Editor’s Note: This is an excerpt from the Practical SCADA Security blog at Tofino Security.
By Heather MacKenzie
The latest post-Stuxnet discovery of advanced threats is a malicious malware known as Shamoon.
Like Stuxnet, Duqu and Flame, it targeted energy companies in the Middle East, this time Saudi Aramco and likely other oil and gas concerns in the region including Qatar’s RasGaz. It is a new species however, because it did not disrupt an industrial process as Stuxnet did, nor did it stealthily steal business information as Flame and Duqu did. Instead it removed and overwrote the information on the hard drives of 30,000 workstations of Saudi Aramco (and who knows how many more at other firms).
Saudi Attack has ‘Inside’ Suspects
Shamoon Malware Variant Running
New Virus Hits Oil Giant, LNG Producer
Qatar’s RasGas Suffers Virus Hit
Saudi Aramco Back Up after Attack
Saudi Aramco Hacked
Nothing this damaging has been seen in a while. As a Kaspersky Lab expert said, “Nowadays, destructive malware is rare; the main focus of cyber criminals is financial profit. Cases like the one here do not appear very often.”
In the end, the question always comes back to what does Shamoon mean for SCADA and ICS Security?
First, let’s start with what Shamoon really is. First publicized August 16 by Symantec, Kaspersky Labs, and Seculert, Shamoon took control of an Internet connected computer at Saudi Aramco. It then used that computer to communicate back to an external Command-and-Control server and to infect other computers running Microsoft Windows that were not Internet connected.
The name Shamoon comes from a folder name within the malware executable: “c:\shamoon\ArabianGulf\wiper\release.pdb”
While the significance of the word “Shamoon” is not known, it is speculated that it is the name of one of the malware authors. Shamoon is the equivalent of Simon in Arabic.
Symantec describes Shamoon as having 3 components:
1. Dropper – the main component and source of the original infection. It drops components 2 and 3 onto the infected computer, copies itself to network shares, executes itself and creates a service to start itself whenever Windows starts.
2. Wiper – this is the destructive module. It compiles a list of files from specific locations on the infected computers, erases them, and sends information about the files back to the attacker. The erased files are overwritten with corrupted jpeg files, “obstructing any potential file recovery by the victim.”
3. Reporter – this module sends infection information back to the attacker’s central computer.
While all of this sounds sophisticated, Kaspersky Labs concluded, due to a number of errors found in the code, that the developers of Shamoon are “skilled amateurs.” They are not in the same league as the sophisticated coders of Stuxnet and Flame.
On August 15, 2012 Saudi Aramco posted on its Facebook page:
“…the company has isolated all its electronic systems from outside access as an early precautionary measure that was taken following a sudden disruption that affected some of the sectors of its electronic network. The disruption was suspected to be the result of a virus that had infected personal workstations without affecting the primary components of the network.”
In a later Reuters report, they said:
“Shamoon [the virus] spread through the company’s network and wiped computers’ hard drives clean. Saudi Aramco says damage was limited to office computers and did not affect systems software that might hurt technical operations.”
However, CIO blogger Constantine von Hoffman said:
“You don’t destroy 30,000 workstations without causing a vast amount of damage. It might be possible that the attack didn’t directly hit oil production or harm the flow of oil out of the ground. No one I’ve spoken to has suggested it did, but it’s clear that if the company’s statement is true then Aramco used a very strict reading of the phrase “oil production.”
Not only that, von Hoffman went on to question the Saudi Aramco statement that all damage had been repaired by Aug 26. He also wonders, in the days of oil and gas projects being dominated by joint ventures, how other energy companies’ computers could not have been damaged by Shamoon.
One report said the Shamoon attack started from an insider, “an extraordinary development in a country where open dissent is banned.”
It may have been the work of a group called the “Cutting Sword of Justice” who claimed responsibility for the attack. In this case the motive seems to be to disrupt the Saudi government’s main source of income because of Riyadh’s support for Sunni leaders in Bahrain and Sunni rebels in Syria.
If this group is behind Shamoon, it could be a milestone in computer hacking. It would be the first time a group of hobbyists and hacktivists achieved results similar to what other government’s cyber warfare teams accomplished.
Another clue about the motivations of the creators of Shamoon could be the part of its code that includes a portion of an image of a burning U.S. flag, which is presumed to have been taken from the Wikipedia image. The angle in this case is presumably that disrupting Saudi Aramco would ultimately disrupt U.S. energy supplies.
Shamoon was a destroyer of data on workstations of energy companies in the Arabian Gulf. There is no evidence it had any impact on ICS or SCADA systems.
What does it mean for automation professionals? The good news is that like Stuxnet, Flame and Duqu, Shamoon was highly targeted. But the bad news is that it is another indicator that industry, especially the energy industry is now a target.
Even more concerning is the fact the bar for effective disruption of a business has been lowered to the level of enthusiastic amateurs. Copycats penetrated a well protected network and destroyed data. This is a bit like the fear we have when we think of terrorists getting their hands on nuclear weapons. No rules of engagement apply.
Call it “cyber warfare” or “cyber hype”, the bottom line is the information/networked world is facing increased threats and ICS and SCADA systems are part of that world.
Heather MacKenzie is marketing director at Tofino Security. Click here to read the full version of the Practical SCADA Security blog.