July 19, 2010 | San Diego, CA | Press Releases

ESET Analysis: Worm Win32/Stuxnet Targets Supervisory Systems in the U.S. and Iran

ESET, the leader in proactive threat protection, has issued a warning against a worm dubbed Win32/Stuxnet, which threatens users around the globe. Exploiting a vulnerability in Windows® Shell, this dangerous threat is detected by ESET as LNK/Autostart.A. It is used in targeted attacks to penetrate SCADA systems, especially in the United States and Iran. SCADA are supervisory and monitoring systems used in many industries, for instance in power engineering.

According to ESET Virus Lab, the worm has been active for several days, lately in the U.S. and Iran withalmost 58 percent of all infections being reported in the United States, 30 percent in Iran and slightly over four percent in Russia. The cyber attacks in the U.S. and heightened activity of the worm in Iran come in the wake of persisting tensions between the two nations over nuclear ambitions of this Middle Eastern country.

"This worm is an exemplary case of targeted attack exploiting a zero-day vulnerability, or, in other words, a vulnerability which is unknown to the public. This particular attack targets the industrial supervisory software SCADA. In short – this is an example of malware-aided industrial espionage. The question is why the chart of affected nations looks as it does," said Juraj Malcho, head of the Virus Lab at ESET's global headquarters in Bratislava, Slovakia.

Most of the damage caused by the worm is limited to industrial targets, with home users being much less affected. "So far, the number of infected PCs are in the tens of thousands, but likely to rise," elaborates Malcho. According to ESET analysis, the Stuxnet worm in and of itself poses no greater threat for home users than the average computer threat. The danger lies in the Windows® OS vulnerability connected with processing of LNK files. Experts expect even more malware families to begin to exploit this security gap in the near future.

An interesting angle to this story is how the worm spreads. "For a truly targeted attack it would have been coded to make specific checks to see that it only ran where it was supposed to and did not spread. Spreading increases the odds of detection. If the attack was aimed at only US systems, then the attacker would not want the code appearing all over the world. This fact might indicate a number of potential attackers," said Randy Abrams, director of technical education at ESET in the U.S. "The ability to attack power grids throughout the world would be very appealing to terrorist groups," concludes Abrams.

ESET security solutions effectively detect and clean this threat. A patch from Microsoft is expected to be issued soon as well. Additional information and continuous updates can be found at www.eset.com/blog.

About ESET
ESET develops software solutions that deliver instant, comprehensive protection against evolving computer security threats. ESET pioneered and continues to lead the industry in proactive threat detection. ESET NOD32 Antivirus consistently achieves the highest accolades in all types of comparative testing, and is the heart of the virus and spyware detection in ESET Smart Security. ESET Smart Security is an integrated antivirus, antispyware, antispam and personal firewall solution that combines accuracy, speed and an extremely small system footprint to create the most effective security solution in the industry. Both products have an extremely efficient code base that eliminates the unnecessarily large size found in some solutions. This means faster scanning that doesn't slow down computers or networks. ESET has global production headquarters in Bratislava, Slovakia, with distribution headquarters for the Americas and Asia-Pacific located in San Diego, California. ESET also has offices in Buenos Aires, Prague, and Krakow and is represented by an extensive global partner network. For more information, visit http://www.eset.com/ or call +1 (619) 876-5400.