A Supervisory Control and Data Acquisition (SCADA) system consists of both hardware and software that collects critical information to keep a facility operating (Johnson & Merkow, 2011, p. 227). SCADA system vulnerabilities include the lack of monitoring, slow updates, lack of knowledge about devices, not understanding traffic, and authentication holes (Adams, 2015). When an organization doesn’t monitor the network, it makes it impossible to notice suspicious activity. System updates are a very important part of protecting against vulnerabilities, even though it may be seen as an inconvenience. The lack of knowledge about the devices is somewhat due to the fact that the SCADA systems change over time. Therefore,

MSC.BAT was used to initialize the persistent installation of the other two binaries, NTLHAFD.GCP and NTSVCHOST.EXE, and cleanup the installation. A Windows registry Autorun key was set to provide persistence. NTLHAFD.GCP was the backdoor and was encrypted with RC4 stream cipher and compressed using the Zlib library (GReAT, 2013a). Before executing the decryption and memory load routines, the loader, NTSVCHOST.EXE, first attempted to connect to legitimate Microsoft domains (update.microsoft.com, www.microsoft.com, and support.microsoft.com) to determine if the victim computer was able to route to the internet. If the infected computer was not online, the loader would not decrypt the backdoor, NTLHAFD.GCP. When online, the loader would execute the decryption and memory load routines, and the backdoor would communicate periodically with the designated Command-and-Control server. From an antivirus perspective, the backdoor that was on disk was encrypted, and the more nefarious code was only in its unencrypted form while in memory. In order to reverse engineer the malware, it required either connecting to the internet or tricking the malware into believing it was on the internet.

Worms occupy a computer but run a file created unambiguously to run a spiteful code and doesn’t appear on the user’s desktop as it runs in the “background” which is comparable to how spell check runs in the background of a word. Worms cam specifically only spread through connections to the internet which is unrelated to the virus.

So they built a large horse and presented it to the Trojans as a gift, which the Trojans accepted. Hidden inside the gigantic horse was a small army of Greek soldiers. During the night, the soldiers dismounted and quickly gained control of key defenses, allowing the rest of the Greek army to invade the previously invulnerable city of Troy. Just as in the myth, Trojan horse programs allow unauthorized users access to a computer system. While viruses and worms usually carry a payload, Trojan horses usually do not. Payloads are the part of the malicious code that modify, erase, or leak information from a system. They may also alter the state of a system, by displaying a simple undesired screen or causing programs to crash or behave abnormally. The lifecycle of viruses and worms is to infect as many systems or files as possible, and then to execute its payload at a predetermined trigger. The trigger may be a time or system event. Trojans, on the other hand, allow unauthorized, anonymous access to information systems. Another type of threat that is becoming increasingly popular is malicious code hybrids. Hybrids use a combination of virus, worm, and Trojan techniques; virus techniques for self-replication, worm techniques for rapid propagation over the Internet, and Trojan techniques for remote system compromise. Today, hybrids represent a growing threat because of their increasing sophistication and multiple propagation

A computer worm is a program that self-propagates across a network exploiting security or policy flaws in widely-used services. The first computer worm widely spread in 1988. Typically, worm can be divided to different class based on different factors. Such as target discovery, carrier, activation, payloads, and attackers. There are some successful multi-modal worms; however it is still based on the specific method mentioned above.