Kill timer found in Shamoon malware suggests possible connection to Saudi Aramco attack

Shamoon's disk-wiping functionality was set to activate at the exact time when hackers claim to have attacked Saudi Aramco

A timer found in the Shamoon cyber-sabotage malware discovered last week matches the exact time and date when a hacktivist group claims to have disabled thousands of computers from the network of Saudi Aramco, the national oil company of Saudi Arabia.

"We penetrated a system of Aramco company by using the hacked systems in several countries and then sent a malicious virus to destroy thirty thousand computers networked in this company," a group called the "Cutting Sword of Justice" said in a Pastebin post on Aug. 15. "The destruction operations began on Wednesday, Aug 15, 2012 at 11:08 AM (Local time in Saudi Arabia) and will be completed within a few hours."

That same day, Saudi Aramco confirmed that some sectors of its computer network were affected by a computer virus that infected workstations used by its employees. However, the incident did not impact the oil production operations in any way, Aramco said at the time.

The news was followed by announcements from several antivirus vendors including Symantec, McAfee and Kaspersky Lab about the discovery of a new destructive piece of malware called Shamoon or Disttrack.

Shamoon contains a so-called wiper module designed to overwrite files from certain directories and the hard disk drive's Master Boot Record (MBR) -- a special region of the disk that contains information about its partitions.

Given the similarities between Shamoon's functionality and the hacktivist group's description of the Aramco attack, there is speculation that the malware might be responsible for the Saudi Arabian company's recent computer problems.

Some other bits of information also pointed in this direction, like Symantec's statement that the malware was used in a targeted attack against an unnamed organization from the energy sector or that a path string found inside the malware included a directory called "ArabianGulf."

However, the most convincing piece of evidence found so far consists of a timer that activates the malware's file and MBR wiping functionality.

"The dropper determines whether a specified date has come or not," Kaspersky Lab researcher Dmitry Tarakanov said Tuesday in a blog post. "The hardcoded date is 15th August 2012 08:08 UTC."

This coincides with the exact time and date when the "Cutting Sword of Justice" hackers claimed the so-called destruction of Aramco computers began -- Wednesday, Aug 15, 2012, at 11:08 a.m. local time in Saudi Arabia (UTC+3:00).

"This is only one indication that the events could possibly be related, and that's only if the Pastebin posting is legitimate," Kaspersky Lab chief security expert Alexander Gostev said Thursday via email. "At this time there is not enough concrete evidence to connect the two events."

Other details don't match up. For example, an internal network IP address used by the Shamoon samples analyzed by antivirus vendors was not present in a list of Aramco internal IP addresses released in a separate Pastebin post by the hackers on Aug. 17.

"This might mean that those samples are part of an attack on a different entity," Aviv Raff, the chief technology officer at security firm Seculert, said Thursday via email. "Or, this is indeed part of the attack against Aramco, but the attackers decided not to share this IP address in the pastes."

In yet another Pastebin post published Wednesday, possibly by the same hackers, they threaten to attack Aramco a second time on Aug. 25 at 21:00 GMT, Raff said.

In its original announcement, the "Cutting Sword of Justice" hacktivist group said that it targeted Aramco because it is the main financial source for Saudi Arabia's Al Saud regime, which the group claims supported oppressive government actions in countries like Syria, Bahrain, Yemen, Lebanon or Egypt.

However, not everyone is convinced by its alleged anti-government-oppression agenda. "I've heard speculation from more than one source in Saudi Arabia that the malware attack against Saudi Aramco's network was an Iranian operation to discourage Saudi Armaco from increasing its oil production to compensate for Iran's decrease in oil deliveries due to sanctions imposed on it by the U.S. and European Union," cybersecurity expert and analyst Jeffrey Carr said Tuesday in a blog post.

"Iran has been known to use its indigenous hacker population to run state-sponsored attacks in the past during Operation Cast Lead (Ashianeh Security Group)," Carr said. "Other well-known and highly skilled Iranian hackers include the Iranian Cyber Army and ComodoHacker."

"During our analysis of the Shamoon malware we noticed an error in the data comparison routine," Kaspersky's Gostev said. "In our experience, such programming errors are not commonly found in sophisticated cyber-weapons; however, we currently do not have enough tangible evidence to determine what type of threat actors or groups were behind Shamoon."

Back in April, computers from Iran's oil ministry were also attacked using a piece of malware with data-wiping functionality. That malware has never been identified, but Kaspersky Lab researchers concluded last week, based on known technical details, that Shamoon was most likely not involved in those attacks.

However, Shamoon might be a copycat of the wiper malware used in Iran that was created by hackers inspired by that incident, the Kaspersky researchers said at the time.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?