The new war domain at work.

This is cyber warfare.

So far at its best.

Pinpoint surgical strike dependent on, and triggered by enemies actions.

The claim cyber weapons are to indiscriminate and cause collateral damage 

has been dispelled, 

Stuxnet even uses a finger print to be sure of target.

http://warintel.blogspot.com/2010/09/cyber-weapons-not-indiscriminate.html

The public vector for this potential attack is social engineering.

Plug in an infected UBS and it spreads to networks and other UBS

also, eventually reaching its target.

Some info has been released about this IPR ( invisible persistent rootkit )

methods of self defense and stealth.

Even if you know where it hides, the exact file and you look at, read

the file, the rootkit intercepts your request and shows you a sanitized clean 

version of the files you are looking at, and it does this on the fly.

It has built in artificial Intelligence, and several methods to make contact

with the "Boss" , but it doesn't need contact, its pre-programed, looking

for specific exact conditions on specific exact networks it has a finger

print for the specfic target, and it has rules of engagement built in.

If you replace the infected files over write them they are reinfected on the

fly as your reload them.

The persistent part has not been fully explored yet. In this area,

it is one of the most advanced rootkits, real cutting edge craft.

The question remains if it can be repackaged, and repurposed 

on maybe Metasploit?

Ralph Langner this week at the 2010 ACS Conference in Maryland predicted
 that the Stuxnet exploits will be available in Metasploit within 6 months.
We don't think so, Attempts to repackage this will result in vaporware, pftt
its gone.
Its an excellent response to Iran's secret nuclear
program, as it is context sensitive.
If Iran stays within peaceful activities it remains
dormant, but if they cross the line their Nuclear
program ends, not in an explosion but in failure,
cause, vector, actions, actors all unknown.

And its going to be a bitch to get rid of.

You will just NEVER be sure.

Gerald

Tactical Internet Systems analyst.

http://warintel.blogspot.com/2010/09/stuxnet-is-not-new.html

Yes there are invisible persistent rootkits IPR

.

Quiz: who said "Trust but Verify" ? good for 3 pts. G

“new era of engagement” that is the trademark of Obama’s foreign policy. 
“Engagement” looks like this: Total Engagement...New def for
"Total Engagement"  ...tee hee G
Hats off to NSA. Salute.


.



.