I thought this was a pretty interesting article that I felt I should share. It talks about the different types of hackers that may have been behind the original stuxnet attack.
(Credit: Symantec)
W32.Stuxnet has received a lot of media attention over the last few days. This incident provides almost a complete case study of how these attacks succeed and how they will probably be used in the future. A successful attack allowed the attacker to steal confidential SCADA design and usage documents.
Let’s start by saying we don’t know who is behind the attack, and historically discovering this is very rare. However, if someone proposed this type of attack a month ago, while we would have agreed it was theoretically possible, most would have dismissed such an attack as a movie-plot scenario. Furthermore, attacks of this nature are rarely disclosed publicly.
We know that the people behind this attack aren’t amateurs, but their final motive is unclear.
The principal facts in this case are:
The zero-day vulnerability, rootkit, main binaries, stolen digital certificates, and in-depth knowledge of SCADA software are all high-quality attack assets. The combination of these factors makes this threat extremely rare, if not completely novel.
Read the rest of the article here
Related posts:
It was also reported that multiple zero-day vulnerabilities were coded in, which ensured greater success, but also played out more of the attacker’s trump cards. Either there are more zero-day exploits up their metaphorical sleeve, and another attack is being readied, or this was purely demonstrative. My bet, and hope, is on the latter. In either case, I expect more interesting developments to come of it.