EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

11.18.10

Eye on Security: BBC Propaganda, Rootkits, and Stuxnet in Iran’s Nuclear Facilities

Posted in Microsoft, Security, Windows at 3:01 pm by Dr. Roy Schestowitz

Sadeh fire festival

Summary: Some of the latest security news which affects only Windows users (or people whom Windows is using)

HERE are some security news picks from the past week.

MSBBC

Not a week goes by without some BBC propaganda such as this. Since many former Microsoft UK employees took leading positions in the BBC, new articles like this neglect to mention major facts like the scary story only referring to Windows and not computers by and large (BBC Click is encouraging similar narrow-mindedness right now).

“BBC’s usual high standards: no mention of MS Windows,” wrote Glyn Moody in response to it. Gordon from TechBytes wrote: “Yet another Windows only story “forgetting” to mention either “Microsoft” or “Windows” #fail !BBC” (he claims to have had a “deja-vu, found another the other day“).

Ask the BBC to call out Windows and thus inform the public. “Computer” is not the same as “Microsoft Windows” and taxpayers who fund the BBC deserve to know this.

The rest of the security news is tediously repetitive (yet new), so we just add it below categorised.

Rootkit

i. More Layers, Please

M$ has put many coats of paint on the old barn to secure that other OS but the malware writers have discovered a way to alter the MBR data so that rebooting turns off some of the layers of protection. The result is rootkits on the beloved 64bit “7″. Fortunately, our 64bit machines run Debian GNU/Linux. You need physical access to the machine or root access to alter the MBR with GNU/Linux. That other OS provides the tools by default… The modifications to UAC after the Vista fiasco opened the door to this rootkit. Malware artists have been going through this door since August.

ii. Rootkit able to bypass kernel protection and driver signing in 64-bit Windows

The 64-bit version of the Alureon rootkit / bot is able to bypass the special security features included in the 64-bit versions of Windows 7 and Vista and insert itself into the system. The tricks used have been known about in theory for several years, but until recently had not been used by malware in the wild. The 32-bit version of Alureon made headlines early this year, when the installation of a Microsoft patch left many systems unable to boot. The problem was caused by the previously unnoticed presence of the rootkit, which the patch effectively unmasked.

The 64-bit version of Alureon (aka. TDL) deactivates checks for driver signing and, even during the boot process, reroutes specific API calls in order to bypass the kernel’s PatchGuard mechanism. Driver signing is intended to ensure that Windows only loads drivers from known vendors. PatchGuard is intended to protect the operating system kernel from being modified by malicious code.

Stuxnet

i. Stuxnet has a double payload

According to the latest analysis, Stuxnet is aimed not at disrupting a single system, but at two different systems. According to control systems security firm Langner Communications, the worm is not just designed to interfere with specific, variable frequency, motor control systems – it also attempts to disrupt turbine control systems. According to Langner, this would mean that, in addition to Iran’s uranium enrichment plant at Natanz, the country’s Bushehr nuclear power plant may have been a further target of the Stuxnet attack.

Specialists have been puzzling over the worm’s target for several weeks, with early rumours circulating that it was aimed at sabotaging Natanz or Bushehr. However, no-one initially suspected that its aim was to sabotage both plants, although clues that this might be the case have been emerging for some time. Stuxnet attacks Siemens control system types S7-300 (315) and S7-400 (417). The attack modules appear to have been created using different tools – probably even by different teams.

The code for the S7-417 system – used in the turbine control systems at Bushehr – is reported to be much more sophisticated than that for the S7-315 system. The code carries out what amounts to a man-in-the-middle attack in order to pass fake input and output values to the genuine plant control code. User code running on a programmable logic controller (PLC) does not usually query I / O ports directly, but instead reads from an input process image and writes to an output process image. Mapping of physical ports to logical ports is intended to ensure that I / O values do not change during processing cycles.

ii. Stuxnet virus could target many industries (from AP, copyright maximalist and fair use squasher)

A malicious computer attack that appears to target Iran’s nuclear plants can be modified to wreak havoc on industrial control systems around the world, and represents the most dire cyberthreat known to industry, government officials and experts said Wednesday.

They warned that industries are becoming increasingly vulnerable to the so-called Stuxnet worm as they merge networks and computer systems to increase efficiency. The growing danger, said lawmakers, makes it imperative that Congress move on legislation that would expand government controls and set requirements to make systems safer.

iii. Stuxnet Was Designed To Subtly Interfere With Uranium Enrichment

“Wired is reporting that the Stuxnet worm was apparently designed to subtly interfere with uranium enrichment by periodically speeding or slowing specific frequency converter drives spinning between 807Hz and 1210Hz. The goal was not to cause a major malfunction (which would be quickly noticed), but rather to degrade the quality of the enriched uranium to the point where much of it wouldn’t be useful in atomic weapons. Statistics from 2009 show that the number of enriched centrifuges operational in Iran mysteriously declined from about 4,700 to about 3,900 at around the time the worm was spreading in Iran.”

iv. Clues Suggest Stuxnet Virus Was Built for Subtle Nuclear Sabotage

The malware, however, doesn’t sabotage just any frequency converter. It inventories a plant’s network and only springs to life if the plant has at least 33 frequency converter drives made by Fararo Paya in Teheran, Iran, or by the Finland-based Vacon.

Even more specifically, Stuxnet targets only frequency drives from these two companies that are running at high speeds — between 807 Hz and 1210 Hz. Such high speeds are used only for select applications. Symantec is careful not to say definitively that Stuxnet was targeting a nuclear facility, but notes that “frequency converter drives that output over 600 Hz are regulated for export in the United States by the Nuclear Regulatory Commission as they can be used for uranium enrichment.”

“There’s only a limited number of circumstances where you would want something to spin that quickly -– such as in uranium enrichment,” said O Murchu. “I imagine there are not too many countries outside of Iran that are using an Iranian device. I can’t imagine any facility in the U.S. using an Iranian device,” he added.

More links about Stuxnet:

  1. Ralph Langner Says Windows Malware Possibly Designed to Derail Iran’s Nuclear Programme
  2. Windows Viruses Can be Politically Motivated Sometimes
  3. Who Needs Windows Back Doors When It’s So Insecure?
  4. Windows Insecurity Becomes a Political Issue
  5. Windows, Stuxnet, and Public Stoning
  6. Stuxnet Grows Beyond Siemens-Windows Infections
  7. Has BP Already Abandoned Windows?
  8. Reports: Apple to Charge for (Security) Updates
  9. Windows Viruses Can be Politically Motivated Sometimes
  10. New Flaw in Windows Facilitates More DDOS Attacks
  11. Siemens is Bad for Industry, Partly Due to Microsoft
  12. Microsoft Security Issues in The British Press, Vista and Vista 7 No Panacea
  13. Microsoft’s Negligence in Patching (Worst Amongst All Companies) to Blame for Stuxnet
  14. Microsoft Software: a Darwin Test for Incompetence
  15. Bad September for Microsoft Security, Symantec Buyout Rumours
  16. Microsoft Claims Credit for Failing in Security
  17. Many Windows Servers Being Abandoned; Minnesota Goes the Opposite Direction by Giving Microsoft Its Data
  18. Windows Users Still Under Attack From Stuxnet, Halo, and Zeus
  19. Security Propaganda From Microsoft: Villains Become Heroes
  20. Security Problems in iOS and Windows

Messenger

i. Microsoft disables Live Messenger links

According to the Vole’s blog, disabling the feature was designed to prevent the spread of a malicious worm.

The worm requires users to click a link within a message, upon which it will load a webpage that downloads the worm to your PC and then it sends the same message to people in your contact list.

It only affected those who had not upgraded to the newest version of Messenger that uses Microsoft’s Smartscreen, which shows up when you click on any link shared via Messenger.

A spokesperson said that the malicious worm was trying to spread itself through many of the world’s largest instant messaging and social networks, including Windows Live Messenger 2009.

Windows will never be secure. “Our products just aren’t engineered for security,” said Brian Valentine, one of the top Windows executive at the time.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email
  • Google Bookmarks
  • Ask
  • Digg
  • Mixx
  • Slashdot
  • StumbleUpon
  • Alltagz
  • BarraPunto
  • blinkbits
  • BlinkList
  • Bloglines
  • blogmarks
  • BlogMemes
  • Fark
  • Gwar
  • Klickts

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

2 Comments

  1. twitter said,

    November 20, 2010 at 1:35 pm

    Gravatar

    Some shameful Microsoft propaganda about botnets was promoted by Slashdot the day you published this roundup. There might be some interesting statistics in the report, but the analysis and conclusions are crazy. The first indication of cluelessness is that the paper was written with Microsoft word so the PDF is of low quality, lacks hyperlinks and has sorry graphics. The word “Windows” appears nowhere in the 67 page paper and the researchers seem to be oblivious to OS choice as an explanation to their findings or as a solution to the problem. Their central finding was:

    all ISPs harbor infected machines – ‘bots’ – in their networks. …Of the tens of thousands of ISPs that provide Internet access, the 200 ISPs that collectively hold nearly 90 percent of the total market share in the wider OECD area account for more than 60 percent of all infected machines worldwide. Other service providers, such as hosting providers, university networks, corporate networks and application service providers contain a smaller share of all bots.

    This, for some reason, surprises them and they then use it to conclude that ISPs should police their users who they must assume are all Windows users. It is obvious to anyone without Microsoft blinders that the reason hosting providers, universities, educated people have less of a botnet problem is that people who know what they are doing steer away from Windows. From false assumptions come incorrect projections and recommendations. The authors should be ashamed of themselves for not looking at OS dependency and the technical nature of their survey should be closely studied by anyone who would like to use any of the statistics reported.

    Freedom is the real solution to the botnet problem, not the kind of anti-competitive “security” that Microsoft would like to inflict on ISPs.

    Dr. Roy Schestowitz Reply:

    Thanks. You’ve reminded me that I should make a quick new post about GNU/Linux installed base.

What Else is New


  1. Twist and Turn, Show Us Your Face

    A little poem about digital privacy



  2. The Race to the Bottom of Tech Rights

    Tech rights (not to be confused with Techrights the site) are going down the drain; people are made complicit using fear tactics, having been told a lot of lies about so-called contact-tracing borderline pseudoscience



  3. [Humour/Meme] OIN Wants Us to Make Peace With Software Patents

    The way things stand, OIN is really not interested in solving the patent problem the Free software way; rather, it's looking to impose its own way on the Free software community



  4. The Last Thing Open Invention Network (OIN) Needs Right Now is Public Association With a Patent Trolls' and Software Patents' Propaganda Site

    The Open Invention Network (OIN) seems to be choosing rather odd platforms; the above publisher, a judge-bashing software patents extremist, cannot possibly improve OIN's image (by association)



  5. The EPO's Misleading 'Studies' Are Just More of the Same Perception Management Routines

    EPO management pays sites to publish a bunch of EPO-controlled propaganda; and we've meanwhile noticed that almost everyone in the press team of the EPO has left (to be replaced by the President's confidant)



  6. Links 14/7/2020: More Laptop Models With GNU/Linux and WordPress 5.5 Beta 2 is Out

    Links for the day



  7. Microsoft Has Not Changed at All (Only the Shallow Marketing and Control of What's Left of the Media Has Changed)

    Microsoft wants everybody to come closer so that everybody can be crushed; the tactics are largely the same



  8. The Founder of Black Duck Still Works for Microsoft

    Black Duck‘s founder, Doug Levin from Microsoft, isn’t doing a terrific job hiding his real loyalties and ‘masters’



  9. IRC Proceedings: Monday, July 13, 2020

    IRC logs for Monday, July 13, 2020



  10. Links 14/7/2020: Claws Mail 3.17.6 and RSS Guard 3.7.0 Released

    Links for the day



  11. Microsoft Has Put the String “0xBIGBOOBS” Inside Linux (Kernel Driver for Microsoft's Windows-Only Proprietary Software, Formerly a GPL Violation); Reddit (Condé Nast) Bans You For Mentioning Such Things

    In this increasingly crazy atmosphere of mass sanctioning and permanent banning (removing everything or everyone that's perceived to be impolite) even "Linux" forums are banning people who point out Microsoft being a rogue corporation that's attacking GNU/Linux



  12. There's Apparently a New Boss (or Policy) at Red Hat/IBM

    The Fedora project doesn’t seem to care much about free speech, no matter one’s seniority in the project; as the person who relayed it to us has just put it, “they even eat their own.” (Longtime contributors) “He’s not a troll. He’s a contributor who rubbed some people the wrong way and now the banhammer is coming out. Fedora KDE was already collapsing and now it finally will.” (Note: Rex Dieter leads or led this project)



  13. There Cannot be Software Freedom Without Free Speech (Which is Nowadays Being Wrongly and Creatively Conflated With Racism)

    The time to speak out in favour of free speech is now; because the next phase typically involves removal (to be sold as "voluntary") of people whose political views are seen as professionally inadequate (recall what they did to Richard Stallman last September)



  14. [Humour/Meme] 'Offensive' Jokes

    Even humour itself is under attack now; people who cannot take/tolerate cartoons and banter are targeting the stand-up comedians, the cartoonists and so on



  15. The Media Does Not Like Talking About Linux (Which It Doesn't Understand Anyway). It Makes the News All About Linus.

    Just like back in May (or every other week) the news about Linux itself is being ignored and the subject is getting personified to make Linux seem rude and unruly



  16. Links 13/7/2020: Linux 5.8 RC5, Qt Creator Beta, Mexico Threatens GNU/Linux

    Links for the day



  17. [Humour/Meme] Embrace, Extend, and Curl

    The Curl project, a high-profile prisoner of GitHub, is again being 'embraced' by Microsoft (which already controls the project through GitHub)



  18. IRC Proceedings: Sunday, July 12, 2020

    IRC logs for Sunday, July 12, 2020



  19. [Humour/Meme] Half a Decade Has Passed and EPO Management Was Never Held Accountable for Illegal Surveillance

    A lot of people may no longer remember it, but the EPO can break privacy laws — as it still routinely does — with no consequences whatsoever



  20. Cleaning the Code

    War must go on; but it'll be more diverse and inclusive



  21. Why We Care About (Mis)Use of Language in Technology

    Software development communities are being divided over issues that would likely not tackle actual racism in any meaningful and profound way (just a symbolic way)



  22. Links 12/7/2020: KF6 Progress Report, GNUnet 0.13.1, Nano Becomes Default Terminal Text Editor in Fedora

    Links for the day



  23. They Always Worked for Microsoft (Directly and Indirectly) and Were Financially Rewarded for That

    Nat and Miguel, now put in charge of new weapons against software freedom (e.g. GitHub and NPM), have long worked for Microsoft (Nat was also an intern there); Techrights was right all along about this pair



  24. Red Hat Betrayed the Free Software Community With Its Software Patents' Stockpiling Drive and Then a Sale to the Biggest Software Patents Lobbyist

    In 2020 Red Hat is little but a shadow of IBM, whose patent policy continues to threaten software freedom and whose lobbying for software patents (under the guise of "HEY HI") persists uninterrupted; this growing problem oughtn't be unspeakable



  25. Politically Correct Tech

    This new video entitled “Politically Correct Tech” covers a topic we’ve spoken a great deal about



  26. [Humour/Meme] High on Production, Stoned on Pseudoscience

    All-time high ‘production’ levels at the European Patent Office (EPO) do not mean what they want people to think and what they try hard to hide



  27. Missing From EPO Management: Actual Scientists

    Political figures and opportunists with connections occupy top positions at top European agencies; this assures self-destructive policies that diminish progress and cushion corruption



  28. All Software Should Come With a Cheat Mode

    Cheat modes are useful for developers because they enable debugging, and are sometimes called "Debug mode"



  29. Linus Torvalds Checks If It's Still Inclusive Enough to 'Bash' Bad Technology (of the Company Whose TPM Pusher Has Just Successfully Pushed to Remove Many Words)

    In the age of endless control of language (e.g. large corporations pushing for "inclusive" language whilst earning billions from bombing of 'inferior' countries) we see that it is still possible to condemn corporations on technical grounds (at least if you’re Linus Torvalds)



  30. Even Before Microsoft Paid ('Joined') the Linux Foundation Jim Zemlin Had a Preference for Microsofters

    Even years before the Linux Foundation was receiving money from Microsoft it had a tendency to hire Microsoft’s people for key positions (a lot of people no longer remember that, but it’s still in the public record; it was Jim Zemlin who approached if not chased Mr. Ramji to offer him the job and the colleagues saw no problem with that)


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts