Shamoon

Modular computer virus

For the apostle of Jesus, see Shamoon al-Safa. For the actor, see Shamoon Abbasi.

Shamoon[a] (Persian: شمعون), also known as W32.DistTrack,[1] is a modular computer virus that was discovered in 2012, targeting then-recent 32-bit NT kernel versions of Microsoft Windows. The virus was notable due to the destructive nature of the attack and the cost of recovery. Shamoon can spread from an infected machine to other computers on the network. Once a system is infected, the virus continues to compile a list of files from specific locations on the system, upload them to the attacker, and erase them. Finally the virus overwrites the master boot record of the infected computer, making it unusable.[2][3]

The virus was used for cyberwarfare[4] against national oil companies including Saudi Arabia's Saudi Aramco and Qatar's RasGas.[5][2][6] A group named "Cutting Sword of Justice" claimed responsibility for an attack on 30,000 Saudi Aramco workstations, causing the company to spend more than a week restoring their services.[7] The group later indicated that the Shamoon virus had been used in the attack.[8] Computer systems at RasGas were also knocked offline by an unidentified computer virus, with some security experts attributing the damage to Shamoon.[9] It was later described as the "biggest hack in history".[3]

Symantec, Kaspersky Lab,[10] and Seculert announced discovery of the malware on 16 August 2012.[2][11] Kaspersky Lab and Seculert found similarities between Shamoon and the Flame malware.[10][11] Shamoon made a surprise comeback in November 2016,[12] January 2017,[13] and December 2018.[14]

## Design

[edit]

Shamoon was designed to erase and overwrite hard drive data with a corrupted image and report the addresses of infected computers back to the computer inside the company's network.[15] The malware had a logic bomb which triggered the master boot record and data wiping payload at 11:08 am local time on Wednesday, August 15. The attack occurred during the month of Ramadan in 2012. It would appear that the attack was timed to occur after most staff had gone on holiday reducing the chance of discovery before maximum damage could be caused, hampering recovery.

The virus consisted of three components, the Dropper, the Wiper and the Reporter. The Dropper, the source of the infection, creates a service with the name 'NtsSrv' that enables it to remain persistent on the infected computer. The Dropper was built in 32-bit and 64-bit versions. If the 32-bit dropper detects a 64-bit architecture, it drops the 64-bit version. This component drops the Wiper and the Reporter onto the infected computer and executes itself. It spreads across a local network by copying itself to network shares and on to other computers.[16]

The Wiper component utilizes an Eldos-produced driver known as RawDisk to achieve direct user-mode access to a hard drive without using Windows APIs. It identifies the locations of all files on the infected computers and erases them. It sends information about the files destroyed to the attacker and then overwrites the erased files with corrupted data so they cannot be recovered. The component used portions of an image. In the 2012 attack it used an image of a burning U.S. flag; in the 2016 attack it used a photo of the body of Alan Kurdi.[17][18][12]

## Before the attack

[edit]

The malware was unique, used to target the Saudi government by causing destruction to the state-owned national oil company Saudi Aramco. The attackers posted a pastie on Pastebin hours prior to the wiper logic bomb occurring, citing "oppression" and the Saudi government as a reason behind the attack.[19] According to Chris Kubecka, a security advisor to Saudi Aramco after the attack and group leader of security for Aramco Overseas, the attack was well-staged.[3] It was initiated by a phishing email attack that an unnamed Saudi Aramco Information Technology employee opened, giving the group entry into the company's network around mid-2012.[20]

> We, behalf of an anti-oppression hacker group that have been fed up of crimes and atrocities taking place in various countries around the world, especially in the neighboring countries such as Syria, Bahrain, Yemen, Lebanon, Egypt and ..., and also of dual approach of the world community to these nations, want to hit the main supporters of these disasters by this action. One of the main supporters of this disasters [sic] is Al-Saud corrupt regime that sponsors such oppressive measures by using Muslims oil resources. Al-Saud is a partner in committing these crimes. It's [sic] hands are infected with the blood of innocent children and people. In the first step, an action was performed against Aramco company, as the largest financial source for Al-Saud regime. In this step, we penetrated a system of Aramco company by using the hacked systems in several countries and then sent a malicious virus to destroy thirty thousand computers networked in this company. The destruction operations began on Wednesday, Aug 15, 2012 at 11:08 AM (Local time in Saudi Arabia) and will be completed within a few hours.[21]

Pastie announcing attack against Saudi Aramco by a group called Cutting Sword of Justice

Kubecka described in a Black Hat USA talk that Saudi Aramco placed the majority of their security budget on the ICS control network, leaving the business network at risk for a major incident.[20]

## During the attack

[edit]

On 15 August at 11:08 am local time, over 30,000 Windows based systems began to be overwritten. Symantec found some of the affected systems showed an image of an American flag while their data was being deleted and overwritten.[2] Saudi Aramco announced the attack on their Facebook page and went offline again until a company statement was issued on 25 August 2012. The statement falsely reported normal business was resumed on 25 August 2012. However a Middle Eastern journalist leaked photographs taken on 1 September 2012 showing kilometers of petrol trucks unable to be loaded due to hacked business systems still inoperable.

Tanker trucks unable to be loaded with gasoline due to Shamoon attacks

"Saudi Aramco has restored all its main internal network services that were impacted on August 15, 2012, by a malicious virus that originated from external sources and affected about 30,000 workstations. The workstations have since been cleaned and restored to service. As a precaution, remote Internet access to online resources was restricted. Saudi Aramco employees returned to work August 25, 2012, following the Eid holidays, resuming normal business. The company confirmed that its primary enterprise systems of hydrocarbon exploration and production were unaffected as they operate on isolated network systems. Production plants were also fully operational as these control systems are also isolated."

On August 29, 2012 the same attackers behind Shamoon posted another pastie on PasteBin.com, taunting Saudi Aramco with proof they still retained access to the company network. The post contained the username and password on security and network equipment and the new password for Aramco CEO Khalid Al-Falih.[22] The attackers also referenced a portion of the Shamoon malware as further proof in the pastie:

> "mon 29th aug, good day, SHN/AMOO/lib/pr/~/reversed

> We think it's funny and weird that there are no news coming out from Saudi Aramco regarding Saturday's night. well, we expect that but just to make it more clear and prove that we're done with we promised, just read the following facts -valuable ones- about the company's systems:

> \- internet service routers are three and their info as follows:

>     Core router: SA-AR-CO-1# password (telnet): c1sc0p@ss-ar-cr-tl / (enable): c1sc0p@ss-ar-cr-bl
>     Backup router: SA-AR-CO-3# password (telnet): c1sc0p@ss-ar-bk-tl / (enable): c1sc0p@ss-ar-bk-bl
>     Middle router: SA-AR-CO-2# password (telnet): c1sc0p@ss-ar-st-tl / (enable): c1sc0p@ss-ar-st-bl

> \- Khalid A. Al-Falih, CEO, email info as follows:

>     Khalid.falih@aramco.com password:kal@ram@sa1960

> \- security appliances used:

>     Cisco ASA # McAfee # FireEye :
>     default passwords for all!!!!!!!!!!

> We think and truly believe that our mission is done and we need no more time to waste. I guess it's time for SA to yell and release something to the public. however, silence is no solution.

> I hope you enjoyed that. and wait our final paste regarding SHN/AMOO/lib/pr/~

> angry internet lovers #SH"

According to Kubecka, in order to restore operations, Saudi Aramco used its large private fleet of aircraft and available funds to purchase much of the world's hard drives, driving the price up. New hard drives were required as quickly as possible so oil prices were not affected by speculation. By September 1, 2012 gasoline resources were dwindling for the public of Saudi Arabia 17 days after the August 15th attack. RasGas was also affected by a different variant, crippling them in a similar manner.[20]

It is unclear why the attacker may have an interest in actually destroying the infected PC. Kaspersky Labs hinted that the 900 KB malware could be related to Wiper, that was used in a cyber attack on Iran in April. After a 2-day analysis, the company erroneously concluded that the malware is more likely to come from "scriptkiddies" who were inspired by Wiper.[23] Later, in a blog post, Eugene Kaspersky clarified the use of Shamoon categorizing as cyberwarfare.[24]

## See also

[edit]

* Iran–Saudi Arabia relations

## Notes

[edit]

1. ^ "Shamoon" is part of a directory string found in the virus' Wiper component.

## References

[edit]

1. ^ "Joint Security Awareness Report (JSAR-12-241-01B):'Shamoon/DistTrack' Malware (Update B)". United States Department of Homeland Security ICS-CERT. 2017-04-18. Retrieved 2017-11-03.
2. ^ a b c d Symantec Security Response (2012-08-16). "The Shamoon Attacks". Symantec. Retrieved 2012-08-19.
3. ^ a b c Jose Pagliery (2015-08-05). "The inside story of the biggest hack in history". Retrieved 2012-08-19.
4. ^ Iain Thompson (2012-08-17). "Exhibitionist Shamoon virus blows PCs' minds". The Register. Retrieved 2017-11-03.
5. ^ Tim Sandle (2012-08-18). "Shamoon virus attacks Saudi oil company". Digital Journal. Retrieved 2012-08-19.
6. ^ "Shamoon virus targets energy sector infrastructure". BBC News. 2012-08-17. Retrieved 2012-08-19.
7. ^ Nicole Perlroth (2012-10-23). "Cyberattack On Saudi Firm Disquiets U.S." The New York Times. pp. A1. Retrieved 2012-10-24.
8. ^ Elinor Mills (2012-08-30). "Virus knocks out computers at Qatari gas firm RasGas". CNET. Retrieved 2012-09-01.
9. ^ "Computer virus hits second energy firm". BBC News. 2012-08-31. Retrieved 2012-09-01.
10. ^ a b GReAT (2012-08-16). "Shamoon the Wiper — Copycats at Work". Archived from the original on 2012-08-20. Retrieved 2012-08-19.
11. ^ a b Seculert (2012-08-16). "Shamoon, a two-stage targeted attack". Seculert. Archived from the original on 2012-08-20. Retrieved 2012-08-19.
12. ^ a b Symantec Security Response (2016-11-30). "Shamoon: Back from the dead and destructive as ever". Symantec. Retrieved 2016-12-06.
13. ^ "Saudi Arabia warns on cyber defense as Shamoon resurfaces". Reuters. 2017-01-23. Retrieved 2017-01-26.
14. ^ Stephen Jewkes, Jim Finkle (2018-12-12). "Saipem says Shamoon variant crippled hundreds of computers". Reuters. Retrieved 2020-09-24.
15. ^ Porche III, Isaac R. (2020). Cyberwarfare - An Introduction to Information-Age Conflict/. Artech House. p. 264\. ISBN 978-1-5231-3277-5.
16. ^ Mackenzie, Heather (2012-10-25). "Shamoon Malware and SCADA Security – What are the Impacts?".
17. ^ Sean Gallagher (2016-12-01). "Shamoon wiper malware returns with a vengeance". Ars Technica. Retrieved 2017-07-03.
18. ^ Nicole Perlroth (2012-08-24). "Among Digital Crumbs from Saudi Aramco Cyberattack, Image of Burning U.S. Flag". Bits. The New York Times. Retrieved 2017-07-03.
19. ^ Cutting Sword of Justice (2012-08-15). "Pastie:'Untitled'". Retrieved 2017-11-03.
20. ^ a b c Christina Kubecka (2015-08-03). "How to Implement IT Security after a Cyber Meltdown". YouTube. Retrieved 2017-11-03. (PDF slides, YouTube video)
21. ^ Rid, Thomas (2013). Cyber War Will Not Take Place. Oxford University Press. p. 63\. ISBN 978-0-19-936546-3.
22. ^ "Saudi Aramco hug, another one". 2012-08-29. Retrieved 2017-11-03.
23. ^ Wolfgang Gruener (2012-08-18). "Cyber Attack: Shamoon Malware Infects, Steals, Wipes MBR". Tom's Hardware. Retrieved 2017-03-22.
24. ^ Eugene Kaspersky (2017-03-06). "StoneDrill: We've Found New Powerful "Shamoon-ish" Wiper Malware – and It's Serious". Retrieved 2017-11-03.

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora (publication of 2009 events)
* Australian cyberattacks
* Operation Olympic Games
* Operation ShadowNet
* Operation Payback

|

2011|

* Canadian government
* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* PlayStation network outage
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism attack of June 25
* 2013 Yahoo! data breach
* Singapore cyberattacks

2014|

* Anthem medical data breach
* Operation Tovar
* 2014 celebrity nude photo leak
* 2014 JPMorgan Chase data breach
* 2014 Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* HackingTeam
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Surkov leaks
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections
* 2016 Bitfinex hack

2017|

* SHAttered
* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster data breach
* Petya and NotPetya
* 2017 Ukraine ransomware attacks
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Atlanta cyberattack
* SingHealth data breach

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* Bulgarian revenue agency hack
* WhatsApp snooping scandal
* Jeff Bezos phone hacking incident

Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* Teamp0ison
* TDO
* UGNazi
* Ukrainian Cyber Alliance

Groups|

* Appin
* Bangladesh Black Hat Hackers
* Bureau 121
* Charming Kitten
* Cozy Bear
* Dark Basin
* DarkMatter
* Elfin Team
* Equation Group
* Fancy Bear
* GOSSIPGIRL (confederation)
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Islamic State Hacking Division
* Lazarus Group
* BlueNorOff
* AndAriel
* Lords of Dharmaraja
* NSO Group
* Numbered Panda
* PLA Unit 61398
* PLA Unit 61486
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Stealth Falcon
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* xDedic
* Yemen Cyber Army

Individuals|

* Ryan Ackroyd
* Mustafa Al-Bassam
* Kim Anh Vo
* George Hotz
* Guccifer
* Elliott Gunton
* Jeremy Hammond
* Sam Hocevar
* Junaid Hussain
* MLT
* Sabu
* Track2
* Topiary
* The Jester

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* SS7 vulnerabilities (2014)
* WinShock (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Exactis (2018)
* Speculative Store Bypass (2018)
* Lazy FP state restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Dragonblood (2019)
* Microarchitectural Data Sampling (2019)
* BlueKeep (2019)
* Kr00k (2019)

Malware|

| 2010|

* Bad Rabbit
* Black Energy 2
* SpyEye
* Stuxnet

|

2011|

* Coreflood
* Alureon
* Duqu
* Kelihos
* Metulji botnet
* Stars

2012|

* Carna
* Dexter
* FBI
* Flame
* Mahdi
* Red October
* Shamoon

2013|

* CryptoLocker
* DarkSeoul

2014|

* Brambul
* Black Energy 3
* Carbanak
* Careto
* DarkHotel
* Duqu 2.0
* FinFisher
* Gameover ZeuS
* Regin

2015|

* Dridex
* Hidden Tear
* Rombertik
* TeslaCrypt
* Project Sauron

2016|

* Hitler
* Jigsaw
* KeRanger
* Necurs
* MEMZ
* Mirai
* Pegasus
* Petya and NotPetya
* X-Agent

2017|

* BrickerBot
* Kirk
* LogicLocker
* Rensenware
* Triton
* WannaCry
* XafeCopy

2018|

* VPNFilter

2019|

* Grum
* Joanap
* NetTraveler
* R2D2
* Tinba
* Titanium
* ZeroAccess botnet

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template