Malicious virus targets SCADA systems

company has seen the bug exploited only in limited, targeted attacks, Microsoft said.

The systems that run the Siemens software, called SCADA (supervisory control and data acquisition) systems, are typically not connected to the Internet for security reasons, but this virus spreads when an infected USB stick is inserted into a computer.

Once the USB device is plugged into the PC, the virus scans for a Siemens WinCC system or another USB device, according to Frank Boldewin, a security analyst with German IT service provider GAD, who has studied the code. It copies itself to any USB device it finds, but if it detects the Siemens software, it immediately tries to log in using a default password. Otherwise it does nothing, he said in an e-mail interview.

McMillan quotes Boldewin to say that that technique may work, because SCADA systems are often badly configured, with default passwords unchanged.

The virus was discovered last month by researchers with VirusBlokAda, a little-known antivirus firm based in Belarus, and reported Thursday by security blogger Brian Krebs.

To get around Windows systems that require digital signatures — a common practice in SCADA environments — the virus uses a digital signature assigned to semiconductor maker Realtek. The virus is triggered anytime a victim tries to view the contents of the USB stick. A technical description of the virus can be found here (pdf)..

McMillan says it is unclear how the authors of the virus were able to sign their code with Realtek’s digital signature, but it may indicate that Realtek’s encryption key has been compromised. The Taiwanese semiconductor maker could not be reached for comment Friday.

In many ways, the virus mimics proof-of-concept attacks that security researchers like Wesley McGrew have been developing in laboratories for years. The systems it targets are attractive to attackers because they can provide a treasure-trove of information about the factory or utility where they are used.

Whoever wrote the virus software may have been targeting a specific installation, said McGrew, founder of McGrew Security and a researcher at Mississippi State University. If the authors had wanted to break into as many computers as possible, rather than a specific target, they would have tried to exploit more popular SCADA management systems such as Wonderware or RSLogix, he said.

According to experts there are several reasons why someone might want to break a SCADA system “There may be money in it,” McGrew said. “Maybe you take over a SCADA system and you hold it hostage for money.”

Criminals could use the information from a manufacturer’s WinCC system to learn how to counterfeit products, said Eric Byres, chief technology officer with security consultancy Byres Security. “This looks like a grade A case of focused IP-harvesting,” he said. “This looks focused and real.”