Stuxnet Worm

Let’s say user (A) download an execution file (EXE) on his-her PC and double click on that file, if this file is infected the virus works based on the written code by the hacker/ attacker/ intruder and copy some files into the system. In case, user (A) does not have virus protection, the virus works perfect in destroying that computer or sending information from this computer to the attacker email. Viruses not only designed to destroy PC’s, but also designed to get information from

We will first look at some known flaws in Windows 7 and Windows 8. An Information Security Engineer at Google had decided to reveal a flaw that affected two of Microsoft’s newest operating systems that allowed attackers to obtain higher privileges on an unpatched computer. The vulnerability was caused due to an error within the ‘win32k.sys’ when it processes

Certification of Authorship: I certify that I am the author of this paper and that any assistance I received in its preparation is fully acknowledged and disclosed in the paper. I have also cited any sources from which I used data, ideas, or words, either quoted directly or paraphrased. I also certify that this paper was prepared by me specifically for the purpose of this assignment.

Ralph Langner’s article on the Stuxnet worm discusses the hardware, distribution and targets of the attack. He also goes into detail regarding the outlook of future attacks and what we can do to prevent them.

As such, he introduces a technique of identifying a spectrum of potential vulnerabilities and suggests procedures to deal with them. Systems Specification and High Order Language Implementation are categorized as items of high risk to attacks. Security Policy and Machine Language Implementation are classified as items of moderate risk of being vulnerable to attacks. Circuits Electronics and Device Physics are of low and very low risks respectively. He also discusses potential threats such as deceiving operating systems to grant access to file or data to unauthorized users through direct (overt) and indirect (convert) channels. Walker also says that lack of precise definition of trusted operating systems and the higher cost of building them are the significant drawbacks faced by the vendors. Vendors are concerned that if they build trusted operating systems, they might not be accepted by their customers. The only solution suggested by the author was to have someone or a company builds it, shares the technology used, and convinces the general public on the significance of it. Once it becomes accepted, then there will be a widespread use of trusted computer operating systems.

Each year there are many attempts to illegal gain entry into networks by attackers to steal information. Some attacks are designed to steal information while other may be to attack a system to cause damage or disrupt services. Attack can happen from anywhere in the world due to the internet and networks. A person from China can hack into an American network or such Stuxnet virus attack on Iran nuclear power plan which thought to be from Israel or United States but it is unsure where the virus originated from. According to Merkow & Breithaupt (2006), viruses caused the greatest financial loss over other computer crimes, (p 142). Worm is a type of virus which replicates and can easily infect a machine and then spread out across the network by using transport features of the computer or network.

Liam O’Murchu a seasoned veteran from Symantec happened to take a look at Stuxnet and found it to be worth delving into. Stuxnet

Supervisory Control and Data Acquisition System Network systems (SCADA), Distributed Control System (DCS) and Industrial Control Systems (ICS) are examples of controlling their Critical Infrastructure. Because once the hackers are able to gain access to the SCADA Network system and sabotage the system, then the Critical Infrastructure would lead to cyberwar and chaos.

Another occurrence of cyberwarfare and its power lies within the Stuxnet worm, unleashed primarily to attack Iranian industrial programmable logic controllers (PLCs) in the nation’s Nuclear facilities. The Stuxnet worm is typically introduced to its target environment via an infected USB flash drive, and upon being loaded onto a computer running the Microsoft Windows operating system the worm would then seek out Siemens Step7 software. This software will then allow for Stuxnet to control Iranian PLCs, collecting information on industrial systems and causing the fast-spinning centrifuges to tear themselves apart. Stuxnet’s complexity is evident in its three prong approach to infection: It unloads a worm that executes all routines related to the main attack, it executes a link file that automatically activates other copies of the worm on the same network, and it activates its rootkit, which allows it to hide its processes and activity on the local computer as well as the entire computer network. Kaspersky Lab, an international software security group operating in almost 200 countries and territories worldwide, concluded that the attack “is a one-of-a-kind, sophisticated malware attack backed by a well-funded, highly skilled attack team” and that the “attack could only be conducted with nation-state support and backing”. In May 2011, the PBS program Need To Know cited a statement by Gary Samore, White House Coordinator for Arms Control and Weapons of Mass Destruction, in which

Two of the common known attacks on computing systems are the deployment of computer viruses and malware.

In his article, Is “Stuxnet” the best malware ever? Gregg Keizer of Computer World says:

Just like a biological virus, a computer virus is able to infect and ruin lives. This malicious software constitutes more than just simple viruses but also includes other types of software including worms, Trojan horses, and ransomware. Malware has been around since the late 1980’s. Originally, people became hackers to gain notoriety online, but today, it has become more of a business. Cyber attacks originate from all around the world, and it is not just individual people that benefit from it. In two decades, numerous cyber crime syndicates have been created, and states all over the world sponsor hacker groups. Over the past twenty-five years, malware has become less about checking the integrity of computer security and gaining notoriety in the underground cyber society, and it has become more of a chaos creating, money making business that many people and institutions take part in.

The use of the malicious software is one of the most common implementation methods which is often referred to as Trojan. Sometimes, the administrators of systems have their systems accessed without their knowledge and consent using malicious codes known as Trojan horses. Their execution involves sending them to the user or even placing them directly into the system. Most of the times, the users will not realize that these are Trojans. For the Trojan to ensure that it is not detected by the firewall during the time of execution,

Network viruses are another favorite method of cyber criminals. As we all know, viruses can bring a network to

Trojan in the computer world is a program that can permeate the whole system without victim’s awareness. The Trojan runs in the victim system, like a spy that sneaks into enemy and opens back door for other kinds of attacks. This is like the Trojan strategy in real war, so the program is called “Trojan Horse” or “Trojan”. Trojan usually includes two executable programs: client and server. The Trojan that hides in the victim system is the server, and the so-called “hacker” uses the client as the control terminal. Once the server runs, it will open one or more ports on the victim system, initiating contact with the client and