Alert India averted Stuxnet bug threat
NEW DELHI: Much before the world got busy making guesses about the origins of the deadly Stuxnet internet worm, the Department of Information Technology's Computer Emergency Response Team (CERT-In ) averted a disaster in India's energy sector by detecting the threat as early as July and advising staterun firms on a workaround to prevent attacks on computer systems controlling their operations , called SCADA in industry parlance.
On July 24, CERT-In director general Gulshan Rai wrote to oil ministry director (vigilance) P K Singh and power ministry saying they had detected a malware that was exploiting a recently-disclosed zero-day vulnerability in Microsoft Windows Shell that was improperly handling shortcut files.
Singh warned that Stuxnet was targeting certain components of SCADA systems. The trojan, or a computer mole, installed by the malware detects SIMATIC WinCC and PCS 7 software programmes from Siemens , devised for SCADA systems, and makes queries to any discovered databases by leveraging default passwords.
In other words, the Stuxnet trojan takes over the password used by various components in a computer system for talking to each other. This is different from a user password for logging on. It can, thus, steal vital information from a computer system and change its functioning or even cripple it.
SCADA stands for supervisory control and data acquisition. It generally refers to computer systems that monitor and control industrial processes such as manufacturing, oil production and refining, power generation infrastructure or facility-based processes. Understandably, anyone who controls a malware that is able to bite into the system can play havoc and steal information to use it for programming attacks with more specific targets.
According to Singh, the malware spreads through USB drives and it can also attack via network shares and a set of extensions that allow users to edit and manage files on remote web servers called web-based distributed authoring and versioning (Web-DAV ) in industry parlance.
CERT-In also advised the ministries on workarounds and other counter-measures to mitigate the threat till such time that safe patches, or software upgrades, were available to block the Stuxnet malware completely. It was established in January 2004 with the mandate to respond to computer security incidents. It is now assigned the task of oversight of the Indian cyberspace for enhancing cyber protection.
'Worm not behind Insat-4 B snags'
Isro has ruled out the possibility of the deadly Stuxnet internet worm attacking Insat-4 B satellite on July 7, resulting in 12 of its 24 transponders shutting down. Speaking to TOI Isro officials said that the worm only strikes a satellite's programme logic controller (PLC). '' We can confirm that Insat-4 B doesn't have a PLC. So the chances of the Stuxnet worm attacking it appear remote. In PLC's place, Insat-4 B had its own indigenouslydesigned software which controlled the logic of the spacecraft,'' said a source.
