buddawiggi's Avatar
buddawiggi 24
717 Asked
4637 Answered
2228 Best
1
No one has voted on this question yet :(
1 year, 8 months ago

Was Stuxnet built to infiltrate Iran's nuclear program?

Specifically Iran's Bushehr reactor? What do we know about this "Stuxnet" and who might be responsible for introducing it? Could you explain in plain English what the findings published here at Langner.com say to us about what is going on with Stuxnet?
images:
Tip for best answer: M$1.01
Separate topics with commas, or by pressing return. Use the delete or backspace key to edit or remove existing topics.

You can leave an optional "tip" with Mahalo's virtual currency, Mahalo Dollars. If you are asking a difficult question that might require some research, or if you'd like a wide variety of feedback, a higher tip often leads to more answers to your question.

M$

What is Your Answer?

0
0
0

1 Answer

1
philipy's Avatar
philipy | 1 year, 8 months ago
8
As for the tech speak, as far as I can make sense of it....

- The malware arrives on a Windows PC via the usual routes, say an infected USB stick
- It checks if the PC it's landed on is hooked up to talk to a specific type of industrial process controller from Siemens
- Looks like it does that check every 5 seconds
- If yes, it injects a piece of itself into the process controller
- Whoever wrote the malware knows the internal details of that particular controller, and the specific application that it would be being used for. i.e. They know how that controller has been programmed in the target plant, and the malware can tell from that pretty reliably if it has found the right target
- One of the things the target controller would ordinarily have been doing is ten times a second it is performing some unknown industrial process task, say for example "Check the temperature of X and if it's more than Y, engage the safety cut out and cool down". Or if the target should happen to be a centrifuge in a uranium enrichment plant, may be instead it's "Check the centrifuge RPM, and stop it going over X".
- The malware will let the controller carry on doing its normal thing until some condition is met. Let's say for example unless the date is one of a series of pre-programmed attack dates.
- When the condition is met, e.g. a certain date is reached, the malware has the controller ignore that thing it was supposed to be doing ten times a second.
- In our examples, maybe there will now be no automatic cooling-off initiated when something starts to overheat, or no slowdown when the centrifuge is spinning too fast. Because that action doesn't happen the result could be possibly a catastrophic plant failure

From what I can see, the idea that Stuxnet was designed to target Iran's nuclear program is at best a good guess based on circumstantial evidence.

The logic seems to be...

- Very expert piece of malware, with seeming insider knowledge of one specific target
- Seems to have turned up in Iran a lot (but also plenty in Pakistan, Indonesia & India)
- Once people have figured it out properly, it will be ineffective...
- So whatever it was meant to be doing, it was probably intended to already have done it by now
- So...what could be a target in Iran that is known to have had tech problems?
- Guess: The most obvious thing that comes to mind is Bushehr. or maybe Natanz

Obviously even if true, no one that could confirm it is likely to be forthcoming.

But we really don't know. Maybe the virus turned up in Iran a lot by accident, and the real target was something else entirely. The virus has turned up also in Germany, Canada, Korea, the UK and the US. That's viruses for you. And the type of equipment targeted is used in chemical plants, oil pipelines and military facilities among other things. For example Dow Chemical is a user.

So... pick any massive industrial disaster of your choice, and invent a suitable conspiracy theory. :)

You can leave an optional "tip" with Mahalo's virtual currency, Mahalo Dollars. If you are asking a difficult question that might require some research, or if you'd like a wide variety of feedback, a higher tip often leads to more answers to your question.

M$
philipy's Avatar
philipy | 1 year, 8 months ago Report

Symantec published a long report on Stuxnet.
49 page PDF here

It's mostly all tech speak so you probably don't want to read it, but is basically the same story as above. Their final words in conclusion:

-- Quote

Stuxnet is of such great complexity—requiring significant resources to develop—that ... we would not expect masses of threats of similar in sophistication to suddenly appear.

However, Stuxnet has highlighted direct-attack attempts on critical infrastructure
are possible and not just theory or movie plotlines.

The real-world implications of Stuxnet are beyond any threat we have seen in the past. Despite the exciting challenge in reverse engineering Stuxnet and understanding its purpose, Stuxnet is the type of threat we hope to never see again.

-- /Quote

Report Abuse

Post Reply Cancel

Learn something new with our FREE educational apps!

Private lessons in the comfort of your own home. Get back in shape or finally pick up a guitar with our great experts guiding you the whole way!
Learn Guitar
Learn Hip Hop
Learn Pilates