Stuxnet garnered a ton of media attention when it managed to cripple Iran’s nuclear program but a new worm recently detailed by Symantec is attacking the country on a different and perhaps even more damaging level.
A new virus called Narilam started infiltrating the country’s banking systems during the past week. As outlined by the security company, the worm works much like any other in that it copies itself to infected machines, adds registry keys and can be spread via removable drives and over networks.
The code is written in Delphi, a common language used to produce malware. What’s not common about Narilam, however, is the fact that it can manipulate a Microsoft SQL database that is accessible by OLEDB. Symantec says it specifically goes after SQL databases that have one of three distinct names: alim, maliran or shahd.
Also unlike other malware, Narilam isn’t designed to spy on a user or their data. Instead, the code simply works itself into systems that deal with money and does its best to screw up data. As you can imagine, this is bad news for banks as it could potentially permanently destroy valuable financial records.
At this hour, it seems that the best defense against the worm is a good backup strategy that an institution could resort to in the event they become infected. Even still, Symantec says an infected database could be difficult to restore. Service disruption and permanent loss would both be expected as part of a successful attack.
There’s no word yet on who is responsible for creating the worm. For their part, Iran says the worm hasn’t been a serious concern as of yet. Granted, they probably wouldn’t admit it even if it was causing chaos in the financial sector.
https://www.techspot.com/news/50908-new-worm-is-designed-to-attack-iran-financial-institutions.html
