Bonum Certa Men Certa

Eye on Security: BBC Propaganda, Rootkits, and Stuxnet in Iran's Nuclear Facilities

Sadeh fire festival



Summary: Some of the latest security news which affects only Windows users (or people whom Windows is using)

HERE are some security news picks from the past week.



MSBBC



Not a week goes by without some BBC propaganda such as this. Since many former Microsoft UK employees took leading positions in the BBC, new articles like this neglect to mention major facts like the scary story only referring to Windows and not computers by and large (BBC Click is encouraging similar narrow-mindedness right now).

"BBC's usual high standards: no mention of MS Windows," wrote Glyn Moody in response to it. Gordon from TechBytes wrote: "Yet another Windows only story "forgetting" to mention either "Microsoft" or "Windows" #fail !BBC" (he claims to have had a "deja-vu, found another the other day").

Ask the BBC to call out Windows and thus inform the public. "Computer" is not the same as "Microsoft Windows" and taxpayers who fund the BBC deserve to know this.

The rest of the security news is tediously repetitive (yet new), so we just add it below categorised.

Rootkit



i. More Layers, Please

M$ has put many coats of paint on the old barn to secure that other OS but the malware writers have discovered a way to alter the MBR data so that rebooting turns off some of the layers of protection. The result is rootkits on the beloved 64bit “7″. Fortunately, our 64bit machines run Debian GNU/Linux. You need physical access to the machine or root access to alter the MBR with GNU/Linux. That other OS provides the tools by default… The modifications to UAC after the Vista fiasco opened the door to this rootkit. Malware artists have been going through this door since August.


ii. Rootkit able to bypass kernel protection and driver signing in 64-bit Windows

The 64-bit version of the Alureon rootkit / bot is able to bypass the special security features included in the 64-bit versions of Windows 7 and Vista and insert itself into the system. The tricks used have been known about in theory for several years, but until recently had not been used by malware in the wild. The 32-bit version of Alureon made headlines early this year, when the installation of a Microsoft patch left many systems unable to boot. The problem was caused by the previously unnoticed presence of the rootkit, which the patch effectively unmasked.

The 64-bit version of Alureon (aka. TDL) deactivates checks for driver signing and, even during the boot process, reroutes specific API calls in order to bypass the kernel's PatchGuard mechanism. Driver signing is intended to ensure that Windows only loads drivers from known vendors. PatchGuard is intended to protect the operating system kernel from being modified by malicious code.


Stuxnet



i. Stuxnet has a double payload

According to the latest analysis, Stuxnet is aimed not at disrupting a single system, but at two different systems. According to control systems security firm Langner Communications, the worm is not just designed to interfere with specific, variable frequency, motor control systems – it also attempts to disrupt turbine control systems. According to Langner, this would mean that, in addition to Iran's uranium enrichment plant at Natanz, the country's Bushehr nuclear power plant may have been a further target of the Stuxnet attack.

Specialists have been puzzling over the worm's target for several weeks, with early rumours circulating that it was aimed at sabotaging Natanz or Bushehr. However, no-one initially suspected that its aim was to sabotage both plants, although clues that this might be the case have been emerging for some time. Stuxnet attacks Siemens control system types S7-300 (315) and S7-400 (417). The attack modules appear to have been created using different tools – probably even by different teams.

The code for the S7-417 system – used in the turbine control systems at Bushehr – is reported to be much more sophisticated than that for the S7-315 system. The code carries out what amounts to a man-in-the-middle attack in order to pass fake input and output values to the genuine plant control code. User code running on a programmable logic controller (PLC) does not usually query I / O ports directly, but instead reads from an input process image and writes to an output process image. Mapping of physical ports to logical ports is intended to ensure that I / O values do not change during processing cycles.


ii. Stuxnet virus could target many industries (from AP, copyright maximalist and fair use squasher)

A malicious computer attack that appears to target Iran's nuclear plants can be modified to wreak havoc on industrial control systems around the world, and represents the most dire cyberthreat known to industry, government officials and experts said Wednesday.

They warned that industries are becoming increasingly vulnerable to the so-called Stuxnet worm as they merge networks and computer systems to increase efficiency. The growing danger, said lawmakers, makes it imperative that Congress move on legislation that would expand government controls and set requirements to make systems safer.


iii. Stuxnet Was Designed To Subtly Interfere With Uranium Enrichment

"Wired is reporting that the Stuxnet worm was apparently designed to subtly interfere with uranium enrichment by periodically speeding or slowing specific frequency converter drives spinning between 807Hz and 1210Hz. The goal was not to cause a major malfunction (which would be quickly noticed), but rather to degrade the quality of the enriched uranium to the point where much of it wouldn't be useful in atomic weapons. Statistics from 2009 show that the number of enriched centrifuges operational in Iran mysteriously declined from about 4,700 to about 3,900 at around the time the worm was spreading in Iran."


iv. Clues Suggest Stuxnet Virus Was Built for Subtle Nuclear Sabotage

The malware, however, doesn’t sabotage just any frequency converter. It inventories a plant’s network and only springs to life if the plant has at least 33 frequency converter drives made by Fararo Paya in Teheran, Iran, or by the Finland-based Vacon.

Even more specifically, Stuxnet targets only frequency drives from these two companies that are running at high speeds — between 807 Hz and 1210 Hz. Such high speeds are used only for select applications. Symantec is careful not to say definitively that Stuxnet was targeting a nuclear facility, but notes that “frequency converter drives that output over 600 Hz are regulated for export in the United States by the Nuclear Regulatory Commission as they can be used for uranium enrichment.”

“There’s only a limited number of circumstances where you would want something to spin that quickly -– such as in uranium enrichment,” said O Murchu. “I imagine there are not too many countries outside of Iran that are using an Iranian device. I can’t imagine any facility in the U.S. using an Iranian device,” he added.


More links about Stuxnet:

  1. Ralph Langner Says Windows Malware Possibly Designed to Derail Iran's Nuclear Programme
  2. Windows Viruses Can be Politically Motivated Sometimes
  3. Who Needs Windows Back Doors When It's So Insecure?
  4. Windows Insecurity Becomes a Political Issue
  5. Windows, Stuxnet, and Public Stoning
  6. Stuxnet Grows Beyond Siemens-Windows Infections
  7. Has BP Already Abandoned Windows?
  8. Reports: Apple to Charge for (Security) Updates
  9. Windows Viruses Can be Politically Motivated Sometimes
  10. New Flaw in Windows Facilitates More DDOS Attacks
  11. Siemens is Bad for Industry, Partly Due to Microsoft
  12. Microsoft Security Issues in The British Press, Vista and Vista 7 No Panacea
  13. Microsoft's Negligence in Patching (Worst Amongst All Companies) to Blame for Stuxnet
  14. Microsoft Software: a Darwin Test for Incompetence
  15. Bad September for Microsoft Security, Symantec Buyout Rumours
  16. Microsoft Claims Credit for Failing in Security
  17. Many Windows Servers Being Abandoned; Minnesota Goes the Opposite Direction by Giving Microsoft Its Data
  18. Windows Users Still Under Attack From Stuxnet, Halo, and Zeus
  19. Security Propaganda From Microsoft: Villains Become Heroes
  20. Security Problems in iOS and Windows


Messenger



i. Microsoft disables Live Messenger links

According to the Vole's blog, disabling the feature was designed to prevent the spread of a malicious worm.

The worm requires users to click a link within a message, upon which it will load a webpage that downloads the worm to your PC and then it sends the same message to people in your contact list.

It only affected those who had not upgraded to the newest version of Messenger that uses Microsoft's Smartscreen, which shows up when you click on any link shared via Messenger.

A spokesperson said that the malicious worm was trying to spread itself through many of the world's largest instant messaging and social networks, including Windows Live Messenger 2009.


Windows will never be secure. "Our products just aren't engineered for security," said Brian Valentine, one of the top Windows executive at the time.

Comments

Recent Techrights' Posts

Brett Wilson LLP Has Track Record in Scam Coin Cases (e.g. Craig Wright and More), Now It Works for 'Crypto' Scam Purveyors
But wait, it gets worse
Will Brett Wilson LLP Handle Its Own Winding Up Petition or be Struck Off for Overt Abuse of Process?
Today we sue not only the first Microsofter
Ubuntu Becomes Microsoft GitHub, Based on Decision Made by British Army Officer
You're hopeless, Canonical
Sharing Code and Recipes
It helps explain the triviality of software freedom
How Many Women Has Microsoft's Alex Balabhadra Graveley Already Strangled and Where Does That End?
If you too are a victim of this man and wish to share information, contact us
"We Might Save Somebody's Life"
I follow the example of my father
Gemini Links 16/07/2025: Tmux and OCC25 Working TLS
Links for the day
 
Under the Guise of "MIT Technology Review Insights" the Site MIT Technology Review Posts Corporate Spam as 'Articles'
Some of the articles aren't even articles but 'hit pieces' against Free software and some are paid advertisements
Exclusive: corruption in Tribunals, Greffiers, from protection rackets to cat whisperers
Reprinted with permission from Daniel Pocock
Links 16/07/2025: Chip Bans and Microsoft’s “Digital Escort” Program
Links for the day
Revolving Doors: One Day You're a Judge, the Next Day You're an Attorney Paying Public Officials and Working for Violent and Dangerous Microsoft Employees
how the US justice system works
Slopwatch: Noise, Plagiarism and Even Fear, Uncertainty, Doubt/Fear-mongering/Dramatisation
What are we meant to do to prevent a false association or misleading connotations? Game the LLMs? No. Boycott slopfarms.
Gemini Links 16/07/2025: BaseLibre Numerical System and Simple Web Browsing with TLS
Links for the day
Links 16/07/2025: Fascist Slop Takes "Intelligence" Clothing, New Criminal Case Against MElon
Links for the day
Why I am Suing the Serial Strangler From Microsoft, Alex Balabhadra Graveley, in the UK High Court This Week
Out of respect to the process and to the Court, I shall not share any pertinent details about the case
Links 16/07/2025: China’s Economy Grows Steadily, France Takes Action Regarding Harm to Children by GAFAM and Fentanylware (TikTok)
Links for the day
It is Not About Politics
Beware the people who try to make this about politics
Good Journalism Saves Lives
a shocking number of women die or get seriously hurt every day due to violence from a partner
Recognition of Women's Contributions to Free Software
Being passive is not an option when bad things are happening
Slopfarms Are Going to Perish Because Public Opinion is Changing
Many slopfarms will simply go offline
19 Years of Standing Up for Justice, Equality, and Truth
This week we shall take it up a notch
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, July 15, 2025
IRC logs for Tuesday, July 15, 2025
Links 15/07/2025: LLM Pollution and Pushback in Ukraine
Links for the day
Gemini Links 15/07/2025: xkcd, New Cert, and Alhena Gemlog
Links for the day
Links 15/07/2025: Press Freedom at Risk and New Facebook Blunders
Links for the day
Reboots Should Never be Necessary
"BUT WHAT ABOUT SECURITY!!"
There's Still Hope for the World Wide Web
Let's hope that the trajectory of the Web won't be leading us to over-reliance on Google, nor will it reward worthless slopfarms
Gemini Links 15/07/2025: Smolweb and Alhena 5.1.7
Links for the day
The Danes Want GNU/Linux
David Heinemeier Hansson recently moved to GNU/Linux
Cory Doctorow Explains Why Software Freedom Matters, Whereas "Open Source" Misses the Point and Helps Monopolies
It's a very long article
BillPR (EpsteinGate-Bribed NPR) is Turning Into a Partial Slopfarm that Promotes Slop
"I went on a date with a chatbot!"
Two Weeks Passed Since Latest Large Wave of Microsoft Layoffs, More Expected Next Month
Blaming the debt on "AI" is just self-serving storytelling
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, July 14, 2025
IRC logs for Monday, July 14, 2025
Gemini Links 15/07/2025: Gemini "Style Sheets" and Switching From Microsoft GitHub to Codeberg
Links for the day
Coming Soon: Another OSI Scandal, This One Implicating Molly de Blanc
OSI has been fairly quiet lately
Outreachy & Debian pregnancy cluster, Meike Reichle evidence
Reprinted with permission from Daniel Pocock
Again, "Lunduke is Actually Sending His Audience to Attack People"
Microsoft Lunduke is not trying to "protect" Linux
XBox is Rapidly Turned Into a Slopfarm by Microsoft
Slop isn't about efficiency and saving money
One of the Most Hilarious Things About the Microsoft SLAPPs
It's so ridiculous
Financial Support for the Free Software Foundation or the GNU Project
The FSF has extended until Friday its fund-raising campaign
Illegally Hiding (or Demanding Secrecy Around) Illegal Requests or Attempts at Extortion
unlawful communications like threats
Microsoft's Halloween Documents and systemd, Wayland, Etc.
Maybe one day Wayland will be widespread. Or maybe not.
Gemini Links 14/07/2025: BOFH Archive, Updating Old Palm PDAS, and Nginx vs Slop Bots
Links for the day
Ubuntu is Becoming GAFAM-Like
What does that say about Canonical and Ubuntu?
Slopfarms Which Take Real Articles About GNU/Linux and Turn Them Into Copycats Which Are False
Even before the LLM hype those were quite common
The Firm That Picks on Techrights is Accustomed to Working With Criminals
Techrights never did anything illegal. So why is it being picked on by people who work with criminals?
Microsoft Said the Mass Layoffs Were for "Investment" in "AI", But It's Also Laying Off the "AI" and "Copilot" Staff
Months ago we showed many so-called "AI" people were getting the boot and this time it's the same
DryDeadFish is Dead, Long Live DryDeadFish
We kept checking, hoping it can recover from some temporary technical issue
For Quite Some Time Already Microsoft Attracts Crackpots, Scams, and More
Occasionally we talk about the situation at IBM as there are many parallels
Links 14/07/2025: Chatbots Broken Again, McHire LLM Shows Limits of the Hype
Links for the day
Changing One's Name Won't Change One's Past
People who have earned a bad reputation are not magically "entitled" to reset
People Who Assault Women Are Not Victims of "Distress"
It seems like an American tradition. In a country with almost 50 presidents, not even one was a female.
Slashdot Media Turned Linux Journal Into a Slopfarm and Now Slashdot Actively Promotes Anti-Linux Slopfarms
Yes, "no-nonsense" apparently means actual nonsense
Adoption of Gemini Protocol Still Growing
Gemini Protocol is being obscured by the media - it doesn't help that Google 'hijacked' the word "Gemini" - but people still manage to find out about it, download a client, and use it
Links 14/07/2025: Arresting Photographers, Threats to Revoke US Citizenship Over Criticism
Links for the day
More EPO Leaks on the Way
We hope that Mr. Rowan will actually try to refute what we say and show, not merely point the finger at the messengers
Decommodification is a Corporate Strategy Against Communities
systemd is led by Microsoft and hosted by Microsoft
copyleft.org 'Hijacked' by the People Who Attack the Person Who Created Copyleft
So far there's nothing "tasteless" in copyleft.org, but that can change at any time in the future
Asking People to Take Down Articles and Videos Only Makes These More Popular and "Viral"
If you do something bad, one of the worst things you can possibly do it try to silence those who speak about it
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, July 13, 2025
IRC logs for Sunday, July 13, 2025
Two-Thirds Towards FSF Goal, Richard Stallman to Give Talks in Europe
There are 67 left before reaching the target
Brett Wilson LLP "Takes it Personal" (Character Assassination, Not Professionalism). Everybody Can See That.
On behalf of violent men
Gemini Links 14/07/2025: Politicised Tech and "Leaving GitHub"
Links for the day