Dale Leschnitzer's List: Wiper Attack

• The attack at first seemed like a response to an earlier incident: the compromise of systems belonging to Iran's Oil Ministry in April.
• That attack, which forced the temporary closure of Iran's oil processing facility on Kharg Island, relied on a trusted insider to plant targeted malware specifically designed for the victim's network environment.
• Yes, the malware deleted files from infected hard drives and attempts to wipe the master boot record of those systems, but didn't do anything "unrecoverable," SophosLabs expert Paul Baccas reported at the time
• Those behind the attacks also made no secret of their compromise: publishing public statements on their attack and the addresses of compromised systems online - not typical of APT-style attacks.
• As the New York Times reported, the code of the malware refers to the "Arabian Gulf," rather than the "Persian Gulf" - the term of choice for Iranians.

3 more annotations...

• At first glance, the file didn't look to be legitimate, so I launched the program. It copied itself to:

   

  c:\windows\system32\trksvr.exe

   

  The file contained some interesting strings:

   

  trksvr.exe
   trksrv.exe
   testdomain.com
   \System32\cmd.exe /c "ping -n 30 127.0.0.1 >;nul && sc config TrkSvr binpath= system32\trksrv.exe && ping -n 10 127.0.0.1 >;nul && sc start TrkSvr"
• I was confident it was malicious. And, because no other security lab seemed to detect the file, I picked a name, Troj/MDrop-ELD, wrote a quick detection, and went home.

1 more annotation...

• On Aug. 15, more than 55,000 Saudi Aramco employees stayed home from work to prepare for one of Islam’s holiest nights of the year — Lailat al Qadr, or the Night of Power — celebrating the revelation of the Koran to Muhammad.
• That virus — called Shamoon after a word embedded in its code — was designed to do two things: replace the data on hard drives with an image of a burning American flag and report the addresses of infected computers — a bragging list of sorts — back to a computer inside the company’s network.

• • Only article I have seen saying they are pinpointing this to a specific USB insert in a specific machine by a specific insider!
• Instead, they said, as the virus spread through the network of the company known as Saudi Aramco, destroying 55,000 computers, the malicious software failed to perform as its designer had intended.
• The mistakes in the virus’s code led investigators to the point of attack -- a USB stick that had been inserted in a computer on the internal company network -- and to the identity of the suspected attacker, an Aramco employee who was logged onto the machine at the time of the incident.
• Parts of the virus used off-the-shelf software, while other elements appear to have been downloaded from hacker forums, according to a participant in the investigation. Errors in the code kept it from overwriting certain segments of Aramco directories that its designer had instructed it to, he said. That allowed analysts to retrieve information that assisted their investigation.
• The virus not only destroyed the hard drives of more than 60 percent of Aramco’s computers, it also wiped out data on the company’s servers, including the domain management servers that were the heart of the corporate network, said an investigator involved in the clean-up.

  • Also attacked domain management systems

3 more annotations...

• “We believe Flame was written by a different team of programmers but commissioned by the same larger entity,” Roel Schouwenberg, a security researcher at Kaspersky Labs, said in an interview Wednesday. But he would not say which governments he was speaking of.

• Nicole Perlroth's New York Times story - In Cyberattack on Saudi Oil Firm, U.S. sees Iran Firing Back - is a ridiculous premise based on confusing hypotheses regarding malware that may not even have come from the U.S. But before I cover that, I'd like to know in what universe does a country who was on the receiving end of multiple perceived U.S. cyber attacks go after an entirely different nation in revenge?
• I just spoke with Nicole Perlroth and learned that her article was mean't to take a skeptical view of the administration's campaign to pin cyber attacks on Iran. I reread the article and I'm still not clear on which points she was being skeptical about however based upon my respect of her past research, I've changed the name of this post to "Ridiculous Administration Premise ..." instead of "Ridiculous NY Times premise" since that was Ms. Perlroth's intent - to express skepticism of the Administration's position on this issue.

• The recent cyber attack against Saudi Aramco resulted in the destruction of thousands of servers and hard drives. Replacement costs along with incident response fees had to have exceeded US$15 million dollars. While it's true that oil production and distribution were not affected, it may be because they weren't targeted.
• sihokoSeptember 16, 2012 at 10:48 PM

  The reason why is relatively simple ...
  
  The number of people involved in ICS is a much smaller and more confined group. (if outsourced, then to direct stakeholders - the vendors)
  
  ICS is not has no direct connection to the Internet. No email, no web browsing.
  
  Shamoon propagates using file shares, best firewall practices do not allow file shares between systems on either side of the firewall.

• According to at least one knowledgable source, Saudi Aramco is currently dealing with another network attack which affected some of its business systems at 0800 AST but not its production or distribution facilities. At this time the company's websites at saudiaramco.com and aramco.com are down and employees have been advised to unplug their workstations while U.S. and Saudi security teams attempt to conduct incident response.

• All Services On One SAP System
• Corruption in Out-sourcing Contracts
   The outsourcing business started in the mid-nineties. It was whispered to be a product of the start of corruption in the corporate management.  It was rumored that each of those outsourced contractors is being fostered by a big figure in management in a way that is difficult to verify.
• Security Administered by Part-time Contractors
• If an employee has a problem on his/her station, then the employee will have to dial "904, The Help Desk" where a contractor employee will issue a trouble ticket, and another contractor employee will remotely use "Remote Desktop" or similar functions to solve the issue.
• The contractors I am talking about are "Local companies" newly established to provide IT services to Aramco. For example, if Aramco wants to install new stations in a department or a unit, then one of those contractors will provide the stations, install the SAP interface and other applications, connect the stations to the network, and add the users to the system. This is how open the system is.
• Insider Threat 
   Those contracted companies hire employees from Asian counties for low salaries and have them do this work. If any of those workers gets a better deal somewhere else he will quit the IT function and go. But those contracted workers can go to Dubai or Qatar if they find better deals. And in this case, they know more than enough about Saudi Aramco system. They can go to Iran and work there with this information.
• UPDATE (20AUG12: 0655 PDT): A contact at Aramco has informed me that one of the oil plant's gate access system and intruder detection systems are down.

5 more annotations...

• • Speculates that they reverse engineered parts of Flame
• Since none of the software security companies have a complete copy of Wiper, it makes sense to me that Iran, the victim of the Wiper attack, reverse-engineered or at least mimic'd it to create Shamoon.
• UPDATE (23AUG12): I've received new information from knowledgable sources that the attack vector for delivery of the worm was via a USB stick inserted into a workstation at one of Aramco's global offices (not in Saudi Arabia). Further, the timing of the attack was carefully chosen to be one hour before the end of the work day which was the end of the month of Ramadan and the start of the Eid holiday.

1 more annotation...

• 2. Companies Need To Pay Closer Attention to the Insider Threat
• It's my understanding from a confidential source that the initial infection vector wasn't through a spear phishing attack but instead was via a Shamoon-infected USB stick which was inserted into a workstation in one of Aramco's foreign offices. This required the cooperation of an insider which, in fact, has been a serious and growing threat vector for a number of years.
• 1. The Conventional Cyber Threat Landscape Is Too Narrowly Viewed
• 3. Companies Cannot Keep a Dedicated Adversary Out of their Network

2 more annotations...