Case: Stuxnet Worm

The Stuxnet worm has been in the news a lot recently, but you might not be familiar with the worm’s name, as it is often not included in the news stories on the subject. Stuxnet is a computer worm that has significantly set back the Iranian nuclear development program. It is an extremely sophisticated piece of software, and in fact, is so sophisticated that many experts believe that it could have been developed only by a nation state. A common speculation is that the CIA and the Israeli government jointly developed the worm. Its sophistication is manifest in various ways:

■ The worm attacked three different operating systems, including Windows.

■ There were four (an unprecedented number) instances of a zero day attack for Windows systems.

■ In addition to the above exploits, the worm also exploited other previously identified, vulnerabilities, and included a Windows rootkit.

■ It was a very large worm, consisting of over 500,000 bytes of programming.

■ The worm was very specific in its target. Although it would propagate indiscriminately, through removable memory devices such as USB Flash drives, it would unleash its attack only on Siemens Supervisory Control And Data Acquisition (SCADA) systems, which were used in the centrifuges in Iran’s nuclear program. The attack included a man-in-the-middle capability that ensured that, after the worm caused the centrifuges to malfunction, it replaced the signals drawing attention to the problem with signals that all was well, so that the centrifuges were not shut down until they were destroyed. Although detailed information is not available, it appears that approximately one thousand centrifuges were destroyed by the worm. Moreover, so many systems were infected that it is not clear that the problem is over for the Iranians.

■ The worm was released in several variants to explicitly attack five different sites in Iran.

At the time of this writing, the Stuxnet worm is clearly the most sophisticated worm to date. The kinds of sophistication involve expertise in computer software, but also expertise in industrial processes, not to mention detailed knowledge of Iran’s nuclear program. The computers infected in Iran were not connected to the Internet, so it’s clear that various clever methods had to be employed to infect them with the virus. It seems that a large team of experts would be necessary to have created such a sophisticated piece of software. Hence, the assertion that this is an instance of “cyber warfare” seems warranted.