Mysterious malware can dupe industrial plant operators

  • By Ellen Nakashima The Washington Post
  • Thursday, June 2, 2016 3:12pm
  • Business

A group of researchers discovered a rare instance of malicious computer software cleverly designed to mask the disruption of an industrial machine that’s being used, for instance, at an energy or chemical plant.

The team from FireEye, a cybersecurity firm, stumbled across the malware last year while researching viruses that attack industrial control systems. They dubbed it Irongate.

The researchers say it’s only the fourth such class of malware ever found. The most well-known example of this kind of malware is Stuxnet, which damaged nearly 1,000 centrifuges at an Iranian nuclear facility and was discovered in 2010. Stuxnet was jointly created by the United States and Israel, though neither country has officially acknowledged its involvement.

The FireEye team does not know who created Irongate or why, and the researchers say the malware is designed to work only on software that simulates a real machine.

But, the team said, its characteristics are still noteworthy.

For instance, researchers said the malware records five seconds of normal control activity and then plays it back over and over to deceive a control room operator into thinking everything is fine.

At the same time, as the operator sees only normal activity on his screen, the malware is able to substitute computer files that alter the temperature and pressure on a specific type of Siemens control system.

“You’re talking about physical equipment that needs to be monitored to be stable,” said Stephen Ward, FireEye communications director. “So if you can make them think everything’s fine here, don’t worry, they have no ability to respond. That’s alarming.”

The firm could find no clues to authorship.

“It could be research activity or it could be some sort of testing of concepts for a future attack,” said Dan Scali, a team member.

Whatever it is, he said, “it highlights challenges we have in the industry in detecting these types of threats.”

Team member Rob Caldwell said there have been no signs that the malware has been used in the real world.

The researchers found the malware on VirusTotal, a free online service and Google subsidiary that analyzes suspicious computer files and facilitates the detection of worms and other malware.

They marveled that it had sat on the database, unanalyzed, for two years before they spotted it.

Irongate also has an ability to detect and evade “sandboxes,” or software programs that try to protect systems by test-running suspicious computer code before it is allowed to enter a network to see what the code does. When Irongate detects a sandbox, it shuts itself down.

They found a couple of similarities to Stuxnet.

Both Stuxnet and Irongate were designed to work on a single, highly specific process. With Stuxnet, it was control systems running uranium-enrichment centrifuges at Natanz. With Irongate, it is a specific simulated industrial process relying on Siemens software.

Both pieces of malware replace data files to manipulate a machine’s operation. Stuxnet accelerated the spinning of the centrifuges. Irongate appears to alter temperature and pressure.

But unlike Stuxnet, which was much more powerful, Irongate works only in a simulated environment. And Stuxnet was launched by two countries seeking to alter the behavior of a third – Iran. With Irongate, the creator’s motive is unknown.

“Our hope,” Scali said, “is we will get more information from the community” of researchers.

Talk to us

> Give us your news tips.

> Send us a letter to the editor.

> More Herald contact information.

More in Business

Mattie Hanley, wife of DARPA director Stephen Winchell, smashes a bottle to christen the USX-1 Defiant, first-of-its kind autonomous naval ship, at Everett Ship Repair on Monday, Aug. 11, 2025 in Everett, Washington. (Olivia Vanni / The Herald)
No crew required: Christening held for autonomous ship prototype in Everett

Built in Whidbey Island, the USX-1 Defiant is part of a larger goal to bring unmanned surface vessels to the US Navy.

Cassie Smith, inventory manager, stocks shelves with vinyl figures in 2020 at the Funko store on Wetmore Avenue in Everett. (Andy Bronson / The Herald)
Everett-based Funko reports $41M loss in the 2nd quarter

The pop culture collectables company reported the news during an earnings call on Thursday.

A Boeing 737 Max 10 prepares to take off in Seattle on June 18, 2021. MUST CREDIT: Bloomberg photo by Chona Kasinger.
When Boeing expects to start production of 737 MAX 10 plane in Everett

Boeing CEO says latest timeline depends on expected FAA certification of the plane in 2026.

Kongsberg Director of Government Relations Jake Tobin talks to Rep. Rick Larsen about the HUGIN Edge on Thursday, July 31, 2025 in Lynnwood, Washington. (Olivia Vanni / The Herald)
Norwegian underwater vehicle company expands to Lynnwood

Kongsberg Discovery will start manufacturing autonomous underwater vehicles in 2026 out of its U.S. headquarters in Lynnwood.

Ben Paul walks through QFC with Nala on Saturday, July 14, 2018 in Everett, Wa. (Olivia Vanni / The Herald)
QFC to close Mill Creek location, part a plan to close similar stores across the nation

A state layoff and closure notice says 76 employees will lose their jobs as a result of the closure.

Logo for news use featuring the municipality of Snohomish in Snohomish County, Washington. 220118
Garbage strike over for now in Lynnwood, Edmonds and Snohomish

Union leaders say strike could return if “fair” negotiations do not happen.

Richard Wong, center, the 777-X wing engineering senior manager, cheers as the first hole is drilled in the 777-8 Freighter wing spar on Monday, July 21, 2025 in Everett, Washington. (Olivia Vanni / The Herald)
Boeing starts production of first 777X Freighter

The drilling of a hole in Everett starts a new chapter at Boeing.

Amit B. Singh, president of Edmonds Community College. 201008
Edmonds College and schools continue diversity programs

Educational diversity programs are alive and well in Snohomish County.

Downtown Edmonds is a dining destination, boasting fresh seafood, Caribbean-inspired sandwiches, artisan bread and more. (Taylor Goebel / The Herald)
Edmonds commission studying parking fees and business tax proposals

Both ideas are under consideration as possible revenue solutions to address a $13M budget shortfall.

Skylar Maldonado, 2, runs through the water at Pacific Rim Plaza’s Splash Fountain, one of the newer features add to the Port of Everett waterfront on Tuesday, July 15, 2025 in Everett, Washington. (Olivia Vanni / The Herald)
CEO: Port of Everett pushes forward, despite looming challenges from tariffs

CEO Lisa Lefeber made the remarks during the annual port report Wednesday.

Britney Barber, owner of Everett Improv. Barber performs a shows based on cuttings from The Everett Herald. Photographed in Everett, Washington on May 16, 2022. (Kevin Clark / The Herald)
August 9 will be the last comedy show at Everett Improv

Everett improv club closing after six years in business.

Support local journalism

If you value local news, make a gift now to support the trusted journalism you get in The Daily Herald. Donations processed in this system are not tax deductible.