Saudi Aramco’s Khurais plant. A cyberattack in August wiped out data on three-quarters of Aramco’s PCs.
The hackers picked the one day of the year they knew they could
inflict the most damage on the world’s most valuable company, Saudi
Aramco.
On Aug. 15, more than 55,000 Saudi Aramco employees stayed home from
work to prepare for one of Islam’s holiest nights of the year — Lailat
al Qadr, or the Night of Power — celebrating the revelation of the Koran
to Muhammad.
That morning, at 11:08, a person with privileged access to the Saudi state-owned oil
company’s computers, unleashed a computer virus to initiate what is
regarded as among the most destructive acts of computer sabotage on a
company to date. The virus erased data on three-quarters of Aramco’s
corporate PCs — documents, spreadsheets, e-mails, files — replacing all
of it with an image of a burning American flag.
Open Channel: Officials see Iran, not outrage over film, behind cyber attacks on US banks
United States intelligence officials say the attack’s real perpetrator was Iran, although they offered no specific evidence to support that claim. But the secretary of defense, Leon E. Panetta, in a recent speech
warning of the dangers of computer attacks, cited the Aramco sabotage
as “a significant escalation of the cyber threat.” In the Aramco case,
hackers who called themselves the “Cutting Sword of Justice” and claimed
to be activists upset about Saudi policies in the Middle East took
responsibility.
But their online message and the burning flag were probably red
herrings, say independent computer researchers who have looked at the
virus’s code.
Immediately after the attack, Aramco was forced to shut down the
company’s internal corporate network, disabling employees’ e-mail and
Internet access, to stop the virus from spreading.
It could have been much worse. An examination of the sabotage
revealed why government officials and computer experts found the attack
disturbing. Aramco’s oil production operations are segregated from the
company’s internal communications network. Once executives were assured
that only the internal communications network had been hit and that not a
drop of oil had been spilled, they set to work replacing the hard
drives of tens of thousands of its PCs and tracking down the parties
responsible, according to two people close to the investigation but who
were not authorized to speak publicly about it.
Aramco flew in roughly a dozen American computer security experts. By
the time those specialists arrived, they already had a good handle on
the virus. Within hours of the attack, researchers at Symantec, a
Silicon Valley security company, began analyzing a sample of the virus.
That virus — called Shamoon after a word embedded in its code — was
designed to do two things: replace the data on hard drives with an image
of a burning American flag and report the addresses of infected
computers — a bragging list of sorts — back to a computer inside the
company’s network.
Shamoon’s code included a so-called kill switch, a timer set to
attack at 11:08 a.m., the exact time that Aramco’s computers were wiped
of memory. Shamoon’s creators even gave the erasing mechanism a name:
Wiper.
-
Only on NBCNews.com
-
'The new Afghanistan'? West turns its attention to Mali
-
Grand Canyon run by Arizona? Vote seeks state control
-
Hurricane tort king gives $1 million to pro-Obama Super PAC
-
‘Spirit’ of Bond alive and well in London
-
Micro close-ups are creepy — and cool!
-
Hackers use next-gen 'botnets' against US banks
-
Boy Scout goal: To interview 1,000 WWII vets
Computer security researchers noted that the same name, Wiper, had been given to an erasing component of Flame,
a computer virus that attacked Iranian oil companies and came to light
in May. Iranian oil ministry officials have claimed that the Wiper
software code forced them to cut Internet connections to their oil
ministry, oil rigs and the Kharg Island oil terminal, a conduit for 80
percent of Iran’s oil exports.
Story: Iran denies role in Gulf cyberattacks
It raised suspicions that the Aramco hacking was retaliation. The
United States fired one of the first shots in the computer war and has
long maintained the upper hand. The New York Times reported in June that the United States, together with Israel, was responsible for Stuxnet, the computer virus used to destroy centrifuges in an Iranian nuclear facility in 2010.
Last May, researchers discovered that Flame had been siphoning data
from computers, mainly in Iran, for several years. Security researchers
believe Flame and Stuxnet were written by different programmers, but
commissioned by the same two nations.
If American officials are correct that Shamoon was designed by Iran,
then clues in its code may have been intended to misdirect blame.
Shamoon’s programmers inserted the word “Arabian Gulf” into its code.
But Iranians refer to that body of water as the Persian Gulf and are
very protective of the name. (This year, Iran threatened to sue Google
for removing the name Persian Gulf from its online maps.)
After analyzing the software code from the Aramco attack, security
experts say that the event involved a company insider, or insiders, with
privileged access to Aramco’s network. The virus could have been
carried on a USB memory stick that was inserted into a PC.
Aramco’s attackers posted blocks of I.P. addresses of thousands of
Aramco PCs online as proof of the attack. Researchers say that only an
Aramco employee or contractor with access to the company’s internal
network would have been able to grab that list from a disconnected
computer inside Aramco’s network and put it online.
Neither researchers nor officials have disclosed the names of the
attackers involved. Saudi Aramco said in a statement that it was
inappropriate to comment amid an investigation. The company further
stated that it does not comment on rumor or speculation.
American intelligence officials blame Iran for a similar, subsequent
attack on RasGas, the Qatari natural gas giant, two weeks after the
Aramco attack. They also believe Iran engineered computer attacks that
intermittently took America’s largest banks offline in September, and last week disrupted the online banking Web sites of Capital One and BB&T.
Multiple requests for comment from Iran’s interests office in
Washington and to Iran’s mission to the United Nations in New York
brought no response.
The finger-pointing demonstrates the growing concern in the United
States among government officials and private industry that other
countries have the technology and skill to initiate attacks. “The
Iranians were faster in developing an attack capability and bolder in
using it than we had expected,” said James A. Lewis, a former diplomat
and cybersecurity expert at the Center for Strategic and International
Studies. “Both sides are going through a dance to figure out how much
they want to turn this into a fight.”
More than two months after the Aramco attack, the company continues
to deal with the aftermath. Still, this month employees were not able to
gain access to their corporate e-mail and internal network for several
days. Until the company’s executives decide its systems are secure,
employees can no longer access Aramco’s internal network remotely.
The attack, intelligence officials say, was a wake-up call. “It
proved you don’t have to be sophisticated to do a lot of damage,” said
Richard A. Clarke, the former counterterrorism official at the National
Security Council. “There are lots of targets in the U.S. where they
could do the same thing. The attacks were intended to say: ‘If you mess
with us, you can expect retaliation.'"
This story, "Cyberattack on Saudi oil firm disquiets U.S.," originally appeared in The New York Times.
Republican presidential candidate
former Massachusetts Gov. Mitt Romney talks with his running mate Rep.
Paul Ryan of Wisconsin aboard their campaign plane on Tuesday, October
23, en route to Denver. A day after the final presidential debate,
Romney is campaigning in Nevada and Colorado.
Posts
