The Virus Event
Mike Williams
Dr. James Wilson

Abstract

The world’s most complex malware ever created, the Stuxnet virus which was designed and enforced by the U.S. and Israel against Iran a few years ago, may have ended up infecting the International Space Station according to leading security analyst Eugene Kaspersky head of IT security at Kaspersky Labs. The virus was designed to only attack specific software and specific hardware in a specific uranium enrichment plant at Natanz, Iran. Stuxnet, however, isn’t at all specific on the targets it infects – basically it’s all over the world. It’s been long thought that only a country or organization with vasts amounts of resources could develop a virus of Stuxnet’s complexity. Last year, the Obama administration stepped out and confirmed that indeed the virus was made as a joint-operation with Israel against Iran, to nobody’s surprise frankly. A leftover from the Bush administration, Stuxnet operations were accelerated during Obama’s presidency and eventually launched against Iran.

How the virus works and propagated itself onto servers
It primarily spreads via USB sticks, which allows it to get into computers and networks not normally connected to the Internet. Once inside a network, it uses a variety of mechanisms to propagate to other machines within that network and gain privilege once it has infected those machines. These mechanisms include both known and patched vulnerabilities, and four “zero-day exploits”: vulnerabilities that were unknown and unpatched when the worm was released. (All the infection vulnerabilities have since been patched.) Stuxnet also acted like a rootkit – hiding its actions and its presence. It was the first virus to include code to attack Supervisory Control and Data Acquisition (SCADA) systems. Discovered by Sergey Ulasen in June, 2010, was at the time working for a small Belarus anti-virus company (VirusBlokAda). One of their customers in Iran had been experiencing a number of BSOD failures and wanted help finding the cause.
Research into that problem led to the discovery of the virus. The Stuxnet version discovered in June, 2010 initially spread through flash drives. *.lnk file on flash drive identifies a reference to a file (expected to be an icon). However, no test to verify, was used to reference a file on the flash drive that contained the virus. The virus was also able to propagate through P2P. Some of the machines expected to be network isolated, but might have access to infected machines through the use of RPC were discovered as having being infected. The infection process starts with 2 threads used to infect the logic controllers (PLCs). Then the first thread checks for candidate PLC files every 15 minutes. If it finds a candidate file, it infects it with one of two similar by unique infection sequences (A or B). The second thread monitors the PLCs, looking for a specific system data block (SBD) injected by the first thread. When the infected PLC’s begins its attack, this second thread contacts all other infected PLCs to coordinate the attack.
Graphic depiction of how the virus was able to replicate

Common Vulnerabilities for other utility companies

Utilities have two networks, a production network and a corporate network. The production systems are supposed to be kept off line. An industry practice known as creating an ‘air gap’ – so they aren’t vulnerable to viruses distributed via the Internet. But experts and industry officials say the risk of an cyber attack is nonetheless a great concern. They say these “air gaps” can be hopped if the two systems use common computer peripherals, such as printers or USB sticks, or if the production networks use public networks to send alerts. And while utilities follow industry standards regarding security, even industry officials admit these standards are not sufficient safeguards against the most significant threats.
Elements of the control infrastructure sometimes need to be updated, which can create a scenario in which workers bring in code and connect potentially compromised computers. Lax internal securities behind the firewall are also common vulnerabilities. Some networks have strong firewalls that protect their perimeter, but insufficient internal boundaries. In those cases, hackers who manage to penetrate a firewall can move around inside of an organization with relative impunity. Shared network gear and peripherals make it possible for production and corporate networks to share network routers. They also might share peripherals like faxes, scanners and printers, which can be connected to the Internet, creating a potential entry point for hackers.
People can move laptops, thumb drives and other devices and storage media from the corporate network to the control network. This may be forbidden by policy, but it may happen in practice. It is possible to build in protections so that computers assigned to a corporate network can’t work on a production network, but such defenses aren’t always put in place. Vulnerable supply chains are also a concern with utility companies. The hardware and software that companies use to build the control networks may not be safe, especially given the fact that economic pressures drive utilities to find the lowest cost provider. Some SCADA networks are connected directly to the Internet. Researchers have found thousands of industrial control systems that can be accessed from the Internet, according to a report from the Department of Homeland Security. DHS has set out to notify utilities when their systems are discovered online. If control systems send out status alerts to workers using devices that are connected to the Internet, those alerts can be used by hackers to gain access to a SCADA system.

Secure Coding efforts and practices to Mitigate Vulnerabilities

It’s key to always understand the developers' approach before starting a secure code review, talk to the developers and understand their approaches to mechanisms like authentication and data validation. Information gathered during this discussion can help jump-start the review and significantly decrease the time a reviewer spends trying to understand the code. If possible, use both manual and automated techniques for the review because each method to help find vulnerabilities that the other doesn't. In addition, try to use more than one automated tool because the strengths of each differ and complement the others.
Do not assess level of risk. Secure coding should not attempt to make judgments about what is acceptable risk. The review team should report what risk and vulnerabilities that are discovered. The customer uses the program's approved risk assessment plan to assess risk and decide whether to accept it or not. Focus on the big picture. When performing a manual review, resist trying to understand the details of every line of code. Instead, gain an understanding of what the code as a whole is doing and then focus the review on important areas, such as functions that handle login or interactions with a database. Leverage automated tools to get details on specific flaws.
It’s also good practice to focus on the big picture. When looking to mitigate risks in the review, you should resist trying to understand the details of every line of code. Instead, it’s best to gain an understanding of what the code as a whole is doing and then focus the review on important areas, such as functions that handle login or interactions with a database. Being able to leverage automated tools, to get details on specific flaws will ensure many risks that are discovered can be mitigated in an acceptable timeframe. Follow up on review points. After a review, hold a follow-up discussion with the development team to help them understand what the findings mean and how to address them. Stick to the intent of the review. Secure code review is not penetration testing. Review teams should not be allowed to "pen-test" a running version of the code because it can bias the results by giving a false sense of completeness

References

Forbes. (2014).The Story Behind The Stuxnet . Retrieved March 8, 2014 from http://www.forbes.com/2010/10/06/iran-nuclear-computer-technology-security-stuxnet-worm.html

Intelligent Utility. (2013).The Rise of Critical Infrastructure . Retrieved March 7, 2014 from http://www.intelligentutility.com/article/13/08/rise-critical-infrastructure-attacks-understanding-privileged-connection-and-common-thread

MITRE. (2013). Systems Engineering Guide. Retrieved March 5, 2014 from http://www.mitre.org/publications/systems-engineering-guide/enterprise-engineering/systems-engineering-for-mission-assurance/secure-code-review

ZME Science. (2013).The Stuxnet Virus that Crippled . Retrieved March 9, 2014 from http://www.zmescience.com/research/discoveries/stuxnet-virus-iran-internationa-space-station-05443/