Hydraq, a Trojan Back-Door Remote Controller

Image via Wikipedia

Trojan Horse

Win32/Hydraq.B is a Trojan horse virus with a back-door remote controller that allows the intruder to retrieve system and user information, shutdown or reboot the system, execute commands on a remote shell, download and execute an arbitrary file, then save it to %Temp%\mdm.exe, escalate user privilege, copy, move, or delete files, and many other things. Viruses such as this one are increasing the stakes of IT security professionals.

This video from the Symantec Security Response blog shows how hydraq works:

Stuxnet, the first true Cyber-weapon targeting Infrastructure

Image via Wikipedia

Image via Wikipedia

Basic SCADA

Win32/Stuxnet is almost certainly the most sophisticated virus yet developed for targeted attacks.  Stuxnet is parasite code that focuses on subverting SCADA systems, the automated monitoring and control systems of many modern manufacturing, production, power generation, transmission and distribution, fabrication, water treatment and distribution, wastewater collection and treatment, oil and gas refining and transmission, and communication systems.  Many SCADA software vulnerabilities can potentially be exploited by Stuxnet.  All current and future efforts to secure infrastructure must now adapt to and address this potential new mode of attack on our infrastructure.   

Related articles

• Cracking Stuxnet, a 21st-century cyber weapon [Greg Laden's Blog] (scienceblogs.com)
• Yet more on Win32/Stuxnet (eset.com)
• Stuxnet Evolves: (warintel.blogspot.com)
• Stuxnet, SCADA and malware (eset.com)