Video…

So I found a simple off-the-shelf solution to my original problem and avoided having to spend a bunch of time writing my own javascript and CSS. I also decided to take advantage of another WordPress feature which is the ability to use a Theme. I purchased the Platform Pro from PageLines and gave my site a new look. Again, this involved a minimum of effort.

• Symantec reports that 60% of the infections have occurred in Iran
• Fewer than 2% of the infections have occurred in the United States
• The developers created fake device drivers that were signed using stolen certificates from two device manufacturers
• The exploit used default passwords for the Siemens systems that were apparently hard coded into the systems.

The last item is especially important as I work on systems all the time that are using or still contain default accounts and passwords set up by the supplier. In many cases it isn’t trivial to rid yourself of these accounts and/or change the passwords. You should really start to think about that.

German security researcher Ralph Langner has posted his thoughts during his investigation here.  I would direct you specifically to his recommendations for asset owners…

I would generally agree with him that you may not need to worry about Stuxnet specifically but you may want to start worrying about the worms that will be coming as soon as the next 90 days that will be using the exploits and techniques pioneered by Stuxnet.

You may want to start thinking about beefing up your security as quickly as possible for your OSIsoft PI systems and their interfaces. OSIsoft publishes a security best practices white paper containing XML templates for using the Windows security configuration wizard to help to reduce the attach surface. You can configure your PI interface nodes to only allow reads from the control system and prevent any writes. You should also consider firewalling your interfaces and your PI server from the rest of your business network using a three zone approach.

• The virus uses several Windows exploits to propagate and hide itself.
• The virus intercepts Siemens DLL calls and reprograms PLC code which it then hides from the engineering software used to program the controllers.
• The virus uses peer to peer networking so that if a newer version of the code is introduced to the network, all of the machines infected with the older code are updated.

Symantec is supposed to present their white paper on the virus today at the Virus Bulletin 2010 conference. I’ll be posting a link when it is available.

The original Slashdot post that I linked to is a story that the Iranians have apparently reached out to several western cyber security firms in an attempt to enlist their help with cleaning the virus off of their systems.

I can see this virus being a real game changer. The first Gulf War woke everyone up to the military capabilities of the United States. I can see that this virus is probably doing the same thing. Someone is demonstrating the same type of capabilities in cyberspace and I’m sure that it is getting the attention of governments throughout the world. It will be interesting to see how this manifests itself. I would love to have the inside story on this one, wouldn’t you?

This Computerworld article has some excellent speculation along this line. What if this highly effective virus mutates and starts attacking other systems beside Siemens?