U.S. federal lab linked to Stuxnet breached

A federally funded U.S. lab that is suspected to have been involved in finding the vulnerabilities in Siemens SCADA systems used by the Stuxnet worm has shut down the Internet connection for its employees following the discovery of a breach into the facility’s systems.

The Oak Ridge National Laboratory – located in Tennessee and funded by the U.S. Department of Energy – is known for performing classified and unclassified research for federal agencies and departments on issues crucial for national security. Among other things, the lab also does cybersecurity research on malware, vulnerabilities and phishing.

It is somewhat ironic, then, that the breach was the result of two employees falling for a malicious email containing a link to a page that exploited a remote-code execution vulnerability in the Internet Explorer browser.

According to Wired, the email was sent to about 530 lab employees, of which 57 believed that the email was coming from the institution’s human resources department and clicked on the link. Of those 57 machines, only two got infected.

It seems that the malware inserted in those two computers lay dormant for a week, and then started to send out stolen data from one of them to a remote server. This was discovered by the administrators who immediately shut down and cleaned up the machine, but a week later, they discovered that other servers were also infected – hence, the total shutdown of Internet access.

Thomas Zacharia, the deputy director of the lab, didn’t say what data had been stolen, but he confirmed it was encrypted. He hopes that the investigation will reveal the nature of the data and the destination of the stolen batch. He also commented that the malware used in the attack was designed to hide on the system and to delete itself if it was unsuccessful on a particular system.

According to a New York Times article, the Oak Ridge National Laboratory was used to test and reveal the vulnerabilities that allowed the Stuxnet worm to target the Natanz nuclear plant. This claim being now in the open, it is easy to see how speculations about the origin of the attack that hit the lab’s network are inevitably going to lean towards Iran.