When you read about Stuxnet and that it used stolen digital certificates from Realtek and JMicron to sign the worm, you may have wondered what the significance of that is or why they did that. There are actually a couple of factors to consider. When you try to install certain types of software on Windows
These new families represent a major transition: Win32/Stuxnet demonstrates a number of novel and interesting features apart from the original 0-day LNK vulnerability, such as its association with the targeting of Siemens control software on SCADA sites and the use of stolen digital certificates, However, the new malware we're seeing is far less sophisticated, and suggests bottom feeders seizing on techniques developed by others. Peter Kosinar comments:
Perhaps you're getting as tired of this thing as I am (though with the information still coming in, I'm not going to be finished with this issue for a good while, I suspect). But without wishing to hype, I figeseture it's worth adding links to some further resources. There's a very useful comment by Jake
Kim Zetter’s article for Wired tells us that “SCADA System’s Hard-Coded Password Circulated Online for Years” – see the article at http://www.wired.com/threatlevel/2010/07/siemens-scada/#ixzz0uFbTTpM0 for a classic description of how a password can have little or no value as a security measure. Zetter quotes Lenny Zeltser of SANS as saying that ““…anti-virus tools’ ability to detect generic versions of
I've been banging on various forums for a while about the misuse of the ESET brand (among others) by fake support centres cold-calling victims and telling them they have "a virus" and charging them hefty fees to fix the "problem."
As I mentioned in a previous blog, Wired Magazine reported it would take a Nation State to pull off a takedown of the electric grid. Actually, Mother Nature, back hoes, and potentially a worm have had major impacts in the past, but the recent use of the LNK file vulnerability shows it doesn’t take the
On July 17th, ESET identified a new malicious file related to the Win32/Stuxnet worm. This new driver is a significant discovery because the file was signed with a certificate from a company called "JMicron Technology Corp". This is different from the previous drivers which were signed with the certificate from Realtek Semiconductor Corp. It is
Our colleagues in Bratislava have issued a press release which focuses on the clustering of reports from the US and Iran, and also quotes Randy Abrams, whose follow-up blog also discusses the SCADA-related malware issue at length. The Internet Storm Center has, unusually, raised its Infocon level to yellow in order to raise awareness of
The hot news https://www.welivesecurity.com/2010/07/17/windows-shellshocked-or-why-win32stuxnet-sux is of a zero-day vulnerability that has been used to attack SCADA systems. This comes hot on the heels of an article on the Wired web site titled “Hacking the Electric Grid – You and What Army” http://www.wired.com/dangerroom/2010/07/hacking-the-electric-grid-you-and-what-army/. So clearly Wired had already predicted the origins, at least vaguely, of Win32/Stuxnet.
...But that doesn't mean that this particular attack is going to vanish any time soon, AV detection notwithstanding. Now that particular vulnerability is known, it's certainly going to be exploited by other parties, at least until Microsoft produce an effective fix for it, and it will affect some end users long after that...
We recently blogged about Securing Our eCity San Diego and MyMaine Privacy both being selected as winners for the Best Local/Community Plan with respect to cyber-security. It is normal for people and companies to want to hold the position as winner all to themselves, but in this case I am hoping that next year we
“Written in the form of a personal retrospective, this paper compares the earliest days of PC computer viruses with today’s threats, as well as provides a glimpse into the origins of the computer anti-virus industry.”
Win32/Swizzor is a very prevalent—and old—malware family having been around since at least 2002. Over the years, ESET has collected millions of samples related to this family and we still receive hundreds of new ones every day. Over the last two years, Win32/Swizzor has frequently shown up in our top ten lists of the most
Oh yeah, lot’s of us do it right under our boss’s nose. Some companies even offer incentives for their employees to get high. I particularly enjoy getting high on long airplane flights right in front of the flight attendants. What am I talking about? It is an ignorant article I read today about i-dosing, digital
For the Best Local/Community Plan, Securing Our eCity San Diego and MyMainePrivacy were both selected as winners. Both proposals offered innovated strategies for grassroots collaborative approaches with state and local government, public and private sector, and the academic community through their online classroom style trainings. The National Cybersecurity Awareness Challenge, which Secretary Napolitano announced in
A couple of months ago I posted a blog while flying at about 30,000 feet. That was a first for me and today I have a new first. I’m writing and posting a blog from the jury waiting room as I wait to see if I’ll be a juror. Of course, this reminded me of
You may have noticed that the blog has undergone some changes. While some may think that all the extra mugshots of yours truly are a bit over the top, I hope you approve of the somewhat livelier presentation. My thanks to everyone who worked on it. David Harley CITP FBCS CISSP ESET Senior Research Fellow
As I mentioned here yesterday, I launched a new AMTSO in the Media page on the AMTSO blog page yesterday. Since then, Pedro Bustamente has kindly sent me a whole bunch of links relating to events leading up to the launch of AMTSO in 2008, so I’ve created a separate sub-page incorporating those links out
…that this blog is not the place to ask for help with product installation and maintenance (even our products). Please contact your supplier or check the Support and Contact pages on the main ESET web site (http://www.eset.com): we simply aren't generally the best people to give you product advice. And while we appreciate appreciative comments,
Who would have thought that an initiative aimed at increasing the accuracy and relevance of anti-malware testing would be quite so controversial? Well, it was to be expected that AMTSO (the Anti-Malware Testing Standards Organization) would generate a certain amount of controversy: clearly, the organization is not going to get everything right first time. And
