16 November 2010

If you know about Zippe uranium enrichment centrifuge operation you will understand what messing with the revs does.





STUXNET
"STop UneXploded Network-version"

Oh Myrtle...

http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf

SDB check
The System Data Blocks are enumerated and parsed. Stuxnet must find an SDB with the DWORD at offset 50h equal to 0100CB2Ch. This specifies the system uses the Profibus communications processor module CP 342-5. Profibus is a standard industrial network bus used for distributed I/O, In addition, specific values are searched for and counted: 7050h and 9500h. The SDB check passes if, and only if, the total number of values found is equal to or greater than 33. These appear to be Profibus identification numbers, which are required for all Profibus DP devices except Master Class 2 devices. Identification numbers are assigned to manufacturers by Profibus & Profinet International (PI) for each device type they manufacture. 7050h is assigned to part number KFC750V3 which appears to be a frequency converter drive (also known as variable frequency drive) manufactured by Fararo Paya in Teheran, Iran. 9500h is assigned to Vacon NX frequency converter drives manufactured by Vacon based in Finland.
Frequency converter drives are used to control the speed of another device, such as a motor. For example, if the frequency is increased, the speed of the motor increases. Frequency converter drives are used in multiple industrial control industries including water systems, HVAC, gas pipelines, and other facilities.