The-Accountant-Sep-Oct-2017-Final

Information Technology
CYBERSECURITY
By FCPA Jim McFie, a Fellow of the Institute of Certified Public Accountants of Kenya
On June 17, 2010, an
extremely sophisticated
worm was found by a
Belarus security expert
on one of his client’s
computers. A computer worm is a
type of malicious software program (or
malware) whose primary function is to
infect other computers while remaining
active on infected systems: it is selfreplicating
– it duplicates itself to spread
to uninfected computers. Worms often
use parts of an operating system that
are automatic and invisible to the user.
It is common for worms to be noticed
only when their uncontrolled replication
consumes system resources, slowing
or halting other tasks. A computer
worm infection spreads without user
interaction; all that is necessary is for the
computer worm to become active on an
infected system. Before the widespread
use of networks, computer worms were
spread through infected storage media,
such as floppy diskettes, which, when
mounted on a system, would infect other
storage devices connected to the victim
system. USB drives are still a common
vector for computer worms and the
persons who infected the computers
in Iran did so by leaving USB drives
around the entrance to the Iranian
uranium enrichment facility. If you
found a USB drive, you would probably
put it into your computer to see what
was on the drive. This happened at the
Iranian facility. The worm then did
the job it was designed to do: the end
result was that the centrifuges that were
critical to the uranium enrichment
program in Iran rotated so fast that
they broke apart. The scientists and
engineers in the plant could not find
the cause of this problem. The President
of Iran demanded explanations but
none were forthcoming. The personnel
in the plant did not realize that they
had been “infected” by one of the most
sophisticated worms that has ever been
written – the Stuxnet worm: there is
even a film about it entitled “Zero Days”.
Though it was immediately apparent
that the virus was deadly, it would
take considerably more analysis—
including by Symantec security response
professionals Eric Chien and Liam
O’Murchu—before its true potential
was revealed. Those revelations were
at once awe-inspiring and unsettling,
as Stuxnet turned out to be a complex
program designed to infiltrate, target,
and sabotage the centrifuges at Iran’s
Natanz nuclear facility. It was equipped
to do this even though Natanz’s systems
were disconnected from the internet.
And it was to perform its mission
without “command and control” input—
meaning that its groundbreaking code
would initiate and carry out its tasks
wholly on its own, or as Chien says,
“There was no turning back once Stuxnet
was released”. It came as no surprise
that, after comprehending the scope
of Stuxnet’s potential, the Symantec
experts called it “Hollywood-esque” and
likened it to something out of a “James
Bond” movie.
To make matters worse, Stuxnet
contained four “zero day” exploits,
meaning that at four different stages
of its operation, it was capable of
28 september - october 2017