Shamoon Wiped Thirty Thousand Computers

It began in the middle of an ordinary working morning, in one of the largest offices on Earth. A screen went black. Then another one, a few desks away. Then a whole row, like lights going out along a street. Nobody had touched anything. Nobody had clicked a strange link or opened a suspicious file. The computers were simply dying, one after another, in waves — and there was nothing anyone in that office could do to stop it.

That morning, the 15th of August 2012, belonged to Shamoon. By the time the wave finished moving through the building, around 30,000 computers at Saudi Aramco — the Saudi state oil company, and one of the most valuable companies on the planet — had been wiped clean.

Shamoon did not steal anything. It did not ask for money. It carried an eraser, and its only wish was to rub a giant company’s memory out.

What Shamoon is, and what the eraser did

Most malware wants something. Ransomware wants payment. Spyware wants secrets. Shamoon, also known by the name Disttrack, wanted nothing at all — and that is what made it so frightening. It is a type of malware called a wiper. A wiper has one single job: destroy.

When Shamoon woke up inside a computer, it worked in a careful order. First, it overwrote the files stored on the machine — documents, records, years of office work — covering them with junk data so they could never be read again. Think of a notebook where someone has scribbled over every page with a thick black marker. The paper is still there, but the writing is gone forever.

Then Shamoon did something even crueller. It destroyed the master boot record. That is the tiny starter program a computer reads in the very first second after you press the power button. It tells the machine where its system lives and how to wake up. With that starter program rubbed out, the computers could not even switch on. They were not asleep. They were not broken in a way a repairman could fix. They sat on their desks like empty boxes, unable to begin.

On many of the dying screens, workers saw one last image before everything went dark: a burning American flag. Shamoon’s makers wanted the destruction to be seen. This was not a quiet crime. It was a message, delivered on 30,000 screens at once.

How Shamoon spread through the building

Shamoon did not need 30,000 separate attacks. It only needed a way in, and then it travelled by itself.

Investigators reported that the malware spread across the company’s network using stolen administrator credentials. An administrator account is like the master key of an office building — the one key that opens every door. Once Shamoon held that key, it could walk from computer to computer along the company’s own network, wiping each machine it reached. The rows of screens dying one after another were the footprints of that walk.

This is worth understanding, because the same road can lead into any company, and smaller versions of it can reach ordinary people too:

• One weak or stolen password can open everything. If the same admin password guards a whole network, a single theft becomes a total disaster.
• Connected machines share each other’s fate. Computers linked on one open network can pass an infection along like a cold in a classroom.
• An attack like this needs no clicking from the victims. The office workers at Aramco did nothing wrong at their desks. The danger arrived through the wires behind the walls.

Big organisations are the natural target for a wiper like Shamoon, because wiping them sends a loud message. But the lesson underneath — stolen master keys and unprotected networks — applies to every office, every school, and every home router in the world.

The day Aramco’s memory was erased

Saudi Aramco was not a small victim. It was the company that pumped a huge share of the world’s oil, a giant whose offices held the paperwork of a global business. And in roughly one working day, around 30,000 of its office computers — the figure widely reported by the company and officials — were turned into dead boxes.

The response had to be total. Aramco ripped out its damaged office network and rebuilt it from the beginning. The rebuilding work took months. The company reportedly bought enormous quantities of hard drives from around the world to replace what had been destroyed, snapping up so many that the attack is said to have shaken the global hard-drive market. Picture it: trucks of fresh drives arriving so that thousands of workers could simply have a working desk again.

I keep thinking about the strange luck hidden inside that disaster, because one thing did not happen — and it was the thing everyone feared most. The oil never stopped. Aramco’s wells kept pumping and its fuel kept flowing through the whole crisis. The reason was simple, and it is the most important detail in this entire story: the computers that ran the oil production were kept on a separate network from the office computers. Shamoon could erase the offices, but it could not cross the gap into the machines that controlled the oil itself.

One decision, made quietly by engineers long before the attack — keep the factory apart from the office — was the difference between a terrible story and a world energy crisis.

Who sent the eraser?

A group calling itself the Cutting Sword of Justice claimed responsibility for the attack. Beyond that claim, the trail goes quiet. US officials were reported to believe that Iran stood behind Shamoon, but no government ever officially took responsibility for it. That fog is normal in attacks between nations: everyone suspects, nobody signs their name.

Shamoon’s story did not end in 2012 either. New versions of the wiper returned in 2016 and 2017, aimed at other organisations inside Saudi Arabia. A tool built to erase, once released into the world, tends to be picked up and used again.

How to protect yourself from a wiper

You cannot stop a nation from building an eraser. But Shamoon’s whole power came from a few simple weaknesses, and every one of them has a practical defence:

1. Keep backups that live apart from the computer

A backup sitting on the same machine, or plugged into it all day, gets erased along with everything else. Keep a copy of your important files on a drive that you disconnect, or in a separate cloud account. If the eraser ever reaches your machine, it cannot reach a copy that is not connected. This single habit turns total loss into a bad afternoon.

2. Guard the master keys

Use strong, different passwords for administrator accounts, and never let one password rule a whole network. At home, that means changing the default password on your router and not reusing your email password anywhere else. Shamoon travelled on a stolen master key — make sure yours is hard to steal and opens as little as possible.

3. Keep important systems separated

Aramco survived because its oil systems were apart from its office systems. Ordinary people can copy the idea in small ways: keep your work and personal accounts separate, do not let every device in the house share everything freely, and keep one clean device or account for truly important things like banking.

4. Update, and watch for strange behaviour

Software updates close the doors that malware walks through. And if several machines around you start failing in the same strange way at the same time, disconnect from the network fast — in a wiper attack, every connected minute costs more computers.

Common questions

What does “wiper” mean?

A wiper is malware built only to destroy data. Unlike ransomware, it does not lock your files and offer to sell them back — it overwrites them and wrecks the computer’s ability to start, so the information is gone for good.

Why is Shamoon also called Disttrack?

Security researchers often give malware a second, technical name based on something inside its code. Shamoon is the name that became famous in the news; Disttrack is the name many security firms use for the same destructive program.

Did Shamoon stop Saudi Arabia’s oil?

No. About 30,000 office computers were wiped, but the systems controlling oil production were kept on a separate network, so production continued. The damage was huge, but it stayed inside the offices.

Who was behind the Shamoon attack?

A group calling itself Cutting Sword of Justice claimed responsibility. US officials were reported to believe Iran was behind it, but no government officially accepted responsibility, so the full truth remains unproven.

Could a wiper like Shamoon hit my home computer?

Wipers are usually aimed at companies and governments, not homes, because their purpose is to send a message. But the habits that defeat them — disconnected backups and strong passwords — protect you from almost every other kind of malware too.

Sources

• Wikipedia — Shamoon: https://en.wikipedia.org/wiki/Shamoon