Stuxnet like virus wiping the computers of Saudi Oil Companies.

[walker]

Hi all

In what appears to be yet another example of the increasing use of cyber warfare tools; computers in Saudi Arabian Oil companies are having their data copied then being systematicly wiped. Media sources are reasuring the public that oil suplies are safe. At first it was thought to be, and was infact claimed by hackers:

Saudi Aramco hit by computer virus
World's largest oil company says its operations have not been affected as hackers claim responsibility for attack

Charles Arthur
guardian.co.uk, Thursday 16 August 2012 22.34 BST

Hackers have claimed responsibility for the spread of a computer virus that forced the world's largest oil company, Saudi Aramco, to isolate its production systems from infected PC workstations inside the company.

It is still unclear whether the problem, which is thought to have affected thousands of the company's PCs, was the result of a hacker attack, a state-sponsored attack such as the Gauss or Stuxnet worms, or one of the millions of viruses found online.

In a statement on its Facebook page, the company said it had "isolated all its electronic systems from outside access as an early precautionary measure that was taken following a sudden disruption that affected some of the sectors of its electronic network"...

http://www.guardian.co.uk/technology...?newsfeed=true
As always follow the link to read the original article text in full.

But subsequent investigations have revealed that the program is transmiting as an automated virus not hacking:

Oil OK after cyberattack on Saudi Aramco
Published: Aug. 16, 2012 at 7:25 AM
RIYADH, Saudi Arabia, Aug. 16 (UPI)

There are no adverse effects on oil production following a cyberattack on the computer network at the Saudi Arabian Oil Co., the company said.

A computer virus entered the company's network through personal computers but the situation was secured and oil production wasn't disrupted because of the attack.

http://www.upi.com/Business_News/Ene...2241345116319/
As always follow the link to read the original article text in full.

The danger of a panic over oil prices is clearly formost in the minds of the media.

The problem with viral attacks is that every time you fire one off you are teaching the enemy new virus attack strategies and and methods. They can then just copy your weapon and then add their own little twist to it. And in these days of Rapid Application Development and Cloud Development new and more effective weapons can be available to your enemy in Days or even hours.

There are also reports of Power plants being targeted too:

Someone’s Trying To Shut Down Power Plants—With a Virus

Earlier this year, a devastating virus dubbed Flame made its way through power plants in Iran, wreaking havoc on system software, and prompting the country to disconnect itself from the internet. Now comes word from Kaspersky Labs that there's a copycat virus doing the same thing to "at least one organization in the energy sector."

Except this time, it's not coming from the government.
This new virus, sometimes referred to as Shamoon, sometimes referred to as Disttrack, contains a file named Wiper, which the Flame virus also has. But the Wiper file in Shamoon doesn't share the same code as the one in Flame, which is why experts suspect a copycat is at work...

http://gizmodo.com/5935647/is-a-scri...s-power-plants
As always follow the link to read the original article text in full.

I already warned that sending out Stuxnet and its cousins was just storing up problems for the future.

Worried Walker

[JdB]

I don't exactly understand why powerplants and other key facilities need internet access anyway, let alone having the core business communicate over the internet. The only reason I can think of for using the most open communication system in the world is saving money (or rather, increasing profit for the suits).

[Storic]

I don't exactly understand why powerplants and other key facilities need internet access anyway, let alone having the core business communicate over the internet. The only reason I can think of for using the most open communication system in the world is saving money (or rather, increasing profit for the suits).

They aren't hacked via direct internet access they are usually hacked via an infected USB or by someone opening an email attachment.

[RangerPL]

Generally the systems themselves aren't online, but they share a network with other computers which are.

A while ago I read about something like this... an automotive plant was shut down for a day at the cost of millions of dollars because one engineer brought in an infected laptop and connected it to the internal network. That's all it takes.

[walker]

Hi all

The thought occured to me that this may have been an after hacking, and getting the info, track wiping operation. In other words what people are seeing is what the perpertrators want them to see; the big nasty wiped drives but the probability is that the real attack had taken place and this just covered it up. Going to all this technical trouble and with the obvious knowledge it involves, it is very odd for the perpertrator not to have grabbed the available info. That oddness is mentioned in the articles I posted above, so I am not the only one remarking on it.

The fact that it is a program based on that capability and that steals info as its primary payload and that they have hacked into it to understand it and that the program details are available on the web and known, means the perpertrator knows how to do this. So knowing how effective that payload of the original cyber weapon on which it was based was, why would they not have used it?

If the perpertrators did use it then the consequences are serious.

The perpertrators may well have gained insider knowledge about oil deals and prices and be able to play the market with the knowledge they previously garnered but used the wipe program to cover their tracks. It is actualy a very common cyber attack profile.

If I were involved in investigating this and looking for the perpertrators I would be looking for unusual and large put options on the oil markets.

If I was involved in the oil markets I would extra vigilant and wary. In fact it may be safer NOT to be in the betting part of the oil market for the next few months, as if such data is compromised, then massive manipulation of the market would be relativley easy.

Kind Regards walker