O.T. Computer virus in Iran targets PLCs

[LadderLogic]

Let's assume the most dramatic possibility - that someone is deliberately trying to cause serious damage to the iranian nuclear power plant.

Would messing with PLC code be enough to cause... I don't know, improper operation of the reactor control rods? Aren't there supposed to be other means of protection?

I don't know much about nuclear plants, could someone please enlighten?

 

[Jeebs]

There are several safety features outside the PLC's control.
Yet screwing around with how the PLC works might be all they were after.
Stalling the building, stalling the start-up, preventing the system from functioning, etc etc etc.
No need to blow it up, just preventing it from working is good enough I guess.

 

[Saperov]

Let's assume the most dramatic possibility - that someone is deliberately trying to cause serious damage to the iranian nuclear power plant.

Would messing with PLC code be enough to cause... I don't know, improper operation of the reactor control rods? Aren't there supposed to be other means of protection?

I don't know much about nuclear plants, could someone please enlighten?

Equipment for Nuclear Power Plant
http://translate.google.com/transla...81:2008-04-02-19-11-44&catid=38:npp&Itemid=63

 

[Eric Nelson]

I don't know if it was mentioned here or not, but Steve Gibson talked about this worm in Episode 266 of "Security Now" (LINK). The discussion starts at 24 minutes, 36 seconds into the show.



-Eric

 

[Saperov]

0-day vulnerabilities...

wrong terminology
Most "0-day vulnerabilities" is realy = 15-years vulnerabilities of Windows (from W95/1995 to W7/2009)

 

[TurpoUrpo]

wrong terminology
Most "0-day vulnerabilities" is realy = 15-years vulnerabilities of Windows (from W95/1995 to W7/2009)

I like the term of 0-day vulnerability, I think it describes it well.

 

[Saperov]

That's the real threat Stuxnet poses for all of us.
It provides a blueprint for aggressive attacks on control systems that can be applied generically.
Depending on where you live, such very same control systems may control the power plant that provides your electricity, the water utility that provides your water, the factory where you work in, and the traffic lights you see on your way home.
The technology how to manipulate all such systems is now on the street, and don't be so naive to assume that nobody would take advantage of it.
...

We have already seen this in the "Live Free or Die Hard 4" 2007/06/27.

Wait Die Hard 5

 

[Saperov]

Misinformation and false tracks

If operation Myrtus had failed because some geniuses in Hamburg, Germany figured out the plot too early....

Myrtus operation was discovered, because some genius in VirusBlokAda (Belarus) found this virus in flash from Iran!

When Ralph told a reporter from BBC Worldwide that presently, perhaps ten people on the globe would be able to invent and implement this attack vector, and three of them could be found in Langner's office,
the reporter was smart enough to ask: Did you do it?
No, we didn't.
But the guy got the point here...

A tale for unscientific journalists...
You send a consequence of a false trail.
Write such a code for the controller to a few thousand programmers.
Change firmware code (Language microprocessor C165) can hundreds of former professionals from Siemens and VIPA.
Some sort of anti-virus can detect the virus in the controller firmware or in the computer BIOS ?
This trend is dangerous.
In the last year in the forums Frequently asked questions - simultaneously died two redundant CPU S7-414H/S7-417H in one assembly! (System of high reliability with cost 15000...30000 Euro for CPUs assembly)
Cause of death unknown.
May accidentally got the wrong infected firmware processors?
I think that the attack was more complex - much remains unknown.
It's time to return to a proven solution as a hardware key on the face of processor: RUN/RUN-P(Programming).

How about ?

For bombing needed new Monica L. with marks on the dress

 

[Steve Bailey]

Uhhh Saperov,

You do realize that Langner is not posting to this forum don't you?

 

[ydtech]

Some new data

http://www.theregister.co.uk/2010/11/15/stuxnet_jigsaw_completed/
http://www.symantec.com/connect/blogs/stuxnet-breakthrough

Looks like they're targeting the enrichment plant. Can anyone confirm the bit about export restrictions on high speed VFDs?

 

[Saperov]

http://www.theregister.co.uk/2010/11/15/stuxnet_jigsaw_completed/
http://www.symantec.com/connect/blogs/stuxnet-breakthrough

Looks like they're targeting the enrichment plant.
Can anyone confirm the bit about export restrictions on high speed VFDs?

No.
You can buy Altivar 71 0...1000 Hz
http://www.schneider-electric.com/s...ffer/range-presentation.page?p_range_id=1155#

400 Hz is military standard, therefore, all the engines at this frequency is much more expensive.

http://www.symantec.com/connect/blogs/stuxnet-breakthrough show
what Stuxnet can destroy any simple Simatic S7 system when start.
In example - Symantec use old S7-315 2DP with 1 SM digital I/O and OB1 with one network (1 timer T and 1 output Q).
No Profibus, no CP342! But we see the explosion of the ball.
Is true Stuxnet or it is Symantec Hollywood ?

 

[Eric Nelson]

I don't know if it was mentioned here or not, but Steve Gibson talked about this worm in Episode 266 of "Security Now" (LINK). The discussion starts at 24 minutes, 36 seconds into the show.

Just as a followup, they discussed it again in this weeks episode. Jump to the 18 minutes, 40 seconds mark.

http://twit.tv/sn275

From the show notes:

• Symantec has been continuing to reverse engineer Stuxnet

• It is now looking highly likely it was targeted at Iranian nuclear power plants

• Only targets "specific frequency-converter drives" - power supplies used to control the speed of devices such as motors.

• Stuxnet intercepts commands to vary the speed wildly, but intermittently.

• Doesn’t sabotage just any frequency converter. It inventories a plant’s network and only springs to life if the plant has at least 33 frequency converter drives made by Fararo Paya in Teheran, Iran, or by "Vacon" in Finland.

• Only targets frequency drives from these two companies that are running at high speeds — between 807 Hz and 1210 Hz. Such high speeds are used only for select applications.

• Symantec, who has continued to perform the analysis is careful not to say that Stuxnet was targeting a nuclear facility, but notes that “frequency converter drives that output over 600 Hz are regulated for export in the United States by the Nuclear Regulatory Commission as they can be used for uranium enrichment.”

-Eric

 

[LadderLogic]

The Grey Old Lady tells it all: http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html

 

[Peter Nachtwey]

Interesting

http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html

 

[allscott]

http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html

Very interesting. Thaks for the link, interesting read.