Trend Micro releases free Stuxnet detection tool

Trend Micro said it is still getting calls from customers concerned about the Stuxnet malware

Trend Micro has released a tool that administrators can use to scan dozens of computers at a time for Stuxnet, the malicious software program that has raised widespread concern for its targeting of industrial systems made by Siemens.

Trend Micro's security products will detect Stuxnet, but the company decided to build a tool that would let other people not using its products detect the malware, said David Sancho, a senior researcher with Trend Micro. Administrators may also want to run the tool to verify that their security software is indeed detecting and removing the program, he said.

The Stuxnet tool can scan all computers within a specific Internet Protocol range. To find the malware, the tool transmits spoofed packets that are similar to the packets sent by the two or three Stuxnet variants. If Stuxnet is present, it will respond to the spoofed packets.

Stuxnet is a worm that was designed to infect Windows computers running Siemens WinCC SCADA (supervisory control and data acquisition) systems, which are used for industrial manufacturing processes.

Researchers have had a tough time figuring out exactly what Stuxnet aimed to do once it infected those systems. But in a report released by Symantec last Friday, researchers found that Stuxnet looks for frequency converter drives, which change electrical output from a power grid to a much higher frequency.

The higher frequencies are required for processing such as in uranium enrichment. The finding gives more solid backing to theories that Stuxnet was designed by a nation-state to disrupt nuclear technology development in countries such as Iran, which reported Stuxnet infections.

But while Stuxnet is highly advanced in some ways, it also had flaws. Because it is a worm, it can spread rapidly, which is part of the reason why security researchers eventually discovered it. Months after it has been discovered, Trend Micro has found that it is still spreading, particularly on computers in places such as China where there is a lower general use of security software, Sancho said.

"We see it propagating all over the place," Sancho said. "There's a lot of people who have it."

Join the CSO newsletter!

Error: Please check your email address.

Tags trend microsecurityDesktop securityExploits / vulnerabilitiesdata protectionmalware

More about SiemensSymantecTrend Micro Australia

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts