ESET Analysis: Worm Win32/Stuxnet Targets Supervisory Systems in the U.S. and Iran

SAN DIEGO – July 19, 2010 – ESET, the leader in proactive threat protection, has issued a warning against a worm dubbed Win32/Stuxnet, which threatens users around the globe. Exploiting a vulnerability in Windows® Shell, this dangerous threat is detected by ESET as LNK/Autostart.A. It is used in targeted attacks to penetrate SCADA systems, especially in the United States and Iran. SCADA are supervisory and monitoring systems used in many industries, for instance in power engineering.

According to ESET Virus Lab, the worm has been active for several days, lately in the U.S. and Iran withalmost 58 percent of all infections being reported in the United States, 30 percent in Iran and slightly over four percent in Russia. The cyber attacks in the U.S. and heightened activity of the worm in Iran come in the wake of persisting tensions between the two nations over nuclear ambitions of this Middle Eastern country.

“This worm is an exemplary case of targeted attack exploiting a zero-day vulnerability, or, in other words, a vulnerability which is unknown to the public. This particular attack targets the industrial supervisory software SCADA. In short – this is an example of malware-aided industrial espionage. The question is why the chart of affected nations looks as it does,” said Juraj Malcho, head of the Virus Lab at ESET’s global headquarters in Bratislava, Slovakia.

Most of the damage caused by the worm is limited to industrial targets, with home users being much less affected. “So far, the number of infected PCs are in the tens of thousands, but likely to rise,” elaborates Malcho. According to ESET analysis, the Stuxnet worm in and of itself poses no greater threat for home users than the average computer threat. The danger lies in the Windows® OS vulnerability connected with processing of LNK files. Experts expect even more malware families to begin to exploit this security gap in the near future.

An interesting angle to this story is how the worm spreads. “For a truly targeted attack it would have been coded to make specific checks to see that it only ran where it was supposed to and did not spread. Spreading increases the odds of detection. If the attack was aimed at only US systems, then the attacker would not want the code appearing all over the world. This fact might indicate a number of potential attackers,” said Randy Abrams, director of technical education at ESET in the U.S. “The ability to attack power grids throughout the world would be very appealing to terrorist groups,” concludes Abrams.

ESET security solutions effectively detect and clean this threat. A patch from Microsoft is expected to be issued soon as well. Additional information and continuous updates can be found at www.eset.com/blog.