Thursday, September 30, 2010

Myrtus

There has been much speculation recently that the Stuxnet worm that has been mainly infecting Seimens PLC's and SCADA networks in the Far and Middle East and South Asia regions was in fact a directed attack on Iran's nuclear program. Ralph Langner, a German Industrial controls specialist, decoded and disassembled the payload of the Stuxnet worm which used flaws in Windows to propagate a destructive payload to control PLC's which were being controlled by the Windows based SCADA network. He found that the program looked for specific segments of code in specific data blocks and attempted to disrupt the process controlled by that code by swapping out the code and hiding that the swap occurred from the operator. It did this by inserting the malware into the operating system EEPROM of the PLC. essentially this was the first known instance of a rootkit being used on a PLC. Up until recently this was assumed to be the work of either the US or Israel, mainly based on who would stand to benefit from the attack.

Now there would appear to be another clue to it's origins. Researchers have found that the project was named Myrtus, and one of it's processes was named Guava. Myrtus is the name of the genus of Guava plants, and myrtles, cloves and eucalyptus trees among others. Myrtus is also very close to and is an allusion to the Hebrew word for Esther.

Now here is where things start sounding plausible. In the Book of Esther, palace intrigue in the court of Xerxes By Esther, woman who was taken by Xerxes as one of his wives and who is secretly Jewish, thwarts an attempted Jewish genocide.

From the Wikipedia article on the Book of Esther:

The book commences with a feast organized by Ahasuerus (Xerxes), initially for his court and dignitaries and afterwards for all inhabitants of Shushan. Ahasuerus orders his wife Vashti to display her beauty before the guests. She refuses. Ahasuerus removes her as queen. Ahasuerus then orders all "beautiful young girls to be presented to him, so he can choose a new queen to replace Vashti. One of these is Esther, who had no parents and is being fostered by her cousin Mordechai. She finds favor in the king's eyes, and is made his new wife. Esther does not reveal that she is Jewish. Shortly afterwards, Mordechai discovers a plot by courtiers Bigthan and Teresh to assassinate Ahasuerus. They are apprehended and executed, and Mordechai's service to the king is recorded.

Ahasuerus appoints Haman as his prime minister. Mordechai, who sits at the palace gates, falls into Haman's disfavor as he refuses to bow down to him. Having found out that Mordechai is Jewish, Haman plans to kill not just Mordechai but all the Jews in the empire. He obtains Ahasuerus' permission to execute this plan, against payment of ten thousand talents of silver, and he casts lots to choose the date on which to do this—the thirteenth of the month of Adar. When Mordechai finds out about the plans he orders fasting. Mordechai informs Esther what has happened and tells her to intercede with the King. She is afraid to break the law and go to the King unsummoned. This action would incur the death penalty. Mordechai tells her that she must. She requests that all Jews fast and pray for three days together with her, and on the third day she goes to Ahasuerus, who stretches out his sceptre to her which shows that she is not to be punished. She invites him to a feast in the company of Haman. During the feast, she asks them to attend a further feast the next evening. Meanwhile, Haman is again offended by Mordechai and builds a gallows for him. That night, Ahasuerus suffers from insomnia, and when the court's records are read to him to help him sleep, he learns of the services rendered by Mordechai in the previous plot against his life. Ahasuerus is told that Mordechai has not received any recognition for saving the king's life. Just then, Haman appears, and King Ahasuerus asks Haman what should be done for the man that he wishes to honor. Thinking that the man that the king wishes to honor is himself, Haman says that the man should be dressed in the king's royal robes and led around on the king's royal horse, while a herald calls: "See how the king honours a man he wishes to reward!" To his horror, the king instructs Haman to do so to Mordechai.

Later that evening, Ahasuerus and Haman attend Esther's second banquet, at which she reveals that she is Jewish and that Haman is planning to exterminate her people, including her. Overcome by rage, Ahasuerus leaves the room; meanwhile Haman stays behind and begs Esther for his life, falling upon her in desperation. The king comes back in at this moment and thinks Haman is assaulting the queen; this makes him angrier than before and he orders Haman impaled on the stake that had been prepared for Mordechai. The previous decree against the Jews cannot be annulled, but the king allows the Jews to defend themselves during attacks. As a result, on 13 Adar, five hundred attackers and Haman's ten sons are killed in Shushan, followed by a Jewish slaughter of seventy-five thousand Persians, although they took no plunder. Mordechai assumes a prominent position in Ahasuerus' court, and institutes an annual commemoration of the delivery of the Jewish people from annihilation.

So the project and process names refer to an Old Testament story of a Jewish genocide thwarted by palace intrigue. I can certainly see the parallels...

1 Comments:

Anonymous Anonymous said...

Good explanation of the book of Esther. I am a programmer and and I constantly name variables or functions and classes "objects" in my applications. Usually the name of a variable just describes the type of data is holds for example is the data numeric or is it a string of letters "text". Functions are named after what they do. ("gettotalPayment", "calculateInterest") Classes are named after objects and are typically nouns for example "Physician","Account".. It is highly unusual for programmers to go outside of these basic tenants of programming. They likely knew their code would be analyzed.

October 01, 2010 1:11 PM  

Post a Comment

Subscribe to Post Comments [Atom]

<< Home