The Stuxnet Shock

Are we seeing the first real use of malware as a weapon in the physical world? And is it being used against Iran's Bushehr nuclear power plant?


From the Christian Science Monitor:

So far, Stuxnet has infected at least 45,000 industrial control systems around the world, without blowing them up – although some victims in North America have experienced some serious computer problems, Eric Byres, a Canadian expert, told the Monitor. Most of the victim computers, however, are in Iran, Pakistan, India, and Indonesia. Some systems have been hit in Germany, Canada, and the US, too. Once a system is infected, Stuxnet simply sits and waits – checking every five seconds to see if its exact parameters are met on the system. When they are, Stuxnet is programmed to activate a sequence that will cause the industrial process to self-destruct, Langner says.

Langner's analysis also shows, step by step, what happens after Stuxnet finds its target. Once Stuxnet identifies the critical function running on a programmable logic controller, or PLC, made by Siemens, the giant industrial controls company, the malware takes control. One of the last codes Stuxnet sends is an enigmatic “DEADF007.” Then the fireworks begin, although the precise function being overridden is not known, Langner says. It may be that the maximum safety setting for RPMs on a turbine is overridden, or that lubrication is shut off, or some other vital function shut down. Whatever it is, Stuxnet overrides it, Langner’s analysis shows.

"After the original code [on the PLC] is no longer executed, we can expect that something will blow up soon," Langner writes in his analysis. "Something big."

Hat-Tip: Andrew Sullivan

Clegg And Blue Touchpaper

Although it's in my blogroll, I don't actually look at the Light Blue Touchpaper blog very often. It's from security research scientists at the Cambridge University Computer Laboratory.

But I did have a look this week and what do I see? "

Liberal Democrat leader visits our lab

This week, Nick Clegg, leader of the UK Liberal Democrat Party, and David Howarth, MP for Cambridgeshire, visited our hardware security lab for a demonstration of Chip & PIN fraud techniques.

They used this visit to announce their new party policy on protections against identity fraud. At present, credit rating companies are exempt from aspects of the Data Protection Act and can forward personal information about an individual’s financial history to companies without the subject’s consent. Clegg proposes to give individuals the rights to “freeze” their credit records, making it more difficult for fraudsters to impersonate others.

A party leader visiting a lab? Make's a pleasant change from reading about creationist US politicians, doesn't it?

A Car I'd Love to Buy

I'd love to buy this car. To begin with, it looks like a car from the future. The top speed, 115 mph, is more than enough for me. It seats six- four in the front, two in the back (facing the rear)

It has loads of features- a combustion efficiency gauge, oil temperature, manifold vacuum and fuel economizer gauges, battery charge level indicator, altimeter, barometer, compass, oil level gauge, tinted glass, and an all-wave radio.

It also has a thermostatically controlled climate control system and was heavily insulated to control wind and road noise. It has a safety-conscious design, with a padded leather dashboard, a shatter-proof (tri-laminate) windshield, indirectly illuminated gauges, and powerful headlights and fog lamps.

There are also no door handles - the doors open at the touch of buttons located on the outside and on the instrument panel.

It's been written about under the heading "Is This The Motor Car of Tomorrow?" and at a retail price of 12,500 dollars, it sounds affordable.

Only problem is, the Phantom Corsair is from the 1930s


It would fit in quite nicely in Daleks in Manhattan, though.