Saudi Aramco oil firm claims to be over cyber attack

Saudi Aramco oil firm claims to be over cyber attack:

International oil company Saudi Aramco claims to be over a cyber attack on 15 August and maintains that oil production was not disrupted.

The company said around 30,000 workstation computers that were hit by a virus attack are back online, although remote access is still being restricted “as a precaution”.

Saudi Aramco has also not yet restored its website, displaying a message apologising for any inconvenience instead.

"We have isolated all our electronic systems from outside access as an early precautionary measure that was taken following a sudden disruption which affected some sectors of our network," the message reads. “Most of the damage has now been repaired."

A group named the Cutting Sword of Justice – which blames the Saudi Government for “crimes and atrocities” in several countries – has claimed responsibility for the attack in an online forum.

The group said the state-run oil firm was hit because it was a key source of income for the government, according to the BBC.

Last week, cybersecurity researchers uncovered a new threat called Shamoon that they said was targeting infrastructure in the energy sector, but Saudi Aramco has not said whether this was the malware involved in the attack on its network.

Researchers at security firm Symantec said Shamoon, also known as W32.Disttrack, corrupts files on a compromised computer and overwrites the MBR (Master Boot Record) in an effort to render a computer unusable.

The attack is designed to penetrate a computer via the internet and then target other computers on the same network. Data on the targeted computers is replaced with image files to prevent data recovery.

Shamoon is the latest in a line of attacks that have targeted infrastructure. It follows Stuxnet – which was designed to hit nuclear infrastructure in Iran – and Duqu, Flame and Gauss, that have all sought to infiltrate networks to steal data.

With the increasing computerisation of critical infrastructure services, the energy and utility industries have never been more vulnerable to cyber attacks, according to security firm LogRhythm.

Siemens issues software fix to protect against Stuxnet:

German engineering firm Siemens has issued a fix for the software vulnerabilities in its programmable logic controllers (PLCs) that were exploited by Stuxnet.

The computer worm was discovered in 2010 when it caused malfunctions at industrial plants and factories using Siemens equipment and PLCs.

Iran's nuclear enrichment plants were the supposed target of Stuxnet, which was found in the control systems for several of the country's nuclear facilities, including a nuclear facility at Natanz.

The effectiveness of the Siemens security updates, issued two years later, may never be proven, however, because Stuxnet had a "kill date" of 24 June 2012.

This means the worm has now stopped spreading, said F-Secure's chief research officer, Mikko Hypponen, in a blog post. “But that has little significance, as the operation had already been active for years and reached most of its targets by 2010," he wrote.  

The software update from Siemens comes as reports circulate of a fresh cyber attack on an Iranian nuclear enrichment project, according to the BBC.

F-Secure reported that it received an e-mail believed to have been sent by a scientist at Iran's Atomic Energy Organisation, claiming that two of its plants had been hit by another cyber attack.

Hypponen said F-Secure had not been able to confirm any of the details in the message. However, he did confirm that the message had come from within Iran's Atomic Energy agency.             

The message said: "I am writing to inform you that our nuclear program has once again been compromised and attacked by a new worm, with exploits which have shut down our automation network at Natanz and another facility, Fordo near Qom.

"According to the e-mail our cyber experts sent to our teams, they believe a hacker tool Metasploit was used. The hackers had access to our VPN. The automation network and Siemens hardware were attacked and shut down. I only know very little about these cyber issues as I am scientist, not a computer expert."

On 23 July, Iran issued a statement saying it had successfully "confronted" sophisticated malware and thwarted all the cyber attacks against the nation's infrastructure.

In June, security researchers reported that there was evidence that the creators of the Flame and Stuxnet malware cooperated at least once during the early stages of development.