Question

For Stuxnet, the first malware aimed at Industrial Control systems, provide details on:

1. The vulnerability (vulnerabilities) it exploited
2. The way it spread
3. The effect it had on the systems
4. How it was cleaned.

Answer 1

`Hey,

Note: Brother in case of any queries, just comment in box I would be very happy to assist all your queries

Back in 2010, security researchers traced a series of hardware-specific infections to a piece of malware dubbed Stuxnet. This malware lay dormant on Windows machines unless there was also access to a SCADA system running Siemens Simatic WinCC and PCS 7 SCADA system. In particular, the targets most affected most by Stuxnet were centrifuges manufactured by Siemens and used in Iran to enrich uranium. Joining the Stuxnet vulnerability in the top ten were exploit kits, which allow novices to create their own malware leveraging known vulnerabilities. Among the most popular exploit kits, Angler took top spot followed by Sweet Orange. For example, the Angler exploit kit targets compromised runtimes and zero-day holes in Microsoft Silverlight, Adobe Flash, and Oracle’s Java with the Internet Explorer browser included.

Stuxnet spread from USB flash drives to Windows computers by exploiting a vulnerability with Windows autorun and shortcuts. It could spread even if users didn't intentionally execute a program on a flash drive. Early versions of the worm used an autorun file on infected USB drives to automatically execute malware when the drives were plugged into a computer.

Unlike most malware, Stuxnet does little harm to computers and networks that do not meet specific configuration requirements; "The attackers took great care to make sure that only their designated targets were hit... It was a marksman's job.

Siemens has released a detection and removal tool for Stuxnet. Siemens recommends contacting customer support if an infection is detected and advises installing Microsoft updates for security vulnerabilities and prohibiting the use of third-party USB flash drives. Siemens also advises immediately upgrading password access codes.

Kindly revert for any queries

Thanks.