Stuxnet worm can reinfect PCs even after disinfection

A security researcher has found yet another way the Stuxnet worm infiltrates computers used in nuclear plants and other industrial facilities, a technique that has the ability to reinfect machines even after they've been cleaned of the malware. Stuxnet has already proven itself as one of the most sophisticated pieces of known …

[Anonymous Coward]

@Fraser

Yes all those process set up things are necessary and need to be done properly, and some of them have not been done properly in the case of Stuxnet. But on their own they are not *sufficient*.

Like it or not, Windows has to go, from places where IT don't go. IT don't do factory automation, IT don't do electronic lab equipment, IT don't do hospital medical equipment, etc. Why should these people have to do IT's job for them ?

"if all your programmers program AIX, you wouldn't buy Windows or VMS,"

If an application's requirements call for AIX or VMS, and all you've got is Windows people, then Windows is still the wrong answer. Picking the right tool is the answer.

If you want a hedgecutter you don't buy a lawnmower because there's only lawnmowers in your company's chosen shop do you? Do you? Sensible open-minded people find another shop, perhaps a rental shop if it's only an occasional job, and use the right tool for the work at hand. Even if they're very nice lawnmowers, advertised on QVC and marketed on The Garden Channel, a lawnmower is still not a hedgecutter.

[Ian Stephenson]

Re: a lawnmower is still not a hedgecutter.

Give it a damn good reprogramming with a hammer and it just might do as a hedgecutter.

Remember if brute force is not working - you are not using enough of it.

Yes, thats mine, the one with the sledge hammer in the lining.

[Anonymous Coward]

@Damn good reprogramming with a hammer

I am familiar with this concept, I have used Windows CE (hammered down from Big Windows, right?) and I have worked in factories in Birmingham (from where the expression "Birmingham screwdriver" presumably originates).

Based on that experience, I can assure you that this tactic doesn't always work, though it definitely has its good points.

See, the thing is, even Microsoft know there's a difference between computers and equipment. Equipment is supposed to run Windows CE, not Windows PC. If only the likes of Fraser could see this. How easy is it to get a virus in a ROM file system? (Whether any sensible person uses Windows CE anyway is a different story for a different day).

Anybody want to buy a 2nd hand Flymo, very low mileage, some cosmetic damage?

Can't stop, need to get to B+Q. Unlike some alleged IT people, they have a bit of a clue about using the right tool for the job in hand.

[Anonymous Coward]

CE

I've used CE on dumb terminals, it's a pretty good system for dumb terminal and embedded type stuff. I agree that it would be vastly preferable to use than normal Windows for monitoring terminals etc. You'll still be needing a proper server of some sort to store data and program code and move it to and from the PLCs. However, this wasn't really the point that I was making, I was trying to say that you can safely run normal Windows systems - and many do - with a modicum of though. I daresay that the sort of people who put their main SCADA servers onto a production network which is visible to everything in the site are also the sort of people who run their CE terminals in read/write mode so that anyone can update the local filesystem.

This goes for anything: Don't get non-IT people to design and maintain IT equipment. Likewise, don't get IT guys to operate your plant.

In fact to go further: Don't get single OS only people to design the OS that they are not expert in. We have plenty of people at work who think that because they know UNIX of one sort or another they know Linux, or becuase they know Linux they know Windows. It's just not the case.