A recent story about Stuxnet malware has been getting a lot of buzz lately. We covered the Stuxnet story in its early stages, when it was thought to mainly target WinCC, software used to program Siemens industrial control systems. Much of the mainstream press at the time was calling Stuxnet a "worm." But when I corresponded with Siemens on the story, the company itself called the malware a "Trojan." To be helpful, we posted a discussion on the differences between a worm, a virus, and a Trojan.
Then, in a comment to this item, our Electronic editor Bob Repas says, "The Stuxnet malware actually makes use of all three vectors of infection. It will copy itself to a flash drive, or attempt to infect other computers on a networked system without any human intervention, thus giving it worm action. It can also infect from a person running the software (trojan), and as a virus piggybacking on the command and control actions of Seimens WinCC systems, a type of SCADA (supervisory control and data acquisition) product used for manufacturing, to infect other WinCC systems. The malware had four zero-day exploits … attack vectors no one else knew existed until they were found in an analysis of the Stuxnet code. The sophistication of the malware indicates there was major backing, possibly even that of a government, in its development. Of course, the two most likely targets to blame about that are the U.S. and Israel."
Interestingly, in my in-box today is an updated podcast of the Stuxnet story from Nick Younker of the Institute for Defense and Government Advancement.