U.S. federal lab linked to Stuxnet breached
Posted on 20.04.2011
A federally funded U.S. lab that is suspected to have been involved in finding the vulnerabilities in Siemens SCADA systems used by the Stuxnet worm has shut down the Internet connection for its employees following the discovery of a breach into the facility's systems.

The Oak Ridge National Laboratory - located in Tennessee and funded by the U.S. Department of Energy - is known for performing classified and unclassified research for federal agencies and departments on issues crucial for national security. Among other things, the lab also does cybersecurity research on malware, vulnerabilities and phishing.

It is somewhat ironic, then, that the breach was the result of two employees falling for a malicious email containing a link to a page that exploited a remote-code execution vulnerability in the Internet Explorer browser.

According to Wired, the email was sent to about 530 lab employees, of which 57 believed that the email was coming from the institution's human resources department and clicked on the link. Of those 57 machines, only two got infected.

It seems that the malware inserted in those two computers lay dormant for a week, and then started to send out stolen data from one of them to a remote server. This was discovered by the administrators who immediately shut down and cleaned up the machine, but a week later, they discovered that other servers were also infected - hence, the total shutdown of Internet access.

Thomas Zacharia, the deputy director of the lab, didn't say what data had been stolen, but he confirmed it was encrypted. He hopes that the investigation will reveal the nature of the data and the destination of the stolen batch. He also commented that the malware used in the attack was designed to hide on the system and to delete itself if it was unsuccessful on a particular system.

According to a New York Times article, the Oak Ridge National Laboratory was used to test and reveal the vulnerabilities that allowed the Stuxnet worm to target the Natanz nuclear plant. This claim being now in the open, it is easy to see how speculations about the origin of the attack that hit the lab's network are inevitably going to lean towards Iran.






Spotlight

The synergy of hackers and tools at the Black Hat Arsenal

Posted on 27 August 2014.  |  Tucked away from the glamour of the vendor booths and the large presentation rooms filled with rockstar sessions, was the Arsenal - a place where developers were able to present their security tools and grow their community.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Wed, Aug 27th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //