STUXNET

Stuxnet was the first virus to cause the physical destruction of infected devices. It severely crippled Iran’s nuclear program, however, the malware was so aggressive in nature it spread beyond the limits of Iran’s nuclear facilities.

quick stuxnet facts:

  • First Surfaced: 2010

  • Suspected State Sponsor: Israel & United States

  • Type of Incident: Sabotage

  • Target Category: Military

  • Codenamed “Olympic Games” and believed to be the work of the Equation Group. Click here for my blog on Equation Group

  • Compromised Industrial Control Systems at the Nantaz Nuclear Material Enrichment Facility in Iran.

Stuxnet is a malicious worm that exploited the previously unknown Windows Zero-Day vulnerabilities. Even though it was initially intended to target the centrifuges of Iran’s uranium enrichment facilities, other hackers modified it over time and adapted it to target other facilities such as power plants and gas pipes. Stuxnet was first uncovered in 2010, it was actually believed to have been in development since at least 2005.

the worm consists of a layered attack against three different systems:

  1. The Windows OS

  2. Siemens PCS 7, Wincc, and STEP7 industrial software applications that run on Windows.

  3. One of more Siemens S7 PLCs.

Stuxnet specifically targets Programmable Logic Controllers (PCLs) which in the case of gas centrifuges for separating nuclear material, they allow the automation of the electromechanical processes. Stuxnet exploited four zero-days flaws. It functions by targeting machines using the Microsoft Windows OS & Networks, then seeking out Siemens Step7 software. Stuxnet then compromised Iranian PLCs collecting information on Industrial Systems & causing the fast-spinning centrifuges to self-destruct. Reportedly Stuxnet ruined almost one-fifth of Iran’s centrifuges. Since it targeted ICS, the worm infected over 200,000 computers & caused 1,000 machines to physically degrade.

Even though neither country has admitted any responsibility for Stuxnet it’s widely believed to be a cyber weapon built jointly by the United States and Israel as a collaborative effort known as “Operation Olympic Games.” The program started during the Bush Administration and was quickly extended in the beginning of Obama’s presidency. Multiple reports indicated that The U.S. pursued the Stuxnet operation as a way of degrading Iran’s nuclear weapons program without resorting to an airstrike or an attack by special operation forces.

Siemens released a detection & removal tool for Stuxnet. Siemens also advised immediately upgrading password access codes. Though, the worm’s ability to reprogram external PLCs could complicate the removal procedure.