stuxnet worm against control systems in manufacturing & nuclear plants

mir

The program was designed to attack and sabotage control systems used in manufacturing facilities, power grids, pipelines, and nuclear plants.

No one knows where the worm was created or what it was targeting. Researchers know only that it was capable of causing physical damage; for instance, it could make a motor rev too quickly and even blow up. “Using something in the cyberworld to control something in the physical world is something we’ve never seen before,” says Liam O Murchu of the computer security company Symantec. “We’ve never seen any industrial control system being attacked before, and we’ve never seen such an advanced threat that needed so many different skills to come together.”

Link : http://discovermagazine.com/2011/jan-feb/09

nuclearcat

yes, this subject is tossed since long time ago
Using Windows in industrial systems is crime from the beginning by many reasons, one serious - you cannot customize them to hide or remove vulnerable points, and this points know by enemy government (all big govt's have access to Windows source code).
In Lebanon Windows is everywhere and still people will not believe to problem till shit will hit the fan, and it will be too late. I'm sure it is trivial to implement such trojan and spy on whole lebanese government in persons, agencies and all it's structure.

System that control critical things that connected over generic network, has USB, that has generic network ports as your home pc, and running system that is same as gaming rig of John Doe - just worse crime.

MrClass

uuh, dont tell me our power plant engineers use windows to control the structure? Jeez!

BashLogic

MrClass wroteuuh, dont tell me our power plant engineers use windows to control the structure? Jeez!

I can never forget what I once saw. I was visiting the empire state building in new york. a friend of mine had been there earlier and forgot something there so i had to go to the security and pick it up on his behalf. as I walked thru the floors and maze of corridors, I finally found to my destination. a friendly guy popped out to enquire and verify that it was i who had just been cleared in, well anyhow, as he was helping out in picking the stuff, i couldnt help but notice from the door crack that a good portion of their screens were locked so i couldnt not see anything unecessary, this was a smart thing to do. the sad story was that the lock screen revealed that the at least some of the security systems were running on NT4 :(

It still shocks me to see of all the places that i have been to (different clients) how they still have poor security and still are using ancient OS/apps. just a couple of months ago i had to deal with nt4/win2000/RHEL3, AAARRRGGGHHHHH!!!!!!!!!!!!

Padre

well ... it's not really up to the users or the designers. I've worked on the design and control of couple of power generation plants (Diesel / HF engines ) and let me tell you one thing, all the softwares required are built for windows and are really not security aware ... well untill the last couple of years. i could easily root any control software for AB (Allen-Bradely) one of the major PLC producing company. In short, they are built with piratically no security, and initially designed for no internet connectivity. that's what u get.