STUXNet

[MKSheppard]

Thanks Shep, but the article already said that.

Lots of people didn't notice that. Just pointing that out to those who skimmed the original article.

It's not, however, the first thing someone breaking in would think to steal (even if they knew where it was).

Your average criminal? Nope. But operatives of a national intelligence agency? They'd at least know what to look for.

[Uraniun235]

Symantec has published a dossier on Stuxnet:

http://www.symantec.com/content/en/us/e ... ossier.pdf

First, the attackers needed to conduct reconnaissance. As each PLC is configured in a unique manner, the attackers would first need the ICS’s schematics. These design documents may have been stolen by an insider or even retrieved by an early version of Stuxnet or other malicious binary. Once attackers had the design documents and potential knowledge of the computing environment in the facility, they would develop the latest version of Stuxnet. Each feature of Stuxnet was implemented for a specific reason and for the final goal of potentially sabotaging the ICS.

Attackers would need to setup a mirrored environment that would include the necessary ICS hardware, such as PLCs, modules, and peripherals in order to test their code. The full cycle may have taken six months and five to ten core developers not counting numerous other individuals, such as quality assurance and management.

In addition their malicious binaries contained driver files that needed to be digitally signed to avoid suspicion. The attackers compromised two digital certificates to achieve this task. The attackers would have needed to obtain the digital certificates from someone who may have physically entered the premises of the two companies and stole them, as the two companies are in close physical proximity.

...

In addition to this, Stuxnet also uses another trick to enhance the chances that it will be executed. The autorun commands turn off autoplay and then add a new command to the context menu. The command that is added is found in %Windir%\System32\shell32.dll,-8496. This is actually the “Open” string. Now when viewing the context menu for the removable device the user will actually see two “Open” commands.

One of these Open commands is the legitimate one and one is the command added by Stuxnet. If a user chooses to open the drive via this menu, Stuxnet will execute first. Stuxnet then opens the drive to hide that anything suspicious has occurred.

[Spoonist]

What I don't get is how they thought that they would get away with itwithout making a mess? The likelyhood of things like this to spread is of course great. So then its only a question of time before someone else detects it, like the russians did.

[RedImperator]

What I don't get is how they thought that they would get away with itwithout making a mess? The likelyhood of things like this to spread is of course great. So then its only a question of time before someone else detects it, like the russians did.

If you can't answer who "they" is, guess what: "they" got away with it. The two most likely candidates have deniability--the digital signatures were stolen by unknown parties from two Taiwanese companies, and the update servers were in neutral countries. Without proof, there's jack-shit Iran can do, given its limited retaliatory options.

[CJvR]

Actually, it appears that both companies whose digital signatures were stolen, resided in the same building. So all you had to do was send someone in to physically raid the offices after hours.

Yeah, and know where and what to look for. I doubt this is something that that is just lying around the office, and then you need to cover up your tracks so no one even suspects you have been there (or at least that you were not intrested in those codes). It is starting to grow once you think about it...

[Spoonist]

What I don't get is how they thought that they would get away with itwithout making a mess? The likelyhood of things like this to spread is of course great. So then its only a question of time before someone else detects it, like the russians did.

If you can't answer who "they" is, guess what: "they" got away with it. The two most likely candidates have deniability--the digital signatures were stolen by unknown parties from two Taiwanese companies, and the update servers were in neutral countries. Without proof, there's jack-shit Iran can do, given its limited retaliatory options.

Ah, wrong implication, sorry. I said without making a mess. Even if the makers get away scot free there will be a mess out of this. From other malware copycats or from foreign services. I mean those four
Why not include a self deletion if outside of Iran for instance? Or after a certain date? Or if home server is gone?

Maybe I'm missing something but to me it looks like they did not think through the results if it spread as much as it did.

[The Kernel]

Actually, it appears that both companies whose digital signatures were stolen, resided in the same building. So all you had to do was send someone in to physically raid the offices after hours.

Yeah, and know where and what to look for. I doubt this is something that that is just lying around the office, and then you need to cover up your tracks so no one even suspects you have been there (or at least that you were not intrested in those codes). It is starting to grow once you think about it...

It's much more likely that they just bribed employees of these companies to steal them a copy. These companies aren't government agencies with tightly defined security protocols.

I've worked at two companies that deal with highly sensitive data and in both cases I could have accessed it without discovery quite easily if I was the unscrupulous sort. I'm sure there are companies that take corporate security seriously but I've never worked at one.

[Sarevok]

So what are the chances future micro-controllers, FPGAs, PLAs etc are going to come with "security" features reminiscent of consumer personal computing world ? The days of just plugging in some ICs into a board and hooking it up to a motor or something without regard of cyberpunkish hackers might be over ?

[Phantasee]

I'm concerned that they weren't over already.

[The Kernel]

So what are the chances future micro-controllers, FPGAs, PLAs etc are going to come with "security" features reminiscent of consumer personal computing world ? The days of just plugging in some ICs into a board and hooking it up to a motor or something without regard of cyberpunkish hackers might be over ?

Did you ever wonder why Intel bought McAfee? That's why.

[Spyder]

Actually, it appears that both companies whose digital signatures were stolen, resided in the same building. So all you had to do was send someone in to physically raid the offices after hours.

Depending on the level of security you probably wouldn't need to do it after hours. Follow someone through a security door, find an unattended PC and look like you're supposed to be there. Hell, just stand outside a security door and look despondent, someone will let you in.

[CaptainChewbacca]

Maybe I'm missing something but to me it looks like they did not think through the results if it spread as much as it did.

Then you're missing something. It spread throughout an ENTIRE dedicated secure military network. Even if it gets out, so what? That just means whoever is running the show gets extra data they don't need, but they can just ignore that. In the meanwhile, Iran has found out that it has serious holes in its' nuclear security and is going to have to stop everything while they upgrade the security and triple-check everything they've done so far for bugs.

And they don't even know who did it or when it might happen again.

No, they thought it through carefully.

[Pelranius]

Like I said on HPCA, it doesn't necessarily have to be the Israelis or us. The Chinese have a vested interest in seeing that the Persian Gulf stays peaceful. delaying the Iranian nuclear program buys time for Tehran's domestic problems to simmer even more. Now of course it doesn't have to be them, but they have a lot invested in seeing that tensions remain relatively low. And there's not much Iran can do to them, since Tehran is dependent on them for money (they can't do anything more than North Korea could if China deliberately shipped a batch of defective machine tools to North Korean factories).

[Spoonist]

Maybe I'm missing something but to me it looks like they did not think through the results if it spread as much as it did.

Then you're missing something. It spread throughout an ENTIRE dedicated secure military network. Even if it gets out, so what?

So what? Well its like giving away trade secrets for free. Now everyone who wants to have access to it and can analyze it.

[CaptainChewbacca]

Yeah, they just have to ask IRAN to share the corporate espionage evidence.

[Spoonist]

Uhm, no?
Its avaiable through most anti-virus networks and thus also to the shadier parts of the net as well.
As in the acual 500k virus where you talking about something different?

[Skgoa]

So what? Seriously, whats your point, here? That other people now know about these vulnerabilities, too? That was probably already true, at least in certain circles. Burning four zero-days is more than we have seen before, but if you consider what they (tried to) achive(d), its not strange at all, if you are willing to spend that kind of money in the first place.

[Spoonist]

Seriously, whats your point, here?

Its lost up there a couple a posts ago. It was just an observation so no biggie.

If you go through all the trouble, why not add a selfdeletion or non-copying thingie outside of the target? Its relatively easy to do and has been done before in similar cases.

For instance, if stuxnet had been limited to Iran only we wouldn't be reading about it in the newspapers. Unless they want to broadcast their capabilities?

Also its not only the four zero-days while that is a lot, its also the design, the file structure, etc, etc.

[Sarevok]

Are you saying the creators of STUXNet were being dick on purpose ?

We may never know the answer to your questions. Perhaps it was due to limited budget or plain impossible to limit the spread of this by chance. But one thing I personally believe is that it was most certainly not due to the creators being extra evil purpose. It seems such a petty thing to do for people who dabble in such arcane level mastery of technology.

[MKSheppard]

It's been a few months; and more has been discovered about it.

link

Print Close
Mystery Surrounds Cyber Missile That Crippled Iran's Nuclear Weapons Ambitions
By Ed Barnes

Published November 26, 2010 | FoxNews.com

advertisement
In the 20th century, this would have been a job for James Bond.

The mission: Infiltrate the highly advanced, securely guarded enemy headquarters where scientists in the clutches of an evil master are secretly building a weapon that can destroy the world. Then render that weapon harmless and escape undetected.

But in the 21st century, Bond doesn't get the call. Instead, the job is handled by a suave and very sophisticated secret computer worm, a jumble of code called Stuxnet, which in the last year has not only crippled Iran's nuclear program but has caused a major rethinking of computer security around the globe.

Intelligence agencies, computer security companies and the nuclear industry have been trying to analyze the worm since it was discovered in June by a Belarus-based company that was doing business in Iran. And what they've all found, says Sean McGurk, the Homeland Security Department's acting director of national cyber security and communications integration, is a “game changer.”

The construction of the worm was so advanced, it was “like the arrival of an F-35 into a World War I battlefield,” says Ralph Langner, the computer expert who was the first to sound the alarm about Stuxnet. Others have called it the first “weaponized” computer virus.

Simply put, Stuxnet is an incredibly advanced, undetectable computer worm that took years to construct and was designed to jump from computer to computer until it found the specific, protected control system that it aimed to destroy: Iran’s nuclear enrichment program.

The target was seemingly impenetrable; for security reasons, it lay several stories underground and was not connected to the World Wide Web. And that meant Stuxnet had to act as sort of a computer cruise missile: As it made its passage through a set of unconnected computers, it had to grow and adapt to security measures and other changes until it reached one that could bring it into the nuclear facility.

When it ultimately found its target, it would have to secretly manipulate it until it was so compromised it ceased normal functions.

And finally, after the job was done, the worm would have to destroy itself without leaving a trace.

That is what we are learning happened at Iran's nuclear facilities -- both at Natanz, which houses the centrifuge arrays used for processing uranium into nuclear fuel, and, to a lesser extent, at Bushehr, Iran's nuclear power plant.

At Natanz, for almost 17 months, Stuxnet quietly worked its way into the system and targeted a specific component -- the frequency converters made by the German equipment manufacturer Siemens that regulated the speed of the spinning centrifuges used to create nuclear fuel. The worm then took control of the speed at which the centrifuges spun, making them turn so fast in a quick burst that they would be damaged but not destroyed. And at the same time, the worm masked that change in speed from being discovered at the centrifuges' control panel.

At Bushehr, meanwhile, a second secret set of codes, which Langner called “digital warheads,” targeted the Russian-built power plant's massive steam turbine.

Here's how it worked, according to experts who have examined the worm:

--The nuclear facility in Iran runs an “air gap” security system, meaning it has no connections to the Web, making it secure from outside penetration. Stuxnet was designed and sent into the area around Iran's Natanz nuclear power plant -- just how may never be known -- to infect a number of computers on the assumption that someone working in the plant would take work home on a flash drive, acquire the worm and then bring it back to the plant.

--Once the worm was inside the plant, the next step was to get the computer system there to trust it and allow it into the system. That was accomplished because the worm contained a “digital certificate” stolen from JMicron, a large company in an industrial park in Taiwan. (When the worm was later discovered it quickly replaced the original digital certificate with another certificate, also stolen from another company, Realtek, a few doors down in the same industrial park in Taiwan.)

--Once allowed entry, the worm contained four “Zero Day” elements in its first target, the Windows 7 operating system that controlled the overall operation of the plant. Zero Day elements are rare and extremely valuable vulnerabilities in a computer system that can be exploited only once. Two of the vulnerabilities were known, but the other two had never been discovered. Experts say no hacker would waste Zero Days in that manner.

--After penetrating the Windows 7 operating system, the code then targeted the “frequency converters” that ran the centrifuges. To do that it used specifications from the manufacturers of the converters. One was Vacon, a Finnish Company, and the other Fararo Paya, an Iranian company. What surprises experts at this step is that the Iranian company was so secret that not even the IAEA knew about it.

--The worm also knew that the complex control system that ran the centrifuges was built by Siemens, the German manufacturer, and -- remarkably -- how that system worked as well and how to mask its activities from it.

--Masking itself from the plant's security and other systems, the worm then ordered the centrifuges to rotate extremely fast, and then to slow down precipitously. This damaged the converter, the centrifuges and the bearings, and it corrupted the uranium in the tubes. It also left Iranian nuclear engineers wondering what was wrong, as computer checks showed no malfunctions in the operating system.

Estimates are that this went on for more than a year, leaving the Iranian program in chaos. And as it did, the worm grew and adapted throughout the system. As new worms entered the system, they would meet and adapt and become increasingly sophisticated.

During this time the worms reported back to two servers that had to be run by intelligence agencies, one in Denmark and one in Malaysia. The servers monitored the worms and were shut down once the worm had infiltrated Natanz. Efforts to find those servers since then have yielded no results.

This went on until June of last year, when a Belarusan company working on the Iranian power plant in Beshehr discovered it in one of its machines. It quickly put out a notice on a Web network monitored by computer security experts around the world. Ordinarily these experts would immediately begin tracing the worm and dissecting it, looking for clues about its origin and other details.

But that didn’t happen, because within minutes all the alert sites came under attack and were inoperative for 24 hours.

“I had to use e-mail to send notices but I couldn’t reach everyone. Whoever made the worm had a full day to eliminate all traces of the worm that might lead us them,” Eric Byers, a computer security expert who has examined the Stuxnet. “No hacker could have done that.”

Experts, including inspectors from the International Atomic Energy Agency, say that, despite Iran's claims to the contrary, the worm was successful in its goal: causing confusion among Iran’s nuclear engineers and disabling their nuclear program.

Because of the secrecy surrounding the Iranian program, no one can be certain of the full extent of the damage. But sources inside Iran and elsewhere say that the Iranian centrifuge program has been operating far below its capacity and that the uranium enrichment program had “stagnated” during the time the worm penetrated the underground facility. Only 4,000 of the 9,000 centrifuges Iran was known to have were put into use. Some suspect that is because of the critical need to replace ones that were damaged.

And the limited number of those in use dwindled to an estimated 3,700 as problems engulfed their operation. IAEA inspectors say the sabotage better explains the slowness of the program, which they had earlier attributed to poor equipment manufacturing and management problems. As Iranians struggled with the setbacks, they began searching for signs of sabotage. From inside Iran there have been unconfirmed reports that the head of the plant was fired shortly after the worm wended its way into the system and began creating technical problems, and that some scientists who were suspected of espionage disappeared or were executed. And counter intelligence agents began monitoring all communications between scientists at the site, creating a climate of fear and paranoia.

Iran has adamantly stated that its nuclear program has not been hit by the bug. But in doing so it has backhandedly confirmed that its nuclear facilities were compromised. When Hamid Alipour, head of the nation’s Information Technology Company, announced in September that 30,000 Iranian computers had been hit by the worm but the nuclear facilities were safe, he added that among those hit were the personal computers of the scientists at the nuclear facilities. Experts say that Natanz and Bushehr could not have escaped the worm if it was in their engineers’ computers.

“We brought it into our lab to study it and even with precautions it spread everywhere at incredible speed,” Byres said.

“The worm was designed not to destroy the plants but to make them ineffective. By changing the rotation speeds, the bearings quickly wear out and the equipment has to be replaced and repaired. The speed changes also impact the quality of the uranium processed in the centrifuges creating technical problems that make the plant ineffective,” he explained.

In other words the worm was designed to allow the Iranian program to continue but never succeed, and never to know why.

One additional impact that can be attributed to the worm, according to David Albright of the Center for Strategic and International Studies, is that “the lives of the scientists working in the facility have become a living hell because of counter-intelligence agents brought into the plant” to battle the breach. Ironically, even after its discovery, the worm has succeeded in slowing down Iran's reputed effort to build an atomic weapon. And Langer says that the efforts by the Iranians to cleanse Stuxnet from their system “will probably take another year to complete,” and during that time the plant will not be able to function anywhere normally.

But as the extent of the worm’s capabilities is being understood, its genius and complexity has created another perplexing question: Who did it?

Speculation on the worm’s origin initially focused on hackers or even companies trying to disrupt competitors. But as engineers tore apart the virus they learned not only the depth of the code, its complex targeting mechanism, (despite infecting more than 100,000 computers it has only done damage at Natanz,) the enormous amount of work that went into it—Microsoft estimated that it consumed 10,000 man days of labor-- and about what the worm knew, the clues narrowed the number of players that have the capabilities to create it to a handful.

“This is what nation-states build, if their only other option would be to go to war,” Joseph Wouk, an Israeli security expert wrote.

Byers is more certain. “It is a military weapon,” he said.

And much of what the worm “knew” could only have come from a consortium of Western intelligence agencies, experts who have examined the code now believe.

Originally, all eyes turned toward Israel’s intelligence agencies. Engineers examining the worm found “clues” that hinted at Israel’s involvement. In one case they found the word “Myrtus” embedded in the code and argued that it was a reference to Esther, the biblical figure who saved the ancient Jewish state from the Persians. But computer experts say "Myrtus" is more likely a common reference to “My RTUS,” or remote terminal units.

Langer argues that no single Western intelligence agency had the skills to pull this off alone. The most likely answer, he says, is that a consortium of intelligence agencies worked together to build the cyber bomb. And he says the most likely confederates are the United States, because it has the technical skills to make the virus, Germany, because reverse-engineering Siemen’s product would have taken years without it, and Russia, because of its familiarity with both the Iranian nuclear plant and Siemen’s systems.

There is one clue that was left in the code that may tell us all we need to know.

Embedded in different section of the code is another common computer language reference, but this one is misspelled. Instead of saying “DEADFOOT,” a term stolen from pilots meaning a failed engine, this one reads “DEADFOO7.”

Yes, 007 has returned -- as a computer worm.

Stuxnet. Shaken, not stirred.

[MKSheppard]

Alternate

New and important evidence found in the sophisticated “Stuxnet” malware targeting industrial control systems provides strong hints that the code was designed to sabotage nuclear plants, and that it employs a subtle sabotage strategy that involves briefly speeding up and slowing down physical machinery at a plant over a span of weeks.

“It indicates that [Stuxnet's creators] wanted to get on the system and not be discovered and stay there for a long time and change the process subtly, but not break it,” says Liam O Murchu, researcher with Symantec Security Response, which published the new information in an updated paper (.pdf) on Friday.

The Stuxnet worm was discovered in June in Iran, and has infected more than 100,000 computer systems worldwide. At first blush it appeared to be a standard, if unusually sophisticated, Windows virus designed to steal data, but experts quickly determined it contained targeted code designed to attack Siemens Simatic WinCC SCADA system. SCADA systems, short for “supervisory control and data acquisition,” are control systems that manage pipelines, nuclear plants, and various utility and manufacturing equipment.

Researchers determined that Stuxnet was designed to intercept commands sent from the SCADA system to control a certain function at a facility, but until Symantec’s latest research it was not known what function was being targeted for sabotage. Symantec still has not determined what specific facility or type of facility Stuxnet targeted, but the new information lends weight to speculation that Stuxnet was targeting the Bushehr or Natanz nuclear facilities in Iran as a means to sabotage Iran’s nascent nuclear program.

According to Symantec, Stuxnet targets specific frequency converter drives—power supplies that are used to control the speed of a device, such as a motor. The malware intercepts commands sent to the drives from the Siemens SCADA software, and replaces them with malicious commands to control the speed of a device, varying it wildly, but intermittently.

The malware, however, doesn’t just sabotage any frequency converter. It inventories a plant’s network and only springs to life if the plant has at least 33 frequency converter drives made by Fararo Paya in Teheran, Iran, or by the Finland-based Vacon.

Even more specifically, Stuxnet targets only frequency drives from these two companies that are running at high speeds—between 807HZ and 1210Hz. Such high speeds are used only for select applications. Symantec is careful not to say definitively that Stuxnet was targeting a nuclear facility, but notes that “frequency converter drives that output over 600Hz are regulated for export in the United States by the Nuclear Regulatory Commission as they can be used for uranium enrichment.”

“There’s only a limited number of circumstances where you would want something to spin that quickly—such as in uranium enrichment,” said O Murchu. “I imagine there are not too many countries outside of Iran that are using an Iranian device. I can’t imagine any facility in the U.S. using an Iranian device,” he added.

The malware appears to have begun infecting systems in January 2009. In July of that year, the secret-spilling site WikiLeaks posted an announcement saying that an anonymous source had disclosed that a “serious” nuclear incident had recently occurred at Natanz. Information published by the Federation of American Scientists in the United States indicates that something may indeed have occurred to Iran’s nuclear program. Statistics from 2009 show that the number of enriched centrifuges operational in Iran mysteriously declined from about 4,700 to about 3,900 beginning around the time the nuclear incident WikiLeaks mentioned would have occurred.

Researchers who have spent months reverse-engineering the Stuxnet code say its level of sophistication suggests that a well-resourced nation-state is behind the attack. It was initially speculated that Stuxnet could cause a real-world explosion at a plant, but Symantec’s latest report makes it appear that the code was designed for subtle sabotage. Additionally, the worm’s pinpoint targeting indicates the malware writers had a specific facility or facilities in mind for their attack, and have extensive knowledge of the system they were targeting.

The worm was publicly exposed after VirusBlokAda, an obscure Belarusian security company, found it on computers belonging to a customer in Iran—the country where the majority of the infections occurred.

German researcher Ralph Langner was the first to suggest that the Bushehr nuclear power plant in Iran was the Stuxnet target. Frank Rieger, chief technology officer at Berlin security firm GSMK, believes it’s more likely that the target in Iran was a nuclear facility in Natanz. The Bushehr reactor is designed to develop non-weapons-grade atomic energy, while the Natanz facility, a centrifuge plant, is designed to enrich uranium and presents a greater risk for producing nuclear weapons.

The new information released by Symantec last week supports this speculation.

As Symantec points out in its paper, frequency converter drives are used to control the speed of another device—for example, a motor at a manufacturing facility or power plant. Increase the frequency, and the motor increases in speed. In the case of Stuxnet, the malware is searching for a process module made by Profibus and Profinet International that is communicating with at least 33 frequency converter drives made by either the Iranian firm or the Finnish firm.

Stuxnet is very specific about what it does once it finds its target facility. If the number of drives from the Iranian firm exceeds the number from the Finnish firm, Stuxnet unleashes one sequence of events. If the Finnish drives outnumber the Iranian ones, a different sequence is initiated.

Once Stuxnet determines it has infected the targeted system or systems, it begins intercepting commands to the frequency drives, altering their operation.

“Stuxnet changes the output frequency for short periods of time to 1410Hz and then to 2Hz and then to 1064Hz,” writes Symantec’s Eric Chien on the company’s blog. “Modification of the output frequency essentially sabotages the automation system from operating properly. Other parameter changes may also cause unexpected effects.”

“That’s another indicator that the amount of applications where this would be applicable are very limited,” O Murchu says. “You would need a process running continuously for more than a month for this code to be able to get the desired effect. Using nuclear enrichment as an example, the centrifuges need to spin at a precise speed for long periods of time in order to extract the pure uranium. If those centrifuges stop to spin at that high speed, then it can disrupt the process of isolating the heavier isotopes in those centrifuges... and the final grade of uranium you would get out would be a lower quality.”

O Murchu said that there is a long wait time between different stages of malicious processes initiated by the code—in some cases more than three weeks—indicating that the attackers were interested in sticking around undetected on the target system, rather than blowing something up in a manner that would get them noticed.

“It wanted to lie there and wait and continuously change how a process worked over a long period of time to change the end results,” O Murchu said.

Stuxnet was designed to hide itself from detection so that even if administrators at a targeted facility noticed that something in the facility’s process had changed, they wouldn’t be able to see Stuxnet on their system intercepting and altering commands. Or at least they wouldn’t have seen this, if information about Stuxnet hadn’t been released last July.

[Pelranius]

The Chinese could have also had a hand in it. Dragging out the nuclear program suits their purposes for several reasons (if the Iranians are still sitting on the backburner, China could try to link their ongoing arms embargo of Iran to the quality of American weapons sold to the RoC), along with the usual economic reasons.

[The Jester]

Q&A about Stuxnet from F-Secure. What's most interesting is that Vacon says that they've never sold any high frequency converters drives to the Iranians and they're not aware of any being used as part of their nuclear program.

Stuxnet continues to be a hot topic. Here's an updated set of Questions and Answers on it.

Q: What is Stuxnet?
A: It's a Windows worm, spreading via USB sticks. Once inside an organization, it can also spread by copying itself to network shares if they have weak passwords.

Q: Can it spread via other USB devices?
A: Sure, it can spread anything that you can mount as a drive. Like a USB hard drive, mobile phone, picture frame and so on.

Q: What does it do then?
A: It infects the system, hides itself with a rootkit and sees if the infected computer is connected to a Siemens Simatic (Step7) factory system.

Q: What does it do with Simatic?
A: It modifies commands sent from the Windows computer to the PLC (Programmable Logic Controllers, i.e. the boxes that actually control the machinery). Once running on the PLC, it looks for a specific factory environment. If this is not found, it does nothing.

Q: Which plant is it looking for?
A: We don't know.

Q: Has it found the plant it's looking for?
A: We don't know.

Q: What would it do if it finds it?
A: The PLC modification searches for specific high-frequency converter drives (AC drives) and modifies their operation.

Q: What's a high-frequency converter drive?
A: Basically, it's a device that can control the speed of a motor. Stuxnet searches for specific AC drives manufactured by Vacon (based in Finland) and Fararo Paya (based in Iran).

Q: So does Stuxnet infect these Vacon and Fararo Paya drives?
A: No. They drives do not get infected. The infected PLC modifies how the drives run. The modification happens only when very specific conditions are all true at the same time, including an extremely high output frequency. Therefore, any possible effects would concern extremely limited AC drive application areas.

Q: What are those application areas? What are AC drives used for?
A: They are used for various purposes, for example for efficient air pressure systems.

Q: Any other examples?
A: Well yes, they are also used for enrichment centrifuges.

Q: As in?
A: As in Uranium enrichment where centrifuges spin at a very high speed. This is why high-frequency drives are considered dual-use technology and are under the IAEA export restriction list.

Q: Would the Stuxnet code cause centrifuges to disintegrate into projectiles traveling at around Mach 2?
A: It's more likely the modifications would cause the centrifuges to produce bad-quality uranium. The changes could go undetected for extended periods of time.

Q: Have you been in touch with Vacon?
A: Yes. They have been investigating the matter and they are not aware of any instances where Stuxnet would have created problems in the operations of Vacon's customers.

Q: Some suggest the target of Stuxnet was the Natanz enrichment facility in Iran. Are there Vacon AC drives in these facilities?
Q: According to Vacon, they are not aware of any Vacon drives in use in the Iranian nuclear program, and they can confirm that they have not sold any AC drives to Iran against the embargo.

Q: Have you been in touch with Fararo Paya?
A: No.

Q: What do you know about this company?
A: Nothing. It doesn't seem to be very well known outside of Iran. We're not aware of any AC drive customers they would have outside of Iran.

Q: That would indicate what the target country was, wouldn't it?
A: Next question.

Q: Could there be collateral damage? Could Stuxnet hit another plant that was not the original target?
A: It would have to be very similar to the original target.

Q: Do you know of any plants that would be similar to Iran's uranium enrichment plant?
A: Turns out North Korea seems to have a plant that shares the same design.

Q: Why is Stuxnet considered to be so complex?
A: It uses multiple vulnerabilities and drops its own driver to the system.

Q: How can it install its own driver? Shouldn't drivers be signed for them to work in Windows?
A: Stuxnet driver was signed with a certificate stolen from Realtek Semiconductor Corp.

Q: How do you steal a certificate?
A: Maybe with malware looking for certificate files and using a keylogger to collect the passphrase when it's typed in. Or breaking in and stealing the signing gear, then brute-forcing the passphrase.

Q: Has the stolen certificate been revoked?
A: Yes. VeriSign revoked it on July 16th. A modified variant signed with a certificate stolen from JMicron Technology Corp was found on July 17th.

Q: What's the relation between Realtek and Jmicron?
A: Nothing. But these companies have their HQs in the same office park in Taiwan… which is weird.

Q: What vulnerabilities does Stuxnet exploit?
A: Overall, Stuxnet exploits five different vulnerabilities, four of which were 0-days:

• LNK (MS10-046)
• Print Spooler (MS10-061)
• Server Service (MS08-067)
• Privilege escalation via Keyboard layout file (MS10-073)
• Privilege escalation via Task Scheduler

Q: And these have been patched by Microsoft?
A: All but one of the two Privilege escalations has been patched. A public exploit for the last remaining vulnerability was released in November.

Q: Did the Stuxnet creators find their own 0-day vulnerabilities or did they buy them from the black market?
A: We don't know.

Q: How expensive would such vulnerabilities be?
A: This varies. A single remote code execution zero-day in a popular version of Windows could go for anything between $50,000 to $500,000.

Q: Why was it so slow to analyze Stuxnet in detail?
A: It's unusually complex and unusually big. Stuxnet is over 1.5MB in size.

Q: When did Stuxnet start spreading?
A: In June 2009, or maybe even earlier. One of the components has a compile date in January 2009.

Q: When was it discovered?
A: A year later, in June 2010.

Q: How is that possible?
A: Good question.

Q: How long did it take to create Stuxnet?
A: We estimate that it took over 10 man-years to develop Stuxnet.

Q: Who could have written Stuxnet?
A: Looking at the financial and R&D investment required and combining this with the fact that there's no obvious money-making mechanism within Stuxnet, that leaves only two possibilities: a terror group or a nation-state. And we don't believe any terror group would have this kind of resources.

Q: So was Stuxnet written by a government?
A: That's what it would look like, yes.

Q: How could governments get something so complex right?
A: Trick question. Nice. Next question.

Q: Was it Israel?
A: We don't know.

Q: Was it Egypt? Saudi Arabia? USA?
A: We don't know.

Q: Was the target Iran?
A: We don't know.

Q: Is it true that there's are biblical references inside Stuxnet?
A: There is a reference to "Myrtus" (which is a myrtle plant). However, this is not "hidden" in the code. It's an artifact left inside the program when it was compiled. Basically this tells us where the author stored the source code in his system. The specific path in Stuxnet is: \myrtus\src\objfre_w2k_x86\i386\guava.pdb. The authors probably did not want us to know they called their project "Myrtus", but thanks to this artifact we do. We have seen such artifacts in other malware as well. The Operation Aurora attack against Google was named Aurora after this path was found inside one of the binaries: \Aurora_Src\AuroraVNC\Avc\Release\AVC.pdb.

Q: So how exactly is "Myrtus" a biblical reference?
A: Uhh… we don't know, really. (However, reader Craig B. left a comment in an earlier version of this post.)

Q: Could it mean something else?
A: Yeah: it could mean "My RTUs", not "Myrtus". RTU is an abbreviation for Remote Terminal Units, used in factory systems.

Q: How does Stuxnet know it has already infected a machine?
A: It sets a Registry key with a value "19790509" as an infection marker.

Q: What's the significance of "19790509"?
A: It's a date. 9th of May, 1979.

Q: What happened on 9th of May, 1979?
A: Maybe it's the birthday of the author? Then again, on that date a Jewish-Iranian businessman called Habib Elghanian was executed in Iran. He was accused to be spying for Israel.

Q: Oh.
A: Yeah.

Q: Obviously the attackers had lots of inside information of the target plant and possibly had a mole inside. Why did they use a worm at all? Why couldn't they just have their mole do the modifications?
A: We don't know. For deniability? Maybe the mole had no access to the key systems? Maybe the mole was not at the plant but had access to the design plans? Maybe there was no mole?

Q: Is there a link between Stuxnet and Conficker?
A: It's possible. Conficker variants were found between November 2008 and April 2009. The first variants of Stuxnet were found shortly after that. Both exploit the MS08-067 vulnerability. Both use USB sticks to spread. Both use weak network passwords to spread. And, of course, both are unusually complex.

Q: Is there a link to any other malware?
A: Some Zlob variants were the first to use the LNK vulnerability.

Q: Disabling AutoRun would have stopped Stuxnet, right?
A: Wrong. Stuxnet used a zero-day. When it was new, it would have infected your Windows box even if you were fully patched, had AutoRun disabled, were running under a restricted low-level user account and had disabled execution of programs from USB drives.

Q: But in general, disabling AutoRun in Windows will stop USB worms, right?
A: Wrong. There are several other spreading mechanisms USB worms use, such as companion infections. It is still a good idea to disable it, but it's not a cure-all.

Q: Will Stuxnet spread forever?
A: The current versions have a "kill date" of June 24, 2012. It will stop spreading on this date.

Q: How many computers did it infect?
A: Hundreds of thousands.

Q: But Siemens has announced that only 15 factories have been infected.
A: They are talking about factories. Most of the infected machines are collateral infections, i.e. normal home and office computers that are not connected to SCADA systems.

Q: How could the attackers get a trojan like this into a secure facility?
A: For example, by breaking into a home of an employee, finding his USB sticks and infecting it. Then wait for the employee to take the sticks to work and infect his work computer. The infection will spread further inside the secure facility via USB sticks, eventually hitting the target. As a side effect, it will continue spread elsewhere also. This is why Stuxnet has spread worldwide.

Q: Did Stuxnet sink Deepwater Horizon and cause the Mexican oil spill?
A: No, we do not think so. Although it does seem Deepwater Horizon indeed did have some Siemens PLC systems on it.

Q: Is it true that the US Senate held hearings on Stuxnet?
A: Yes, in November.

Q: Does F-Secure detect Stuxnet?
A: Yes.

[cosmicalstorm]

Thanks for posting those articles Mark, very interesting.

The Iranian nuclear weapons program will be delayed by 1-3 years, if I am reading this right. What are the real world implications of this?
I risk sounding like an idiot now, but the end result will still be Iranian nuclear weapons within a decade or so, the difference being that it will have cost them more money and pride than they originally planned. Is this a correct analysis of the situation?

[Murazor]

I risk sounding like an idiot now, but the end result will still be Iranian nuclear weapons within a decade or so, the difference being that it will have cost them more money and pride than they originally planned. Is this a correct analysis of the situation?

Iran cannot really compete in military R&D against either Israel or the United States. A delay of a decade means that they will be WAY behind the curve and considering recent breakthroughs in missile interception technologies, the hope might well be that even if Iran eventually manages to get nukes by the time they do they won't be able to use them offensively.